--- /dev/null
+From 8edcb0ba0d56f5914eef11eda6db8bfe74eb9ca8 Mon Sep 17 00:00:00 2001
+From: Stanislaw Gruszka <sgruszka@redhat.com>
+Date: Tue, 10 Jun 2014 12:51:06 +0200
+Subject: rt2x00: disable TKIP on USB
+
+From: Stanislaw Gruszka <sgruszka@redhat.com>
+
+commit 8edcb0ba0d56f5914eef11eda6db8bfe74eb9ca8 upstream.
+
+On USB we can not get atomically TKIP key. We have to disable support
+for TKIP acceleration on USB hardware to avoid bug as showed bellow.
+
+[ 860.827243] BUG: scheduling while atomic: hostapd/3397/0x00000002
+<snip>
+[ 860.827280] Call Trace:
+[ 860.827282] [<ffffffff81682ea6>] dump_stack+0x4d/0x66
+[ 860.827284] [<ffffffff8167eb9b>] __schedule_bug+0x47/0x55
+[ 860.827285] [<ffffffff81685bb3>] __schedule+0x733/0x7b0
+[ 860.827287] [<ffffffff81685c59>] schedule+0x29/0x70
+[ 860.827289] [<ffffffff81684f8a>] schedule_timeout+0x15a/0x2b0
+[ 860.827291] [<ffffffff8105ac50>] ? ftrace_raw_event_tick_stop+0xc0/0xc0
+[ 860.827294] [<ffffffff810c13c2>] ? __module_text_address+0x12/0x70
+[ 860.827296] [<ffffffff81686823>] wait_for_completion_timeout+0xb3/0x140
+[ 860.827298] [<ffffffff81080fc0>] ? wake_up_state+0x20/0x20
+[ 860.827301] [<ffffffff814d5b3d>] usb_start_wait_urb+0x7d/0x150
+[ 860.827303] [<ffffffff814d5cd5>] usb_control_msg+0xc5/0x110
+[ 860.827305] [<ffffffffa02fb0c6>] rt2x00usb_vendor_request+0xc6/0x160 [rt2x00usb]
+[ 860.827307] [<ffffffffa02fb215>] rt2x00usb_vendor_req_buff_lock+0x75/0x150 [rt2x00usb]
+[ 860.827309] [<ffffffffa02fb393>] rt2x00usb_vendor_request_buff+0xa3/0xe0 [rt2x00usb]
+[ 860.827311] [<ffffffffa023d1a3>] rt2x00usb_register_multiread+0x33/0x40 [rt2800usb]
+[ 860.827314] [<ffffffffa05805f9>] rt2800_get_tkip_seq+0x39/0x50 [rt2800lib]
+[ 860.827321] [<ffffffffa0480f88>] ieee80211_get_key+0x218/0x2a0 [mac80211]
+[ 860.827322] [<ffffffff815cc68c>] ? __nlmsg_put+0x6c/0x80
+[ 860.827329] [<ffffffffa051b02e>] nl80211_get_key+0x22e/0x360 [cfg80211]
+
+Reported-and-tested-by: Peter Wu <lekensteyn@gmail.com>
+Reported-and-tested-by: Pontus Fuchs <pontus.fuchs@gmail.com>
+Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/rt2x00/rt2x00mac.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/net/wireless/rt2x00/rt2x00mac.c
++++ b/drivers/net/wireless/rt2x00/rt2x00mac.c
+@@ -487,6 +487,8 @@ int rt2x00mac_set_key(struct ieee80211_h
+ crypto.cipher = rt2x00crypto_key_to_cipher(key);
+ if (crypto.cipher == CIPHER_NONE)
+ return -EOPNOTSUPP;
++ if (crypto.cipher == CIPHER_TKIP && rt2x00_is_usb(rt2x00dev))
++ return -EOPNOTSUPP;
+
+ crypto.cmd = cmd;
+
--- /dev/null
+From 616a8394b5df8c88f4dd416f4527439a4e365034 Mon Sep 17 00:00:00 2001
+From: Stanislaw Gruszka <stf_xl@wp.pl>
+Date: Mon, 16 Jun 2014 18:45:15 +0200
+Subject: rt2x00: fix rfkill regression on rt2500pci
+
+From: Stanislaw Gruszka <stf_xl@wp.pl>
+
+commit 616a8394b5df8c88f4dd416f4527439a4e365034 upstream.
+
+As reported by Niels, starting rfkill polling during device probe
+(commit e2bc7c5, generally sane change) broke rfkill on rt2500pci
+device. I considered that bug as some initalization issue, which
+should be fixed on rt2500pci specific code. But after several
+attempts (see bug report for details) we fail to find working solution.
+Hence I decided to revert to old behaviour on rt2500pci to fix
+regression.
+
+Additionally patch also unregister rfkill on device remove instead
+of ifconfig down, what was another issue introduced by bad commit.
+
+Bug report:
+https://bugzilla.kernel.org/show_bug.cgi?id=73821
+
+Fixes: e2bc7c5f3cb8 ("rt2x00: Fix rfkill_polling register function.")
+Bisected-by: Niels <nille0386@googlemail.com>
+Reported-and-tested-by: Niels <nille0386@googlemail.com>
+Signed-off-by: Stanislaw Gruszka <stf_xl@wp.pl>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/rt2x00/rt2500pci.c | 7 ++++++-
+ drivers/net/wireless/rt2x00/rt2x00.h | 1 +
+ drivers/net/wireless/rt2x00/rt2x00dev.c | 24 +++++++++++++++++++++---
+ 3 files changed, 28 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/wireless/rt2x00/rt2500pci.c
++++ b/drivers/net/wireless/rt2x00/rt2500pci.c
+@@ -1681,8 +1681,13 @@ static int rt2500pci_init_eeprom(struct
+ /*
+ * Detect if this device has an hardware controlled radio.
+ */
+- if (rt2x00_get_field16(eeprom, EEPROM_ANTENNA_HARDWARE_RADIO))
++ if (rt2x00_get_field16(eeprom, EEPROM_ANTENNA_HARDWARE_RADIO)) {
+ __set_bit(CAPABILITY_HW_BUTTON, &rt2x00dev->cap_flags);
++ /*
++ * On this device RFKILL initialized during probe does not work.
