]> nv-tegra.nvidia Code Review - linux-3.10.git/blobdiff - drivers/usb/host/xhci-ring.c
xhci-hcd: support soft retry on SS transfer error
[linux-3.10.git] / drivers / usb / host / xhci-ring.c
index 37e23ed1fe1ea4ebb04e835d69737dd404aaac52..5f12cd73fb3b4efa06a6b04f7f3d14fa3154401e 100644 (file)
@@ -66,6 +66,7 @@
 
 #include <linux/scatterlist.h>
 #include <linux/slab.h>
+#include <linux/usb/phy.h>
 #include "xhci.h"
 
 static int handle_cmd_in_cmd_wait_list(struct xhci_hcd *xhci,
@@ -85,7 +86,7 @@ dma_addr_t xhci_trb_virt_to_dma(struct xhci_segment *seg,
                return 0;
        /* offset in TRBs */
        segment_offset = trb - seg->trbs;
-       if (segment_offset > TRBS_PER_SEGMENT)
+       if (segment_offset >= TRBS_PER_SEGMENT)
                return 0;
        return seg->dma + (segment_offset * sizeof(*trb));
 }
@@ -122,6 +123,16 @@ static int enqueue_is_link_trb(struct xhci_ring *ring)
        return TRB_TYPE_LINK_LE32(link->control);
 }
 
+union xhci_trb *xhci_find_next_enqueue(struct xhci_ring *ring)
+{
+       /* Enqueue pointer can be left pointing to the link TRB,
+        * we must handle that
+        */
+       if (TRB_TYPE_LINK_LE32(ring->enqueue->link.control))
+               return ring->enq_seg->next->trbs;
+       return ring->enqueue;
+}
+
 /* Updates trb to point to the next TRB in the ring, and updates seg if the next
  * TRB is in a new segment.  This does not skip over link TRBs, and it does not
  * effect the ring dequeue or enqueue pointers.
@@ -318,7 +329,7 @@ static int xhci_abort_cmd_ring(struct xhci_hcd *xhci)
         * seconds), then it should assume that the there are
         * larger problems with the xHC and assert HCRST.
         */
-       ret = handshake(xhci, &xhci->op_regs->cmd_ring,
+       ret = xhci_handshake(xhci, &xhci->op_regs->cmd_ring,
                        CMD_RING_RUNNING, 0, 5 * 1000 * 1000);
        if (ret < 0) {
                xhci_err(xhci, "Stopped the command ring failed, "
@@ -388,6 +399,10 @@ int xhci_cancel_cmd(struct xhci_hcd *xhci, struct xhci_command *command,
                        spin_unlock_irqrestore(&xhci->lock, flags);
                        usb_hc_died(xhci_to_hcd(xhci)->primary_hcd);
                        xhci_dbg(xhci, "xHCI host controller is dead.\n");
+                       if (xhci_to_hcd(xhci)->driver &&
+                               xhci_to_hcd(xhci)->driver->hcd_reinit)
+                               xhci_to_hcd(xhci)->driver->hcd_reinit(
+                                       xhci_to_hcd(xhci));
                        return retval;
                }
        }
@@ -434,7 +449,7 @@ static void ring_doorbell_for_active_rings(struct xhci_hcd *xhci,
 
        /* A ring has pending URBs if its TD list is not empty */
        if (!(ep->ep_state & EP_HAS_STREAMS)) {
-               if (!(list_empty(&ep->ring->td_list)))
+               if (ep->ring && !(list_empty(&ep->ring->td_list)))
                        xhci_ring_ep_doorbell(xhci, slot_id, ep_index, 0);
                return;
        }
@@ -847,8 +862,12 @@ remove_finished_td:
                /* Otherwise ring the doorbell(s) to restart queued transfers */
                ring_doorbell_for_active_rings(xhci, slot_id, ep_index);
        }
-       ep->stopped_td = NULL;
-       ep->stopped_trb = NULL;
+
+       /* Clear stopped_td and stopped_trb if endpoint is not halted */
+       if (!(ep->ep_state & EP_HALTED)) {
+               ep->stopped_td = NULL;
+               ep->stopped_trb = NULL;
+       }
 
        /*
         * Drop the lock and complete the URBs in the cancelled TD list.
@@ -989,6 +1008,8 @@ void xhci_stop_endpoint_command_watchdog(unsigned long arg)
        xhci_dbg(xhci, "Calling usb_hc_died()\n");
        usb_hc_died(xhci_to_hcd(xhci)->primary_hcd);
        xhci_dbg(xhci, "xHCI host controller is dead.\n");
+       if (xhci_to_hcd(xhci)->driver && xhci_to_hcd(xhci)->driver->hcd_reinit)
+               xhci_to_hcd(xhci)->driver->hcd_reinit(xhci_to_hcd(xhci));
 }
 
 
@@ -1164,9 +1185,15 @@ static void handle_reset_ep_completion(struct xhci_hcd *xhci,
                                false);
                xhci_ring_cmd_db(xhci);
        } else {
-               /* Clear our internal halted state and restart the ring(s) */
+               /* Clear our internal halted state */
                xhci->devs[slot_id]->eps[ep_index].ep_state &= ~EP_HALTED;
-               ring_doorbell_for_active_rings(xhci, slot_id, ep_index);
+
+               /* ring doorbell for the endpoint under soft-retry */
+               if (TRB_TSP | le32_to_cpu(trb->generic.field[3])) {
+                       xhci_dbg(xhci, "Ring doorbell for slot_id %d ep_index 0x%x\n",
+                                slot_id, ep_index);
+                       xhci_ring_ep_doorbell(xhci, slot_id, ep_index, 0);
+               }
        }
 }
 