++ */
++ __set_bit(REQUIRE_DELAYED_RFKILL, &rt2x00dev->cap_flags);
++ }
+
+ /*
+ * Check if the BBP tuning should be enabled.
+--- a/drivers/net/wireless/rt2x00/rt2x00.h
++++ b/drivers/net/wireless/rt2x00/rt2x00.h
+@@ -693,6 +693,7 @@ enum rt2x00_capability_flags {
+ REQUIRE_SW_SEQNO,
+ REQUIRE_HT_TX_DESC,
+ REQUIRE_PS_AUTOWAKE,
++ REQUIRE_DELAYED_RFKILL,
+
+ /*
+ * Capabilities
+--- a/drivers/net/wireless/rt2x00/rt2x00dev.c
++++ b/drivers/net/wireless/rt2x00/rt2x00dev.c
+@@ -1126,9 +1126,10 @@ static void rt2x00lib_uninitialize(struc
+ return;
+
+ /*
+- * Unregister extra components.
++ * Stop rfkill polling.
+ */
+- rt2x00rfkill_unregister(rt2x00dev);
++ if (test_bit(REQUIRE_DELAYED_RFKILL, &rt2x00dev->cap_flags))
++ rt2x00rfkill_unregister(rt2x00dev);
+
+ /*
+ * Allow the HW to uninitialize.
+@@ -1166,6 +1167,12 @@ static int rt2x00lib_initialize(struct r
+
+ set_bit(DEVICE_STATE_INITIALIZED, &rt2x00dev->flags);
+
++ /*
++ * Start rfkill polling.
++ */
++ if (test_bit(REQUIRE_DELAYED_RFKILL, &rt2x00dev->cap_flags))
++ rt2x00rfkill_register(rt2x00dev);
++
+ return 0;
+ }
+
+@@ -1375,7 +1382,12 @@ int rt2x00lib_probe_dev(struct rt2x00_de
+ rt2x00link_register(rt2x00dev);
+ rt2x00leds_register(rt2x00dev);
+ rt2x00debug_register(rt2x00dev);
+- rt2x00rfkill_register(rt2x00dev);
++
++ /*
++ * Start rfkill polling.
++ */
++ if (!test_bit(REQUIRE_DELAYED_RFKILL, &rt2x00dev->cap_flags))
++ rt2x00rfkill_register(rt2x00dev);
+
+ return 0;
+
+@@ -1391,6 +1403,12 @@ void rt2x00lib_remove_dev(struct rt2x00_
+ clear_bit(DEVICE_STATE_PRESENT, &rt2x00dev->flags);
+
+ /*
++ * Stop rfkill polling.
++ */
++ if (!test_bit(REQUIRE_DELAYED_RFKILL, &rt2x00dev->cap_flags))
++ rt2x00rfkill_unregister(rt2x00dev);
++
++ /*
+ * Disable radio.
+ */
+ rt2x00lib_disable_radio(rt2x00dev);
virtio-scsi-avoid-cancelling-uninitialized-work-items.patch
scsi_error-fix-invalid-setting-of-host-byte.patch
virtio-scsi-fix-various-bad-behavior-on-aborted-requests.patch
+xhci-use-correct-slot-id-when-handling-a-reset-device-command.patch
+xhci-correct-burst-count-field-for-isoc-transfers-on-1.0-xhci-hosts.patch
+xhci-fix-runtime-suspended-xhci-from-blocking-system-suspend.patch
+usb-option-add-device-id-for-speedup-su9800-usb-3g-modem.patch
+usb-option-add-modify-olivetti-olicard-modems.patch
+usb-musb-ux500-don-t-propagate-the-of-node.patch
+usb-musb-ensure-that-cppi41-timer-gets-armed-on-premature-dma-tx-irq.patch
+usb-musb-fix-panic-upon-musb_am335x-module-removal.patch
+usb-chipidea-udc-delete-td-from-req-s-td-list-at-ep_dequeue.patch
+usb-ftdi_sio-fix-null-deref-at-port-probe.patch
+usb-gadget-f_fs-resurect-usb_functionfs_descs_head-structure.patch
+usb-gadget-f_fs-fix-null-pointer-dereference-when-there-are-no-strings.patch
+rt2x00-disable-tkip-on-usb.patch
+rt2x00-fix-rfkill-regression-on-rt2500pci.patch
--- /dev/null
+From e4adcff09ca39ecbcc4851d40d0f0a5458e7b77a Mon Sep 17 00:00:00 2001
+From: Peter Chen <peter.chen@freescale.com>
+Date: Wed, 2 Jul 2014 12:16:31 +0800
+Subject: usb: chipidea: udc: delete td from req's td list at ep_dequeue
+
+From: Peter Chen <peter.chen@freescale.com>
+
+commit e4adcff09ca39ecbcc4851d40d0f0a5458e7b77a upstream.
+
+We need to delete un-finished td from current request's td list
+at ep_dequeue API, otherwise, this non-user td will be remained
+at td list before this request is freed. So if we do ep_queue->
+ep_dequeue->ep_queue sequence, when the complete interrupt for
+the second ep_queue comes, we search td list for this request,
+the first td (added by the first ep_queue) will be handled, and
+its status is still active, so we will consider the this transfer
+still not be completed, but in fact, it has completed. It causes
+the peripheral side considers it never receives current data for
+this transfer.
+
+We met this problem when do "Error Recovery Test - Device Configured"
+test item for USBCV2 MSC test, the host has never received ACK for
+the IN token for CSW due to peripheral considers it does not get this
+CBW, the USBCV test log like belows:
+
+--------------------------------------------------------------------------
+INFO
+Issuing BOT MSC Reset, reset should always succeed
+INFO
+Retrieving status on CBW endpoint
+INFO
+CBW endpoint status = 0x0
+INFO
+Retrieving status on CSW endpoint
+INFO
+CSW endpoint status = 0x0
+INFO
+Issuing required command (Test Unit Ready) to verify device has recovered
+INFO
+Issuing CBW (attempt #1):
+INFO
+|----- CBW LUN = 0x0
+INFO
+|----- CBW Flags = 0x0
+INFO
+|----- CBW Data Transfer Length = 0x0
+INFO
+|----- CBW CDB Length = 0x6
+INFO
+|----- CBW CDB-00 = 0x0
+INFO
+|----- CBW CDB-01 = 0x0
+INFO
+|----- CBW CDB-02 = 0x0
+INFO
+|----- CBW CDB-03 = 0x0
+INFO
+|----- CBW CDB-04 = 0x0
+INFO
+|----- CBW CDB-05 = 0x0
+INFO
+Issuing CSW : try 1
+INFO
+CSW Bulk Request timed out!