@@ -1219,7 +1246,7 @@ static void xhci_cmd_to_noop(struct xhci_hcd *xhci, struct xhci_cd *cur_cd)
 {
        struct xhci_segment *cur_seg;
        union xhci_trb *cmd_trb;
-       u32 cycle_state;
+       u32 cycle_state = 0;
 
        if (xhci->cmd_ring->dequeue == xhci->cmd_ring->enqueue)
                return;
@@ -1228,6 +1255,17 @@ static void xhci_cmd_to_noop(struct xhci_hcd *xhci, struct xhci_cd *cur_cd)
        cur_seg = find_trb_seg(xhci->cmd_ring->first_seg,
                        xhci->cmd_ring->dequeue, &cycle_state);
 
+       if (!cur_seg) {
+               xhci_warn(xhci, "Command ring mismatch, dequeue = %p %llx (dma)\n",
+                               xhci->cmd_ring->dequeue,
+                               (unsigned long long)
+                               xhci_trb_virt_to_dma(xhci->cmd_ring->deq_seg,
+                                       xhci->cmd_ring->dequeue));
+               xhci_debug_ring(xhci, xhci->cmd_ring);
+               xhci_dbg_ring_ptrs(xhci, xhci->cmd_ring);
+               return;
+       }
+
        /* find the command trb matched by cd from command ring */
        for (cmd_trb = xhci->cmd_ring->dequeue;
                        cmd_trb != xhci->cmd_ring->enqueue;
@@ -1379,8 +1417,18 @@ static void handle_cmd_completion(struct xhci_hcd *xhci,
                        inc_deq(xhci, xhci->cmd_ring);
                        return;
                }
+               /* There is no command to handle if we get a stop event when the
+                * command ring is empty, event->cmd_trb points to the next
+                * unset command
+                */
+               if (xhci->cmd_ring->dequeue == xhci->cmd_ring->enqueue)
+                       return;
        }
 
+       /* return if command ring is empty */
+       if (xhci->cmd_ring->dequeue == xhci->cmd_ring->enqueue)
+               return;
+
        switch (le32_to_cpu(xhci->cmd_ring->dequeue->generic.field[3])
                & TRB_TYPE_BITMASK) {
        case TRB_TYPE(TRB_ENABLE_SLOT):
@@ -1576,6 +1624,7 @@ static void handle_port_status(struct xhci_hcd *xhci,
        struct xhci_bus_state *bus_state;
        __le32 __iomem **port_array;
        bool bogus_port_status = false;
+       struct usb_device *udev;
 
        /* Port status change events always have a successful completion code */
        if (GET_COMP_CODE(le32_to_cpu(event->generic.field[2])) != COMP_SUCCESS) {
@@ -1588,14 +1637,20 @@ static void handle_port_status(struct xhci_hcd *xhci,
        max_ports = HCS_MAX_PORTS(xhci->hcs_params1);
        if ((port_id <= 0) || (port_id > max_ports)) {
                xhci_warn(xhci, "Invalid port id %d\n", port_id);
-               bogus_port_status = true;
-               goto cleanup;
+               inc_deq(xhci, xhci->event_ring);
+               return;
        }
 
        /* Figure out which usb_hcd this port is attached to:
         * is it a USB 3.0 port or a USB 2.0/1.1 port?
         */
        major_revision = xhci->port_array[port_id - 1];
+
+       /* Find the right roothub. */
+       hcd = xhci_to_hcd(xhci);
+       if ((major_revision == 0x03) != (hcd->speed == HCD_USB3))
+               hcd = xhci->shared_hcd;
+
        if (major_revision == 0) {
                xhci_warn(xhci, "Event for port %u not in "
                                "Extended Capabilities, ignoring.\n",
@@ -1618,10 +1673,6 @@ static void handle_port_status(struct xhci_hcd *xhci,
         * into the index into the ports on the correct split roothub, and the
         * correct bus_state structure.
         */
-       /* Find the right roothub. */
-       hcd = xhci_to_hcd(xhci);
-       if ((major_revision == 0x03) != (hcd->speed == HCD_USB3))
-               hcd = xhci->shared_hcd;
        bus_state = &xhci->bus_state[hcd_index(hcd)];
        if (hcd->speed == HCD_USB3)
                port_array = xhci->usb3_ports;
@@ -1637,6 +1688,9 @@ static void handle_port_status(struct xhci_hcd *xhci,
                usb_hcd_resume_root_hub(hcd);
        }
 
+       if (hcd->speed == HCD_USB3 && (temp & PORT_PLS_MASK) == XDEV_INACTIVE)
+               bus_state->port_remote_wakeup &= ~(1 << faked_port_index);
+
        if ((temp & PORT_PLC) && (temp & PORT_PLS_MASK) == XDEV_RESUME) {
                xhci_dbg(xhci, "port resume event for port %d\n", port_id);
 