+ERROR
+Failed CSW phase : should have been success or stall
+FAIL
+(5.3.4) The CSW status value must be 0x00, 0x01, or 0x02.
+ERROR
+BOTCommonMSCRequest failed: error=80004000
+
+Cc: Andrzej Pietrasiewicz <andrzej.p@samsung.com>
+Signed-off-by: Peter Chen <peter.chen@freescale.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/chipidea/udc.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/usb/chipidea/udc.c
++++ b/drivers/usb/chipidea/udc.c
+@@ -1326,6 +1326,7 @@ static int ep_dequeue(struct usb_ep *ep,
+ struct ci_hw_ep *hwep = container_of(ep, struct ci_hw_ep, ep);
+ struct ci_hw_req *hwreq = container_of(req, struct ci_hw_req, req);
+ unsigned long flags;
++ struct td_node *node, *tmpnode;
+
+ if (ep == NULL || req == NULL || hwreq->req.status != -EALREADY ||
+ hwep->ep.desc == NULL || list_empty(&hwreq->queue) ||
+@@ -1336,6 +1337,12 @@ static int ep_dequeue(struct usb_ep *ep,
+
+ hw_ep_flush(hwep->ci, hwep->num, hwep->dir);
+
++ list_for_each_entry_safe(node, tmpnode, &hwreq->tds, td) {
++ dma_pool_free(hwep->td_pool, node->ptr, node->dma);
++ list_del(&node->td);
++ kfree(node);
++ }
++
+ /* pop request */
+ list_del_init(&hwreq->queue);
+
--- /dev/null
+From aea1ae8760314e072bf1b773521e9de5d5dda10d Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Thu, 5 Jun 2014 16:05:52 +0200
+Subject: USB: ftdi_sio: fix null deref at port probe
+
+From: Johan Hovold <johan@kernel.org>
+
+commit aea1ae8760314e072bf1b773521e9de5d5dda10d upstream.
+
+Fix NULL-pointer dereference when probing an interface with no
+endpoints.
+
+These devices have two bulk endpoints per interface, but this avoids
+crashing the kernel if a user forces a non-FTDI device to be probed.
+
+Note that the iterator variable was made unsigned in order to avoid
+a maybe-uninitialized compiler warning for ep_desc after the loop.
+
+Fixes: 895f28badce9 ("USB: ftdi_sio: fix hi-speed device packet size
+calculation")
+
+Reported-by: Mike Remski <mremski@mutualink.net>
+Tested-by: Mike Remski <mremski@mutualink.net>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/ftdi_sio.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -1566,14 +1566,17 @@ static void ftdi_set_max_packet_size(str
+ struct usb_device *udev = serial->dev;
+
+ struct usb_interface *interface = serial->interface;
+- struct usb_endpoint_descriptor *ep_desc = &interface->cur_altsetting->endpoint[1].desc;
++ struct usb_endpoint_descriptor *ep_desc;
+
+ unsigned num_endpoints;
+- int i;
++ unsigned i;
+
+ num_endpoints = interface->cur_altsetting->desc.bNumEndpoints;
+ dev_info(&udev->dev, "Number of endpoints %d\n", num_endpoints);
+
++ if (!num_endpoints)
++ return;
++
+ /* NOTE: some customers have programmed FT232R/FT245R devices
+ * with an endpoint size of 0 - not good. In this case, we
+ * want to override the endpoint descriptor setting and use a
--- /dev/null
+From f0688c8b81d2ea239c3fb0b848f623b579238d99 Mon Sep 17 00:00:00 2001
+From: Michal Nazarewicz <mina86@mina86.com>
+Date: Tue, 17 Jun 2014 17:47:41 +0200
+Subject: usb: gadget: f_fs: fix NULL pointer dereference when there are no strings
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Michal Nazarewicz <mina86@mina86.com>
+
+commit f0688c8b81d2ea239c3fb0b848f623b579238d99 upstream.
+
+If the descriptors do not need any strings and user space sends empty
+set of strings, the ffs->stringtabs field remains NULL. Thus
+*ffs->stringtabs in functionfs_bind leads to a NULL pointer
+dereferenece.
+
+The bug was introduced by commit [fd7c9a007f: “use usb_string_ids_n()”].
+
+While at it, remove double initialisation of lang local variable in
+that function.
+
+ffs->strings_count does not need to be checked in any way since in
+the above scenario it will remain zero and usb_string_ids_n() is
+a no-operation when colled with 0 argument.
+
+Signed-off-by: Michal Nazarewicz <mina86@mina86.com>
+Signed-off-by: Felipe Balbi <balbi@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/gadget/f_fs.c | 12 +++++++-----
+ 1 file changed, 7 insertions(+), 5 deletions(-)
+
+--- a/drivers/usb/gadget/f_fs.c
++++ b/drivers/usb/gadget/f_fs.c
+@@ -1227,11 +1227,13 @@ static int functionfs_bind(struct ffs_da
+ ffs->ep0req->context = ffs;
+
+ lang = ffs->stringtabs;
+- for (lang = ffs->stringtabs; *lang; ++lang) {
+- struct usb_string *str = (*lang)->strings;
+- int id = first_id;
+- for (; str->s; ++id, ++str)
+- str->id = id;
++ if (lang) {
++ for (; *lang; ++lang) {
++ struct usb_string *str = (*lang)->strings;
++ int id = first_id;
++ for (; str->s; ++id, ++str)
++ str->id = id;
++ }
+ }
+
+ ffs->gadget = cdev->gadget;
--- /dev/null
+From 09122141785348bf9539762a5f5dbbae3761c783 Mon Sep 17 00:00:00 2001
+From: Michal Nazarewicz <mina86@mina86.com>
+Date: Fri, 13 Jun 2014 15:38:04 +0200
+Subject: usb: gadget: f_fs: resurect usb_functionfs_descs_head structure
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Michal Nazarewicz <mina86@mina86.com>
+
+commit 09122141785348bf9539762a5f5dbbae3761c783 upstream.
+
+Even though usb_functionfs_descs_head structure is now deprecated,
+it has been used by some user space tools. Its removel in commit
+[ac8dde1: “Add flags to descriptors block”] was an oversight
+leading to build breakage for such tools.
+
+Bring it back so that old user space tools can still be build
+without problems on newer kernel versions.
+
+Reported-by: Lad, Prabhakar <prabhakar.csengg@gmail.com>
+Reported-by: Krzysztof Opasiak <k.opasiak@samsung.com>
+Signed-off-by: Michal Nazarewicz <mina86@mina86.com>
+Signed-off-by: Felipe Balbi <balbi@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ include/uapi/linux/usb/functionfs.h | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/include/uapi/linux/usb/functionfs.h
++++ b/include/uapi/linux/usb/functionfs.h
+@@ -27,6 +27,13 @@ struct usb_endpoint_descriptor_no_audio
+ __u8 bInterval;
+ } __attribute__((packed));
+
++/* Legacy format, deprecated as of 3.14. */
++struct usb_functionfs_descs_head {
++ __le32 magic;
++ __le32 length;
++ __le32 fs_count;
++ __le32 hs_count;
++} __attribute__((packed, deprecated));
+
+ /*
+ * All numbers must be in little endian order.
--- /dev/null
+From c58d80f523ffc15ef4d062fc7aeb03793fe39701 Mon Sep 17 00:00:00 2001
+From: Thomas Gleixner <tglx@linutronix.de>
+Date: Fri, 20 Jun 2014 23:41:24 +0200
+Subject: usb: musb: Ensure that cppi41 timer gets armed on premature DMA TX irq
+
+From: Thomas Gleixner <tglx@linutronix.de>
+
+commit c58d80f523ffc15ef4d062fc7aeb03793fe39701 upstream.
+
+Some TI chips raise the DMA complete interrupt before the actual
+transfer has been completed. The code tries to busy wait for a few
+microseconds and if that fails it arms an hrtimer to recheck. So far
+so good, but that has the following issue:
+
+CPU 0 CPU1
+
+start_next_transfer(RQ1);
+
+DMA interrupt
+ if (premature_irq(RQ1))
+ if (!hrtimer_active(timer))
+ hrtimer_start(timer);
+
+hrtimer expires
+ timer->state = CALLBACK_RUNNING;
+ timer->fn()
+ cppi41_recheck_tx_req()
+ complete_request(RQ1);
+ if (requests_pending())
+ start_next_transfer(RQ2);
+
+ DMA interrupt
+ if (premature_irq(RQ2))
+ if (!hrtimer_active(timer))
+ hrtimer_start(timer);
+ timer->state = INACTIVE;
+
+The premature interrupt of request2 on CPU1 does not arm the timer and
+therefor the request completion never happens because it checks for
+!hrtimer_active(). hrtimer_active() evaluates:
+
+ timer->state != HRTIMER_STATE_INACTIVE
+
+which of course evaluates to true in the above case as timer->state is
+CALLBACK_RUNNING.
+
+That's clearly documented:
+
+ * A timer is active, when it is enqueued into the rbtree or the
+ * callback function is running or it's in the state of being migrated
+ * to another cpu.
+
+But that's not what the code wants to check. The code wants to check
+whether the timer is queued, i.e. whether its armed and waiting for
+expiry.
+
+We have a helper function for this: hrtimer_is_queued(). This
+evaluates:
+
+ timer->state & HRTIMER_STATE_QUEUED
+
+So in the above case this evaluates to false and therefor forces the
+DMA interrupt on CPU1 to call hrtimer_start().
+
+Use hrtimer_is_queued() instead of hrtimer_active() and evrything is
+good.
+
+Reported-by: Torben Hohn <torbenh@linutronix.de>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Felipe Balbi <balbi@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/musb/musb_cppi41.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/musb/musb_cppi41.c
++++ b/drivers/usb/musb/musb_cppi41.c
+@@ -266,7 +266,7 @@ static void cppi41_dma_callback(void *pr
+ }
+ list_add_tail(&cppi41_channel->tx_check,
+ &controller->early_tx_list);
+- if (!hrtimer_active(&controller->early_tx)) {
++ if (!hrtimer_is_queued(&controller->early_tx)) {
+ hrtimer_start_range_ns(&controller->early_tx,
+ ktime_set(0, 140 * NSEC_PER_USEC),
+ 40 * NSEC_PER_USEC,
--- /dev/null
+From 7adb5c876e9c0677078a1e1094c6eafd29c30b74 Mon Sep 17 00:00:00 2001
+From: Ezequiel Garcia <ezequiel@vanguardiasur.com.ar>
+Date: Mon, 23 Jun 2014 15:34:22 -0300
+Subject: usb: musb: Fix panic upon musb_am335x module removal
+
+From: Ezequiel Garcia <ezequiel@vanguardiasur.com.ar>
+
+commit 7adb5c876e9c0677078a1e1094c6eafd29c30b74 upstream.
+
+At probe time, the musb_am335x driver register its childs by
+calling of_platform_populate(), which registers all childs in
+the devicetree hierarchy recursively.
+
+On the other side, the driver's remove() function uses of_device_unregister()
+to remove each child of musb_am335x's.
+
+However, when musb_dsps is loaded, its devices are attached to the musb_am335x
+device as musb_am335x childs. Hence, musb_am335x remove() will attempt to
+unregister the devices registered by musb_dsps, which produces a kernel panic.
+
+In other words, the childs in the "struct device" hierarchy are not the same
+as the childs in the "devicetree" hierarchy.
+
+Ideally, we should enforce the removal of the devices registered by
+musb_am335x *only*, instead of all its child devices. However, because of the
+recursive nature of of_platform_populate, this doesn't seem possible.