@@ -1665,7 +1719,7 @@ static void handle_port_status(struct xhci_hcd *xhci,
                } else {
                        xhci_dbg(xhci, "resume HS port %d\n", port_id);
                        bus_state->resume_done[faked_port_index] = jiffies +
-                               msecs_to_jiffies(20);
+                               msecs_to_jiffies(USB_RESUME_TIMEOUT);
                        set_bit(faked_port_index, &bus_state->resuming_ports);
                        mod_timer(&hcd->rh_timer,
                                  bus_state->resume_done[faked_port_index]);
@@ -1687,7 +1741,7 @@ static void handle_port_status(struct xhci_hcd *xhci,
                                faked_port_index + 1);
                if (slot_id && xhci->devs[slot_id])
                        xhci_ring_device(xhci, slot_id);
-               if (bus_state->port_remote_wakeup && (1 << faked_port_index)) {
+               if (bus_state->port_remote_wakeup & (1 << faked_port_index)) {
                        bus_state->port_remote_wakeup &=
                                ~(1 << faked_port_index);
                        xhci_test_and_clear_bit(xhci, port_array,
@@ -1703,6 +1757,44 @@ static void handle_port_status(struct xhci_hcd *xhci,
                xhci_test_and_clear_bit(xhci, port_array, faked_port_index,
                                        PORT_PLC);
 
+       /* notify the otg driver of B's connection logic to detect a connect
+        * event of the B-device goes here
+        */
+       xhci_dbg(xhci, "otg_port = %d, fake_port_index = %d, speed = %s\n",
+               hcd->self.otg_port, faked_port_index,
+               (hcd->speed == HCD_USB3) ? "SS" : "HS/FS/LS");
+
+       /* check if the otg_port caused port status change */
+       if (hcd->self.otg_port == (faked_port_index + 1) && (temp & PORT_CSC)) {
+               enum usb_device_speed speed = USB_SPEED_UNKNOWN;
+
+               xhci_dbg(xhci, "otgport caused portstatus 0x%x change\n", temp);
+
+               if (DEV_LOWSPEED(temp))
+                       speed = USB_SPEED_LOW;
+               else if (DEV_FULLSPEED(temp))
+                       speed = USB_SPEED_FULL;
+               else if (DEV_HIGHSPEED(temp))
+                       speed = USB_SPEED_HIGH;
+               else if (DEV_SUPERSPEED(temp))
+                       speed = USB_SPEED_SUPER;
+
+               /* now check if the port status change is because of
+                * connect or disconnect
+                */
+               slot_id = xhci_find_slot_id_by_port(hcd, xhci,
+                               faked_port_index + 1);
+               udev = xhci->devs[slot_id]->udev;
+               if (((temp & PORT_PLS_MASK) == XDEV_U0) ||
+                       ((temp & PORT_PLS_MASK) == XDEV_POLLING)) {
+                       if (hcd->phy)
+                               usb_phy_notify_connect(hcd->phy, speed);
+               } else if (((temp & PORT_PLS_MASK) == XDEV_U3) ||
+                               ((temp & PORT_PLS_MASK) == XDEV_RXDETECT)) {
+                       if (hcd->phy)
+                               usb_phy_notify_disconnect(hcd->phy, speed);
+               }
+       }
 cleanup:
        /* Update event ring dequeue pointer before dropping the lock */
        inc_deq(xhci, xhci->event_ring);
@@ -1714,6 +1806,15 @@ cleanup:
        if (bogus_port_status)
                return;
 
+       /*
+        * xHCI port-status-change events occur when the "or" of all the
+        * status-change bits in the portsc register changes from 0 to 1.
+        * New status changes won't cause an event if any other change
+        * bits are still set.  When an event occurs, switch over to
+        * polling to avoid losing status changes.
+        */
+       xhci_dbg(xhci, "%s: starting port polling.\n", __func__);
+       set_bit(HCD_FLAG_POLL_RH, &hcd->flags);
        spin_unlock(&xhci->lock);
        /* Pass this up to the core */
        usb_hcd_poll_rh_status(hcd);
@@ -2007,8 +2108,8 @@ static int process_ctrl_td(struct xhci_hcd *xhci, struct xhci_td *td,
                if (event_trb != ep_ring->dequeue &&
                                event_trb != td->last_trb)
                        td->urb->actual_length =
-                               td->urb->transfer_buffer_length
-                               TRB_LEN(le32_to_cpu(event->transfer_len));
+                               td->urb->transfer_buffer_length -
+                               EVENT_TRB_LEN(le32_to_cpu(event->transfer_len));
                else
                        td->urb->actual_length = 0;
 
@@ -2023,7 +2124,7 @@ static int process_ctrl_td(struct xhci_hcd *xhci, struct xhci_td *td,
        if (event_trb != ep_ring->dequeue) {
                /* The event was for the status stage */
                if (event_trb == td->last_trb) {
-                       if (td->urb->actual_length != 0) {
+                       if (td->urb_length_set) {
                                /* Don't overwrite a previously set error code
                                 */
                                if ((*status == -EINPROGRESS || *status == 0) &&
@@ -2037,10 +2138,16 @@ static int process_ctrl_td(struct xhci_hcd *xhci, struct xhci_td *td,
                                        td->urb->transfer_buffer_length;
                        }
                } else {
-               /* Maybe the event was for the data stage? */
+                       /*
+                        * Maybe the event was for the data stage? If so, update
+                        * already the actual_length of the URB and flag it as
+                        * set, so that it is not overwritten in the event for
+                        * the last TRB.
+                        */
+                       td->urb_length_set = true;
                        td->urb->actual_length =
                                td->urb->transfer_buffer_length -
-                               TRB_LEN(le32_to_cpu(event->transfer_len));
+                               EVENT_TRB_LEN(le32_to_cpu(event->transfer_len));
                        xhci_dbg(xhci, "Waiting for status "
                                        "stage event\n");
                        return 0;
@@ -2076,7 +2183,7 @@ static int process_isoc_td(struct xhci_hcd *xhci, struct xhci_td *td,
        /* handle completion code */
        switch (trb_comp_code) {
        case COMP_SUCCESS:
-               if (TRB_LEN(le32_to_cpu(event->transfer_len)) == 0) {
+               if (EVENT_TRB_LEN(le32_to_cpu(event->transfer_len)) == 0) {
                        frame->status = 0;
                        break;
                }
@@ -2097,8 +2204,14 @@ static int process_isoc_td(struct xhci_hcd *xhci, struct xhci_td *td,
                break;
        case COMP_DEV_ERR:
        case COMP_STALL:
+               frame->status = -EPROTO;
+               skip_td = true;
+               break;
        case COMP_TX_ERR:
+               xhci->xhci_ereport.comp_tx_err++;
                frame->status = -EPROTO;
+               if (event_trb != td->last_trb)
+                       return 0;
                skip_td = true;
                break;
        case COMP_STOP:
@@ -2113,6 +2226,12 @@ static int process_isoc_td(struct xhci_hcd *xhci, struct xhci_td *td,
                frame->actual_length = frame->length;
                td->urb->actual_length += frame->length;
        } else {
+               if (urb_priv->finishing_short_td &&
+                               (event_trb == td->last_trb)) {
+                       urb_priv->finishing_short_td = false;
+                       /* get event for last trb, can finish this short td */
+                       goto finish_td;
+               }
                for (cur_trb = ep_ring->dequeue,
                     cur_seg = ep_ring->deq_seg; cur_trb != event_trb;
                     next_trb(xhci, ep_ring, &cur_seg, &cur_trb)) {
@@ -2121,14 +2240,23 @@ static int process_isoc_td(struct xhci_hcd *xhci, struct xhci_td *td,
                                len += TRB_LEN(le32_to_cpu(cur_trb->generic.field[2]));
                }
                len += TRB_LEN(le32_to_cpu(cur_trb->generic.field[2])) -
-                       TRB_LEN(le32_to_cpu(event->transfer_len));
+                       EVENT_TRB_LEN(le32_to_cpu(event->transfer_len));
 
                if (trb_comp_code != COMP_STOP_INVAL) {
                        frame->actual_length = len;
                        td->urb->actual_length += len;
                }
+               if ((trb_comp_code == COMP_SHORT_TX) &&
+                               (event_trb != td->last_trb)) {
+                       /* last trb has IOC, expect HC to send event for it */
+                       while (ep_ring->dequeue != td->last_trb)
+                               inc_deq(xhci, ep_ring);
+                       urb_priv->finishing_short_td = true;
+                       return 0;
+               }
        }
 
+finish_td:
        return finish_td(xhci, td, event_trb, event, ep, status, false);
 }
 
@@ -2179,7 +2307,7 @@ static int process_bulk_intr_td(struct xhci_hcd *xhci, struct xhci_td *td,
        case COMP_SUCCESS:
                /* Double check that the HW transferred everything. */
                if (event_trb != td->last_trb ||
-                               TRB_LEN(le32_to_cpu(event->transfer_len)) != 0) {
+                   EVENT_TRB_LEN(le32_to_cpu(event->transfer_len)) != 0) {
                        xhci_warn(xhci, "WARN Successful completion "
                                        "on short TX\n");
                        if (td->urb->transfer_flags & URB_SHORT_NOT_OK)
@@ -2207,18 +2335,18 @@ static int process_bulk_intr_td(struct xhci_hcd *xhci, struct xhci_td *td,
                                "%d bytes untransferred\n",
                                td->urb->ep->desc.bEndpointAddress,
                                td->urb->transfer_buffer_length,
-                               TRB_LEN(le32_to_cpu(event->transfer_len)));
+                               EVENT_TRB_LEN(le32_to_cpu(event->transfer_len)));
        /* Fast path - was this the last TRB in the TD for this URB? */
        if (event_trb == td->last_trb) {
-               if (TRB_LEN(le32_to_cpu(event->transfer_len)) != 0) {
+               if (EVENT_TRB_LEN(le32_to_cpu(event->transfer_len)) != 0) {
                        td->urb->actual_length =
                                td->urb->transfer_buffer_length -
-                               TRB_LEN(le32_to_cpu(event->transfer_len));
+                               EVENT_TRB_LEN(le32_to_cpu(event->transfer_len));
                        if (td->urb->transfer_buffer_length <
                                        td->urb->actual_length) {
                                xhci_warn(xhci, "HC gave bad length "
                                                "of %d bytes left\n",
-                                         TRB_LEN(le32_to_cpu(event->transfer_len)));
+                                         EVENT_TRB_LEN(le32_to_cpu(event->transfer_len)));
                                td->urb->actual_length = 0;
                                if (td->urb->transfer_flags & URB_SHORT_NOT_OK)
                                        *status = -EREMOTEIO;
@@ -2260,12 +2388,35 @@ static int process_bulk_intr_td(struct xhci_hcd *xhci, struct xhci_td *td,
                if (trb_comp_code != COMP_STOP_INVAL)
                        td->urb->actual_length +=
                                TRB_LEN(le32_to_cpu(cur_trb->generic.field[2])) -
-                               TRB_LEN(le32_to_cpu(event->transfer_len));
+                               EVENT_TRB_LEN(le32_to_cpu(event->transfer_len));
        }
 