+
+Therefore, as the only solution at hand, this commit disables musb_am335x
+driver removal capability, preventing it from being ever removed. This was
+originally suggested by Sebastian Siewior:
+
+https://www.mail-archive.com/linux-omap@vger.kernel.org/msg104946.html
+
+And for reference, here's the panic upon module removal:
+
+musb-hdrc musb-hdrc.0.auto: remove, state 4
+usb usb1: USB disconnect, device number 1
+musb-hdrc musb-hdrc.0.auto: USB bus 1 deregistered
+Unable to handle kernel NULL pointer dereference at virtual address 0000008c
+pgd = de11c000
+[0000008c] *pgd=9e174831, *pte=00000000, *ppte=00000000
+Internal error: Oops: 17 [#1] ARM
+Modules linked in: musb_am335x(-) musb_dsps musb_hdrc usbcore usb_common
+CPU: 0 PID: 623 Comm: modprobe Not tainted 3.15.0-rc4-00001-g24efd13 #69
+task: de1b7500 ti: de122000 task.ti: de122000
+PC is at am335x_shutdown+0x10/0x28
+LR is at am335x_shutdown+0xc/0x28
+pc : [<c0327798>] lr : [<c0327794>] psr: a0000013
+sp : de123df8 ip : 00000004 fp : 00028f00
+r10: 00000000 r9 : de122000 r8 : c000e6c4
+r7 : de0e3c10 r6 : de0e3800 r5 : de624010 r4 : de1ec750
+r3 : de0e3810 r2 : 00000000 r1 : 00000001 r0 : 00000000
+Flags: NzCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment user
+Control: 10c5387d Table: 9e11c019 DAC: 00000015
+Process modprobe (pid: 623, stack limit = 0xde122240)
+Stack: (0xde123df8 to 0xde124000)
+3de0: de0e3810 bf054488
+3e00: bf05444c de624010 60000013 bf043650 000012fc de624010 de0e3810 bf043a20
+3e20: de0e3810 bf04b240 c0635b88 c02ca37c c02ca364 c02c8db0 de1b7500 de0e3844
+3e40: de0e3810 c02c8e28 c0635b88 de02824c de0e3810 c02c884c de0e3800 de0e3810
+3e60: de0e3818 c02c5b20 bf05417c de0e3800 de0e3800 c0635b88 de0f2410 c02ca838
+3e80: bf05417c de0e3800 bf055438 c02ca8cc de0e3c10 bf054194 de0e3c10 c02ca37c
+3ea0: c02ca364 c02c8db0 de1b7500 de0e3c44 de0e3c10 c02c8e28 c0635b88 de02824c
+3ec0: de0e3c10 c02c884c de0e3c10 de0e3c10 de0e3c18 c02c5b20 de0e3c10 de0e3c10
+3ee0: 00000000 bf059000 a0000013 c02c5bc0 00000000 bf05900c de0e3c10 c02c5c48
+3f00: de0dd0c0 de1ec970 de0f2410 bf05929c de0f2444 bf05902c de0f2410 c02ca37c
+3f20: c02ca364 c02c8db0 bf05929c de0f2410 bf05929c c02c94c8 bf05929c 00000000
+3f40: 00000800 c02c8ab4 bf0592e0 c007fc40 c00dd820 6273756d 336d615f 00783533
+3f60: c064a0ac de1b7500 de122000 de1b7500 c000e590 00000001 c000e6c4 c0060160
+3f80: 00028e70 00028e70 00028ea4 00000081 60000010 00028e70 00028e70 00028ea4
+3fa0: 00000081 c000e500 00028e70 00028e70 00028ea4 00000800 becb59f8 00027608
+3fc0: 00028e70 00028e70 00028ea4 00000081 00000001 00000001 00000000 00028f00
+3fe0: b6e6b6f0 becb59d4 000160e8 b6e6b6fc 60000010 00028ea4 00000000 00000000
+[<c0327798>] (am335x_shutdown) from [<bf054488>] (dsps_musb_exit+0x3c/0x4c [musb_dsps])
+[<bf054488>] (dsps_musb_exit [musb_dsps]) from [<bf043650>] (musb_shutdown+0x80/0x90 [musb_hdrc])
+[<bf043650>] (musb_shutdown [musb_hdrc]) from [<bf043a20>] (musb_remove+0x24/0x68 [musb_hdrc])
+[<bf043a20>] (musb_remove [musb_hdrc]) from [<c02ca37c>] (platform_drv_remove+0x18/0x1c)
+[<c02ca37c>] (platform_drv_remove) from [<c02c8db0>] (__device_release_driver+0x70/0xc8)
+[<c02c8db0>] (__device_release_driver) from [<c02c8e28>] (device_release_driver+0x20/0x2c)
+[<c02c8e28>] (device_release_driver) from [<c02c884c>] (bus_remove_device+0xdc/0x10c)
+[<c02c884c>] (bus_remove_device) from [<c02c5b20>] (device_del+0x104/0x198)
+[<c02c5b20>] (device_del) from [<c02ca838>] (platform_device_del+0x14/0x9c)
+[<c02ca838>] (platform_device_del) from [<c02ca8cc>] (platform_device_unregister+0xc/0x20)
+[<c02ca8cc>] (platform_device_unregister) from [<bf054194>] (dsps_remove+0x18/0x38 [musb_dsps])
+[<bf054194>] (dsps_remove [musb_dsps]) from [<c02ca37c>] (platform_drv_remove+0x18/0x1c)
+[<c02ca37c>] (platform_drv_remove) from [<c02c8db0>] (__device_release_driver+0x70/0xc8)
+[<c02c8db0>] (__device_release_driver) from [<c02c8e28>] (device_release_driver+0x20/0x2c)
+[<c02c8e28>] (device_release_driver) from [<c02c884c>] (bus_remove_device+0xdc/0x10c)
+[<c02c884c>] (bus_remove_device) from [<c02c5b20>] (device_del+0x104/0x198)
+[<c02c5b20>] (device_del) from [<c02c5bc0>] (device_unregister+0xc/0x20)
+[<c02c5bc0>] (device_unregister) from [<bf05900c>] (of_remove_populated_child+0xc/0x14 [musb_am335x])
+[<bf05900c>] (of_remove_populated_child [musb_am335x]) from [<c02c5c48>] (device_for_each_child+0x44/0x70)
+[<c02c5c48>] (device_for_each_child) from [<bf05902c>] (am335x_child_remove+0x18/0x30 [musb_am335x])