        return finish_td(xhci, td, event_trb, event, ep, status, false);
 }
 
+static void xhci_endpoint_soft_retry(struct xhci_hcd *xhci, unsigned slot_id,
+                       unsigned dci, bool on)
+{
+       struct xhci_virt_device *xdev = xhci->devs[slot_id];
+       struct usb_host_endpoint *ep;
+
+       if (!xhci->shared_hcd || !xhci->shared_hcd->driver
+                       || !xhci->shared_hcd->driver->endpoint_soft_retry)
+               return;
+
+       if (xdev->udev->speed != USB_SPEED_SUPER)
+               return;
+
+       if (dci & 0x1)
+               ep = xdev->udev->ep_in[(dci - 1)/2];
+       else
+               ep = xdev->udev->ep_out[dci/2];
+
+       if (!ep)
+               return;
+
+       xhci->shared_hcd->driver->endpoint_soft_retry(xhci->shared_hcd, ep, on);
+}
 /*
  * If this function returns an error condition, it means it got a Transfer
  * event with a corrupted Slot ID, Endpoint ID, or TRB DMA address.
@@ -2293,6 +2444,7 @@ static int handle_tx_event(struct xhci_hcd *xhci,
        u32 trb_comp_code;
        int ret = 0;
        int td_num = 0;
+       bool handling_skipped_tds = false;
 
        slot_id = TRB_TO_SLOT_ID(le32_to_cpu(event->flags));
        xdev = xhci->devs[slot_id];
@@ -2348,14 +2500,22 @@ static int handle_tx_event(struct xhci_hcd *xhci,
         * transfer type
         */
        case COMP_SUCCESS:
-               if (TRB_LEN(le32_to_cpu(event->transfer_len)) == 0)
-                       break;
+               if (EVENT_TRB_LEN(le32_to_cpu(event->transfer_len)) == 0)
+                       goto check_soft_try;
                if (xhci->quirks & XHCI_TRUST_TX_LENGTH)
                        trb_comp_code = COMP_SHORT_TX;
                else
                        xhci_warn_ratelimited(xhci,
                                        "WARN Successful completion on short TX: needs XHCI_TRUST_TX_LENGTH quirk?\n");
        case COMP_SHORT_TX:
+check_soft_try:
+               if (ep_ring->soft_try) {
+                       xhci_dbg(xhci, "soft retry completed successfully\n");
+                       ep_ring->soft_try = false;
+                       xhci_endpoint_soft_retry(xhci,
+                                               slot_id, ep_index + 1, false);
+               }
+
                break;
        case COMP_STOP:
                xhci_dbg(xhci, "Stopped on Transfer TRB\n");
@@ -2373,7 +2533,33 @@ static int handle_tx_event(struct xhci_hcd *xhci,
                status = -EILSEQ;
                break;
        case COMP_SPLIT_ERR:
+               xhci_dbg(xhci, "Transfer error on endpoint\n");
+               status = -EPROTO;
+               break;
        case COMP_TX_ERR:
+               xhci->xhci_ereport.comp_tx_err++;
+
+               if (xdev->udev->speed == USB_SPEED_SUPER &&
+                                               ep_ring->type != TYPE_ISOC) {
+                       if (!ep_ring->soft_try) {
+                               xhci_dbg(xhci, "SuperSpeed transfer error, do soft retry\n");
+                               ret = xhci_queue_soft_retry(xhci,
+                                               slot_id, ep_index);
+                               if (!ret) {
+                                       xhci_endpoint_soft_retry(xhci,
+                                               slot_id, ep_index + 1, true);
+                                       xhci_ring_cmd_db(xhci);
+                                       ep_ring->soft_try = true;
+                                       goto cleanup;
+                               }
+                       } else {
+                               xhci_dbg(xhci, "soft retry complete but transfer still failed\n");
+                               ep_ring->soft_try = false;
+                       }
+                       xhci_endpoint_soft_retry(xhci,
+                                               slot_id, ep_index + 1, false);
+               }
+
                xhci_dbg(xhci, "Transfer error on endpoint\n");
                status = -EPROTO;
                break;
@@ -2426,6 +2612,10 @@ static int handle_tx_event(struct xhci_hcd *xhci,
                ep->skip = true;
                xhci_dbg(xhci, "Miss service interval error, set skip flag\n");
                goto cleanup;
+       case COMP_PING_ERR:
+               ep->skip = true;
+               xhci_dbg(xhci, "No Ping response error, Skip one Isoc TD\n");
+               goto cleanup;
        default:
                if (xhci_is_vendor_info_code(xhci, trb_comp_code)) {
                        status = 0;
@@ -2441,14 +2631,21 @@ static int handle_tx_event(struct xhci_hcd *xhci,
                 * TD list.
                 */
                if (list_empty(&ep_ring->td_list)) {
-                       xhci_warn(xhci, "WARN Event TRB for slot %d ep %d "
-                                       "with no TDs queued?\n",
-                                 TRB_TO_SLOT_ID(le32_to_cpu(event->flags)),
-                                 ep_index);
-                       xhci_dbg(xhci, "Event TRB with TRB type ID %u\n",
-                                (le32_to_cpu(event->flags) &
-                                 TRB_TYPE_BITMASK)>>10);
-                       xhci_print_trb_offsets(xhci, (union xhci_trb *) event);
+                       /*
+                        * A stopped endpoint may generate an extra completion
+                        * event if the device was suspended.  Don't print
+                        * warnings.
+                        */
+                       if (!(trb_comp_code == COMP_STOP ||
+                                               trb_comp_code == COMP_STOP_INVAL)) {
+                               xhci_warn(xhci, "WARN Event TRB for slot %d ep %d with no TDs queued?\n",
+                                               TRB_TO_SLOT_ID(le32_to_cpu(event->flags)),
+                                               ep_index);
+                               xhci_dbg(xhci, "Event TRB with TRB type ID %u\n",
+                                               (le32_to_cpu(event->flags) &
+                                                TRB_TYPE_BITMASK)>>10);
+                               xhci_print_trb_offsets(xhci, (union xhci_trb *) event);
+                       }
                        if (ep->skip) {
                                ep->skip = false;
                                xhci_dbg(xhci, "td_list is empty while skip "
@@ -2483,7 +2680,8 @@ static int handle_tx_event(struct xhci_hcd *xhci,
                 * last TRB of the previous TD. The command completion handle
                 * will take care the rest.
                 */
-               if (!event_seg && trb_comp_code == COMP_STOP_INVAL) {
+               if (!event_seg && (trb_comp_code == COMP_STOP ||
+                                  trb_comp_code == COMP_STOP_INVAL)) {
                        ret = 0;
                        goto cleanup;
                }
@@ -2491,6 +2689,8 @@ static int handle_tx_event(struct xhci_hcd *xhci,
                if (!event_seg) {
                        if (!ep->skip ||
                            !usb_endpoint_xfer_isoc(&td->urb->ep->desc)) {
+                               static bool printit = true;
+                               static unsigned long lastprint;
                                /* Some host controllers give a spurious
                                 * successful event after a short transfer.
                                 * Ignore it.
@@ -2502,9 +2702,18 @@ static int handle_tx_event(struct xhci_hcd *xhci,
                                        goto cleanup;
                                }
                                /* HC is busted, give up! */
-                               xhci_err(xhci,
+                               if (!printit &&
+                                       time_is_before_jiffies(lastprint))
+                                       printit = true;
+
+                               if (printit) {
+                                       xhci_err_ratelimited(xhci,
                                        "ERROR Transfer event TRB DMA ptr not "
                                        "part of current TD\n");
+                                       printit = false;
+                                       lastprint = jiffies +
+                                               msecs_to_jiffies(5000);
+                               }
                                return -ESHUTDOWN;
                        }
 