+[<bf05902c>] (am335x_child_remove [musb_am335x]) from [<c02ca37c>] (platform_drv_remove+0x18/0x1c)
+[<c02ca37c>] (platform_drv_remove) from [<c02c8db0>] (__device_release_driver+0x70/0xc8)
+[<c02c8db0>] (__device_release_driver) from [<c02c94c8>] (driver_detach+0xb4/0xb8)
+[<c02c94c8>] (driver_detach) from [<c02c8ab4>] (bus_remove_driver+0x4c/0xa0)
+[<c02c8ab4>] (bus_remove_driver) from [<c007fc40>] (SyS_delete_module+0x128/0x1cc)
+[<c007fc40>] (SyS_delete_module) from [<c000e500>] (ret_fast_syscall+0x0/0x48)
+
+Fixes: 97238b35d5bb ("usb: musb: dsps: use proper child nodes")
+Acked-by: George Cherian <george.cherian@ti.com>
+Signed-off-by: Ezequiel Garcia <ezequiel@vanguardiasur.com.ar>
+Signed-off-by: Felipe Balbi <balbi@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/musb/musb_am335x.c | 23 ++++++-----------------
+ 1 file changed, 6 insertions(+), 17 deletions(-)
+
+--- a/drivers/usb/musb/musb_am335x.c
++++ b/drivers/usb/musb/musb_am335x.c
+@@ -19,21 +19,6 @@ err:
+ return ret;
+ }
+
+-static int of_remove_populated_child(struct device *dev, void *d)
+-{
+- struct platform_device *pdev = to_platform_device(dev);
+-
+- of_device_unregister(pdev);
+- return 0;
+-}
+-
+-static int am335x_child_remove(struct platform_device *pdev)
+-{
+- device_for_each_child(&pdev->dev, NULL, of_remove_populated_child);
+- pm_runtime_disable(&pdev->dev);
+- return 0;
+-}
+-
+ static const struct of_device_id am335x_child_of_match[] = {
+ { .compatible = "ti,am33xx-usb" },
+ { },
+@@ -42,13 +27,17 @@ MODULE_DEVICE_TABLE(of, am335x_child_of_
+
+ static struct platform_driver am335x_child_driver = {
+ .probe = am335x_child_probe,
+- .remove = am335x_child_remove,
+ .driver = {
+ .name = "am335x-usb-childs",
+ .of_match_table = am335x_child_of_match,
+ },
+ };
+
+-module_platform_driver(am335x_child_driver);
++static int __init am335x_child_init(void)
++{
++ return platform_driver_register(&am335x_child_driver);
++}
++module_init(am335x_child_init);
++
+ MODULE_DESCRIPTION("AM33xx child devices");
+ MODULE_LICENSE("GPL v2");
--- /dev/null
+From 82363cf2eeafeea6ba88849f5e2febdc8a05943f Mon Sep 17 00:00:00 2001
+From: Linus Walleij <linus.walleij@linaro.org>
+Date: Tue, 10 Jun 2014 10:54:16 +0200
+Subject: usb: musb: ux500: don't propagate the OF node
+
+From: Linus Walleij <linus.walleij@linaro.org>
+
+commit 82363cf2eeafeea6ba88849f5e2febdc8a05943f upstream.
+
+There is a regression in the upcoming v3.16-rc1, that is caused
+by a problem that has been around for a while but now finally
+hangs the system. The bootcrawl looks like this:
+
+pinctrl-nomadik soc:pinctrl: pin GPIO256_AF28 already
+requested by a03e0000.usb_per5; cannot claim for musb-hdrc.0.auto
+pinctrl-nomadik soc:pinctrl: pin-256 (musb-hdrc.0.auto) status -22
+pinctrl-nomadik soc:pinctrl: could not request pin 256
+(GPIO256_AF28) from group usb_a_1 on device pinctrl-nomadik
+musb-hdrc musb-hdrc.0.auto: Error applying setting, reverse
+things back
+HS USB OTG: no transceiver configured
+musb-hdrc musb-hdrc.0.auto: musb_init_controller failed
+with status -517
+platform musb-hdrc.0.auto: Driver musb-hdrc requests
+probe deferral
+(...)
+
+The ux500 MUSB driver propagates the OF node to the dynamically
+created musb-hdrc device, which is incorrect as it makes the OF
+core believe there are two devices spun from the very same
+DT node, which confuses other parts of the device core, notably
+the pin control subsystem, which will try to apply all the pin
+control settings also to the HDRC device as it gets
+instantiated. (The OMAP2430 for example, does not set the
+of_node member.)
+
+Cc: Arnd Bergmann <arnd@arndb.de>
+Acked-by: Lee Jones <lee.jones@linaro.org>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Felipe Balbi <balbi@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/musb/ux500.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/drivers/usb/musb/ux500.c
++++ b/drivers/usb/musb/ux500.c
+@@ -274,7 +274,6 @@ static int ux500_probe(struct platform_d
+ musb->dev.parent = &pdev->dev;
+ musb->dev.dma_mask = &pdev->dev.coherent_dma_mask;
+ musb->dev.coherent_dma_mask = pdev->dev.coherent_dma_mask;
+- musb->dev.of_node = pdev->dev.of_node;
+
+ glue->dev = &pdev->dev;
+ glue->musb = musb;
--- /dev/null
+From 1cab4c68e339086cdaff7535848e878e8f261fca Mon Sep 17 00:00:00 2001
+From: Oliver Neukum <oneukum@suse.de>
+Date: Tue, 20 May 2014 16:27:40 +0200
+Subject: USB: option: add device ID for SpeedUp SU9800 usb 3g modem
+
+From: Oliver Neukum <oneukum@suse.de>
+
+commit 1cab4c68e339086cdaff7535848e878e8f261fca upstream.