@@ -2549,13 +2758,18 @@ static int handle_tx_event(struct xhci_hcd *xhci,
                                                 ep, &status);
 
 cleanup:
+
+
+               handling_skipped_tds = ep->skip &&
+                       trb_comp_code != COMP_MISSED_INT &&
+                       trb_comp_code != COMP_PING_ERR;
+
                /*
-                * Do not update event ring dequeue pointer if ep->skip is set.
-                * Will roll back to continue process missed tds.
+                * Do not update event ring dequeue pointer if we're in a loop
+                * processing missed tds.
                 */
-               if (trb_comp_code == COMP_MISSED_INT || !ep->skip) {
+               if (!handling_skipped_tds)
                        inc_deq(xhci, xhci->event_ring);
-               }
 
                if (ret) {
                        urb = td->urb;
@@ -2569,6 +2783,8 @@ cleanup:
                                (trb_comp_code != COMP_STALL &&
                                        trb_comp_code != COMP_BABBLE))
                                xhci_urb_free_priv(xhci, urb_priv);
+                       else
+                               kfree(urb_priv);
 
                        usb_hcd_unlink_urb_from_ep(bus_to_hcd(urb->dev->bus), urb);
                        if ((urb->actual_length != urb->transfer_buffer_length &&
@@ -2597,7 +2813,7 @@ cleanup:
         * Process them as short transfer until reach the td pointed by
         * the event.
         */
-       } while (ep->skip && trb_comp_code != COMP_MISSED_INT);
+       } while (handling_skipped_tds);
 
        return 0;
 }
@@ -2686,13 +2902,11 @@ irqreturn_t xhci_irq(struct usb_hcd *hcd)
 {
        struct xhci_hcd *xhci = hcd_to_xhci(hcd);
        u32 status;
-       union xhci_trb *trb;
        u64 temp_64;
        union xhci_trb *event_ring_deq;
        dma_addr_t deq;
 
        spin_lock(&xhci->lock);
-       trb = xhci->event_ring->dequeue;
        /* Check if the xHC generated the interrupt, or the irq is shared */
        status = xhci_readl(xhci, &xhci->op_regs->status);
        if (status == 0xffffffff)
@@ -2707,7 +2921,7 @@ irqreturn_t xhci_irq(struct usb_hcd *hcd)
                xhci_halt(xhci);
 hw_died:
                spin_unlock(&xhci->lock);
-               return -ESHUTDOWN;
+               return IRQ_HANDLED;
        }
 