+
+Reported by Alif Mubarak Ahmad:
+
+This device vendor and product id is 1c9e:9800
+It is working as serial interface with generic usbserial driver.
+I thought it is more suitable to use usbserial option driver, which has
+better capability distinguishing between modem serial interface and
+micro sd storage interface.
+
+[ johan: style changes ]
+
+Signed-off-by: Oliver Neukum <oneukum@suse.de>
+Tested-by: Alif Mubarak Ahmad <alive4ever@live.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/option.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -352,6 +352,9 @@ static void option_instat_callback(struc
+ /* Zoom */
+ #define ZOOM_PRODUCT_4597 0x9607
+
++/* SpeedUp SU9800 usb 3g modem */
++#define SPEEDUP_PRODUCT_SU9800 0x9800
++
+ /* Haier products */
+ #define HAIER_VENDOR_ID 0x201e
+ #define HAIER_PRODUCT_CE100 0x2009
+@@ -1577,6 +1580,7 @@ static const struct usb_device_id option
+ { USB_DEVICE(LONGCHEER_VENDOR_ID, FOUR_G_SYSTEMS_PRODUCT_W14),
+ .driver_info = (kernel_ulong_t)&four_g_w14_blacklist
+ },
++ { USB_DEVICE_INTERFACE_CLASS(LONGCHEER_VENDOR_ID, SPEEDUP_PRODUCT_SU9800, 0xff) },
+ { USB_DEVICE(LONGCHEER_VENDOR_ID, ZOOM_PRODUCT_4597) },
+ { USB_DEVICE(LONGCHEER_VENDOR_ID, IBALL_3_5G_CONNECT) },
+ { USB_DEVICE(HAIER_VENDOR_ID, HAIER_PRODUCT_CE100) },
--- /dev/null
+From b0ebef36e93703e59003ad6a1a20227e47714417 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Bj=C3=B8rn=20Mork?= <bjorn@mork.no>
+Date: Fri, 6 Jun 2014 17:25:56 +0200
+Subject: usb: option: add/modify Olivetti Olicard modems
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Bjørn Mork <bjorn@mork.no>
+
+commit b0ebef36e93703e59003ad6a1a20227e47714417 upstream.
+
+Adding a couple of Olivetti modems and blacklisting the net
+function on a couple which are already supported.
+
+Reported-by: Lars Melin <larsm17@gmail.com>
+Signed-off-by: Bjørn Mork <bjorn@mork.no>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/option.c | 22 ++++++++++++++++------
+ 1 file changed, 16 insertions(+), 6 deletions(-)
+
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -375,8 +375,12 @@ static void option_instat_callback(struc
+ /* Olivetti products */
+ #define OLIVETTI_VENDOR_ID 0x0b3c
+ #define OLIVETTI_PRODUCT_OLICARD100 0xc000
++#define OLIVETTI_PRODUCT_OLICARD120 0xc001
++#define OLIVETTI_PRODUCT_OLICARD140 0xc002
+ #define OLIVETTI_PRODUCT_OLICARD145 0xc003
++#define OLIVETTI_PRODUCT_OLICARD155 0xc004
+ #define OLIVETTI_PRODUCT_OLICARD200 0xc005
++#define OLIVETTI_PRODUCT_OLICARD160 0xc00a
+ #define OLIVETTI_PRODUCT_OLICARD500 0xc00b
+
+ /* Celot products */
+@@ -1615,15 +1619,21 @@ static const struct usb_device_id option
+ { USB_DEVICE(SIEMENS_VENDOR_ID, CINTERION_PRODUCT_HC25_MDMNET) },
+ { USB_DEVICE(SIEMENS_VENDOR_ID, CINTERION_PRODUCT_HC28_MDM) }, /* HC28 enumerates with Siemens or Cinterion VID depending on FW revision */
+ { USB_DEVICE(SIEMENS_VENDOR_ID, CINTERION_PRODUCT_HC28_MDMNET) },
+-
+- { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD100) },
++ { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD100),
++ .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
++ { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD120),
++ .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
++ { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD140),
++ .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
+ { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD145) },
++ { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD155),
++ .driver_info = (kernel_ulong_t)&net_intf6_blacklist },
+ { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD200),
+- .driver_info = (kernel_ulong_t)&net_intf6_blacklist
+- },
++ .driver_info = (kernel_ulong_t)&net_intf6_blacklist },
++ { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD160),
++ .driver_info = (kernel_ulong_t)&net_intf6_blacklist },
+ { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD500),
+- .driver_info = (kernel_ulong_t)&net_intf4_blacklist
+- },
++ .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
+ { USB_DEVICE(CELOT_VENDOR_ID, CELOT_PRODUCT_CT680M) }, /* CT-650 CDMA 450 1xEVDO modem */
+ { USB_DEVICE_AND_INTERFACE_INFO(SAMSUNG_VENDOR_ID, SAMSUNG_PRODUCT_GT_B3730, USB_CLASS_CDC_DATA, 0x00, 0x00) }, /* Samsung GT-B3730 LTE USB modem.*/
+ { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CEM600) },
--- /dev/null
+From 3213b151387df0b95f4eada104f68eb1c1409cb3 Mon Sep 17 00:00:00 2001
+From: Mathias Nyman <mathias.nyman@linux.intel.com>
+Date: Tue, 24 Jun 2014 17:14:41 +0300
+Subject: xhci: correct burst count field for isoc transfers on 1.0 xhci hosts
+
+From: Mathias Nyman <mathias.nyman@linux.intel.com>
+
+commit 3213b151387df0b95f4eada104f68eb1c1409cb3 upstream.
+
+The transfer burst count (TBC) field in xhci 1.0 hosts should be set
+to the number of bursts needed to transfer all packets in a isoc TD.
+Supported values are 0-2 (1 to 3 bursts per service interval).
+
+Formula for TBC calculation is given in xhci spec section 4.11.2.3:
+TBC = roundup( Transfer Descriptor Packet Count / Max Burst Size +1 ) - 1
+
+This patch should be applied to stable kernels since 3.0 that contain
+the commit 5cd43e33b9519143f06f507dd7cbee6b7a621885
+"xhci 1.0: Set transfer burst count field."