        /*
@@ -2852,7 +3066,7 @@ static int prepare_ring(struct xhci_hcd *xhci, struct xhci_ring *ep_ring,
                        xhci_err(xhci, "Ring expansion failed\n");
                        return -ENOMEM;
                }
-       };
+       }
 
        if (enqueue_is_link_trb(ep_ring)) {
                struct xhci_ring *ring = ep_ring;
@@ -3060,11 +3274,11 @@ static u32 xhci_td_remainder(unsigned int remainder)
 }
 
 /*
- * For xHCI 1.0 host controllers, TD size is the number of packets remaining in
- * the TD (*not* including this TRB).
+ * For xHCI 1.0 host controllers, TD size is the number of max packet sized
+ * packets remaining in the TD (*not* including this TRB).
  *
  * Total TD packet count = total_packet_count =
- *     roundup(TD size in bytes / wMaxPacketSize)
+ *     DIV_ROUND_UP(TD size in bytes / wMaxPacketSize)
  *
  * Packets transferred up to and including this TRB = packets_transferred =
  *     rounddown(total bytes transferred including this TRB / wMaxPacketSize)
@@ -3072,24 +3286,27 @@ static u32 xhci_td_remainder(unsigned int remainder)
  * TD size = total_packet_count - packets_transferred
  *
  * It must fit in bits 21:17, so it can't be bigger than 31.
+ * The last TRB in a TD must have the TD size set to zero.
  */
-
 static u32 xhci_v1_0_td_remainder(int running_total, int trb_buff_len,
-               unsigned int total_packet_count, struct urb *urb)
+               unsigned int total_packet_count, struct urb *urb,
+               unsigned int num_trbs_left)
 {
        int packets_transferred;
 
        /* One TRB with a zero-length data packet. */
-       if (running_total == 0 && trb_buff_len == 0)
+       if (num_trbs_left == 0 || (running_total == 0 && trb_buff_len == 0))
                return 0;
 
        /* All the TRB queueing functions don't count the current TRB in
         * running_total.
         */
        packets_transferred = (running_total + trb_buff_len) /
-               usb_endpoint_maxp(&urb->ep->desc);
+               GET_MAX_PACKET(usb_endpoint_maxp(&urb->ep->desc));
 
-       return xhci_td_remainder(total_packet_count - packets_transferred);
+       if ((total_packet_count - packets_transferred) > 31)
+               return 31 << 17;
+       return (total_packet_count - packets_transferred) << 17;
 }
 
 static int queue_bulk_sg_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
@@ -3101,9 +3318,11 @@ static int queue_bulk_sg_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
        struct xhci_td *td;
        struct scatterlist *sg;
        int num_sgs;
-       int trb_buff_len, this_sg_len, running_total;
+       int trb_buff_len, this_sg_len, running_total, ret;
        unsigned int total_packet_count;
+       bool zero_length_needed;
        bool first_trb;
+       int last_trb_num;
        u64 addr;
        bool more_trbs_coming;
 
@@ -3116,16 +3335,30 @@ static int queue_bulk_sg_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
 
        num_trbs = count_sg_trbs_needed(xhci, urb);
        num_sgs = urb->num_mapped_sgs;
-       total_packet_count = roundup(urb->transfer_buffer_length,
+       total_packet_count = DIV_ROUND_UP(urb->transfer_buffer_length,
                        usb_endpoint_maxp(&urb->ep->desc));
 
-       trb_buff_len = prepare_transfer(xhci, xhci->devs[slot_id],
+       ret = prepare_transfer(xhci, xhci->devs[slot_id],
                        ep_index, urb->stream_id,
                        num_trbs, urb, 0, mem_flags);
-       if (trb_buff_len < 0)
-               return trb_buff_len;
+       if (ret < 0)
+               return ret;
 
        urb_priv = urb->hcpriv;
+
+       /* Deal with URB_ZERO_PACKET - need one more td/trb */
+       zero_length_needed = urb->transfer_flags & URB_ZERO_PACKET &&
+               urb_priv->length == 2;
+       if (zero_length_needed) {
+               num_trbs++;
+               xhci_dbg(xhci, "Creating zero length td.\n");
+               ret = prepare_transfer(xhci, xhci->devs[slot_id],
+                               ep_index, urb->stream_id,
+                               1, urb, 1, mem_flags);
+               if (ret < 0)
+                       return ret;
+       }
+
        td = urb_priv->td[0];
 
        /*
@@ -3155,6 +3388,7 @@ static int queue_bulk_sg_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
                trb_buff_len = urb->transfer_buffer_length;
 
        first_trb = true;
+       last_trb_num = zero_length_needed ? 2 : 1;
        /* Queue the first TRB, even if it's zero-length */
        do {
                u32 field = 0;
@@ -3172,12 +3406,15 @@ static int queue_bulk_sg_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
                /* Chain all the TRBs together; clear the chain bit in the last
                 * TRB to indicate it's the last TRB in the chain.
                 */
-               if (num_trbs > 1) {
+               if (num_trbs > last_trb_num) {
                        field |= TRB_CHAIN;
-               } else {
-                       /* FIXME - add check for ZERO_PACKET flag before this */
+               } else if (num_trbs == last_trb_num) {
                        td->last_trb = ep_ring->enqueue;
                        field |= TRB_IOC;
+               } else if (zero_length_needed && num_trbs == 1) {
+                       trb_buff_len = 0;
+                       urb_priv->td[1]->last_trb = ep_ring->enqueue;
+                       field |= TRB_IOC;
                }
 