+
+Suggested-by: ShiChun Ma <masc2008@qq.com>
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/host/xhci-ring.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -3666,7 +3666,7 @@ static unsigned int xhci_get_burst_count
+ return 0;
+
+ max_burst = urb->ep->ss_ep_comp.bMaxBurst;
+- return roundup(total_packet_count, max_burst + 1) - 1;
++ return DIV_ROUND_UP(total_packet_count, max_burst + 1) - 1;
+ }
+
+ /*
--- /dev/null
+From d6236f6d1d885aa19d1cd7317346fe795227a3cc Mon Sep 17 00:00:00 2001
+From: "Wang, Yu" <yu.y.wang@intel.com>
+Date: Tue, 24 Jun 2014 17:14:44 +0300
+Subject: xhci: Fix runtime suspended xhci from blocking system suspend.
+
+From: "Wang, Yu" <yu.y.wang@intel.com>
+
+commit d6236f6d1d885aa19d1cd7317346fe795227a3cc upstream.
+
+The system suspend flow as following:
+1, Freeze all user processes and kenrel threads.
+
+2, Try to suspend all devices.
+
+2.1, If pci device is in RPM suspended state, then pci driver will try
+to resume it to RPM active state in the prepare stage.
+
+2.2, xhci_resume function calls usb_hcd_resume_root_hub to queue two
+workqueue items to resume usb2&usb3 roothub devices.
+
+2.3, Call suspend callbacks of devices.
+
+2.3.1, All suspend callbacks of all hcd's children, including
+roothub devices are called.
+
+2.3.2, Finally, hcd_pci_suspend callback is called.
+
+Due to workqueue threads were already frozen in step 1, the workqueue
+items can't be scheduled, and the roothub devices can't be resumed in
+this flow. The HCD_FLAG_WAKEUP_PENDING flag which is set in
+usb_hcd_resume_root_hub won't be cleared. Finally,
+hcd_pci_suspend will return -EBUSY, and system suspend fails.
+
+The reason why this issue doesn't show up very often is due to that
+choose_wakeup will be called in step 2.3.1. In step 2.3.1, if
+udev->do_remote_wakeup is not equal to device_may_wakeup(&udev->dev), then
+udev will resume to RPM active for changing the wakeup settings. This
+has been a lucky hit which hides this issue.
+
+For some special xHCI controllers which have no USB2 port, then roothub
+will not match hub driver due to probe failed. Then its
+do_remote_wakeup will be set to zero, and we won't be as lucky.
+
+xhci driver doesn't need to resume roothub devices everytime like in
+the above case. It's only needed when there are pending event TRBs.
+
+This patch should be back-ported to kernels as old as 3.2, that
+contains the commit f69e3120df82391a0ee8118e0a156239a06b2afb
+"USB: XHCI: resume root hubs when the controller resumes"
+
+Signed-off-by: Wang, Yu <yu.y.wang@intel.com>
+Acked-by: Alan Stern <stern@rowland.harvard.edu>
+[use readl() instead of removed xhci_readl(), reword commit message -Mathias]
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/host/xhci.c | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -928,7 +928,7 @@ int xhci_suspend(struct xhci_hcd *xhci)
+ */
+ int xhci_resume(struct xhci_hcd *xhci, bool hibernated)
+ {
+- u32 command, temp = 0;
++ u32 command, temp = 0, status;
+ struct usb_hcd *hcd = xhci_to_hcd(xhci);
+ struct usb_hcd *secondary_hcd;
+ int retval = 0;
+@@ -1046,8 +1046,12 @@ int xhci_resume(struct xhci_hcd *xhci, b
+
+ done:
+ if (retval == 0) {
+- usb_hcd_resume_root_hub(hcd);
+- usb_hcd_resume_root_hub(xhci->shared_hcd);
++ /* Resume root hubs only when have pending events. */
++ status = readl(&xhci->op_regs->status);
++ if (status & STS_EINT) {
++ usb_hcd_resume_root_hub(hcd);
++ usb_hcd_resume_root_hub(xhci->shared_hcd);
++ }
+ }
+
+ /*
--- /dev/null
+From 6fcfb0d682a8212d321a6131adc94daf0905992a Mon Sep 17 00:00:00 2001
+From: Mathias Nyman <mathias.nyman@linux.intel.com>
+Date: Tue, 24 Jun 2014 17:14:40 +0300
+Subject: xhci: Use correct SLOT ID when handling a reset device command
+
+From: Mathias Nyman <mathias.nyman@linux.intel.com>
+
+commit 6fcfb0d682a8212d321a6131adc94daf0905992a upstream.
+
+Command completion events normally include command completion status,
+SLOT_ID, and a pointer to the original command. Reset device command
+completion SLOT_ID may be zero according to xhci specs 4.6.11.
+
+VIA controllers set the SLOT_ID to zero, triggering a WARN_ON in the
+command completion handler.
+
+Use the SLOT ID found from the original command instead.
+
+This patch should be applied to stable kernels since 3.13 that contain
+the commit 20e7acb13ff48fbc884d5918c3697c27de63922a
+"xhci: use completion event's slot id rather than dig it out of command"
+
+Reported-by: Saran Neti <sarannmr@gmail.com>
+Tested-by: Saran Neti <sarannmr@gmail.com>
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/host/xhci-ring.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -1578,8 +1578,11 @@ static void handle_cmd_completion(struct
+ xhci_handle_cmd_reset_ep(xhci, slot_id, cmd_trb, cmd_comp_code);
+ break;
+ case TRB_RESET_DEV:
+- WARN_ON(slot_id != TRB_TO_SLOT_ID(
+- le32_to_cpu(cmd_trb->generic.field[3])));
++ /* SLOT_ID field in reset device cmd completion event TRB is 0.
++ * Use the SLOT_ID from the command TRB instead (xhci 4.6.11)
++ */
++ slot_id = TRB_TO_SLOT_ID(
++ le32_to_cpu(cmd_trb->generic.field[3]));
+ xhci_handle_cmd_reset_dev(xhci, slot_id, event);
+ break;
+ case TRB_NEC_GET_FW:
projects / thirdparty / kernel / stable-queue.git / commitdiff