                /* Only set interrupt on short packet for IN endpoints */
@@ -3199,7 +3436,8 @@ static int queue_bulk_sg_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
                                        running_total);
                } else {
                        remainder = xhci_v1_0_td_remainder(running_total,
-                                       trb_buff_len, total_packet_count, urb);
+                                       trb_buff_len, total_packet_count, urb,
+                                       num_trbs - 1);
                }
                length_field = TRB_LEN(trb_buff_len) |
                        remainder |
@@ -3238,7 +3476,7 @@ static int queue_bulk_sg_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
                if (running_total + trb_buff_len > urb->transfer_buffer_length)
                        trb_buff_len =
                                urb->transfer_buffer_length - running_total;
-       } while (running_total < urb->transfer_buffer_length);
+       } while (num_trbs > 0);
 
        check_trb_math(urb, num_trbs, running_total);
        giveback_first_trb(xhci, slot_id, ep_index, urb->stream_id,
@@ -3256,7 +3494,9 @@ int xhci_queue_bulk_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
        int num_trbs;
        struct xhci_generic_trb *start_trb;
        bool first_trb;
+       int last_trb_num;
        bool more_trbs_coming;
+       bool zero_length_needed;
        int start_cycle;
        u32 field, length_field;
 
@@ -3287,7 +3527,6 @@ int xhci_queue_bulk_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
                num_trbs++;
                running_total += TRB_MAX_BUFF_SIZE;
        }
-       /* FIXME: this doesn't deal with URB_ZERO_PACKET - need one more */
 
        ret = prepare_transfer(xhci, xhci->devs[slot_id],
                        ep_index, urb->stream_id,
@@ -3296,6 +3535,20 @@ int xhci_queue_bulk_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
                return ret;
 
        urb_priv = urb->hcpriv;
+
+       /* Deal with URB_ZERO_PACKET - need one more td/trb */
+       zero_length_needed = urb->transfer_flags & URB_ZERO_PACKET &&
+               urb_priv->length == 2;
+       if (zero_length_needed) {
+               num_trbs++;
+               xhci_dbg(xhci, "Creating zero length td.\n");
+               ret = prepare_transfer(xhci, xhci->devs[slot_id],
+                               ep_index, urb->stream_id,
+                               1, urb, 1, mem_flags);
+               if (ret < 0)
+                       return ret;
+       }
+
        td = urb_priv->td[0];
 
        /*
@@ -3307,7 +3560,7 @@ int xhci_queue_bulk_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
        start_cycle = ep_ring->cycle_state;
 
        running_total = 0;
-       total_packet_count = roundup(urb->transfer_buffer_length,
+       total_packet_count = DIV_ROUND_UP(urb->transfer_buffer_length,
                        usb_endpoint_maxp(&urb->ep->desc));
        /* How much data is in the first TRB? */
        addr = (u64) urb->transfer_dma;
@@ -3317,7 +3570,7 @@ int xhci_queue_bulk_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
                trb_buff_len = urb->transfer_buffer_length;
 
        first_trb = true;
-
+       last_trb_num = zero_length_needed ? 2 : 1;
        /* Queue the first TRB, even if it's zero-length */
        do {
                u32 remainder = 0;
@@ -3334,12 +3587,15 @@ int xhci_queue_bulk_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
                /* Chain all the TRBs together; clear the chain bit in the last
                 * TRB to indicate it's the last TRB in the chain.
                 */
-               if (num_trbs > 1) {
+               if (num_trbs > last_trb_num) {
                        field |= TRB_CHAIN;
-               } else {
-                       /* FIXME - add check for ZERO_PACKET flag before this */
+               } else if (num_trbs == last_trb_num) {
                        td->last_trb = ep_ring->enqueue;
                        field |= TRB_IOC;
+               } else if (zero_length_needed && num_trbs == 1) {
+                       trb_buff_len = 0;
+                       urb_priv->td[1]->last_trb = ep_ring->enqueue;
+                       field |= TRB_IOC;
                }
 
                /* Only set interrupt on short packet for IN endpoints */
@@ -3353,7 +3609,8 @@ int xhci_queue_bulk_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
                                        running_total);
                } else {
                        remainder = xhci_v1_0_td_remainder(running_total,
-                                       trb_buff_len, total_packet_count, urb);
+                                       trb_buff_len, total_packet_count, urb,
+                                       num_trbs - 1);
                }
                length_field = TRB_LEN(trb_buff_len) |
                        remainder |
@@ -3376,7 +3633,7 @@ int xhci_queue_bulk_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
                trb_buff_len = urb->transfer_buffer_length - running_total;
                if (trb_buff_len > TRB_MAX_BUFF_SIZE)
                        trb_buff_len = TRB_MAX_BUFF_SIZE;
-       } while (running_total < urb->transfer_buffer_length);
+       } while (num_trbs > 0);
 
        check_trb_math(urb, num_trbs, running_total);
        giveback_first_trb(xhci, slot_id, ep_index, urb->stream_id,
@@ -3443,8 +3700,8 @@ int xhci_queue_ctrl_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
        if (start_cycle == 0)
                field |= 0x1;
 
-       /* xHCI 1.0 6.4.1.2.1: Transfer Type field */
-       if (xhci->hci_version == 0x100) {
+       /* xHCI 1.0/1.1 6.4.1.2.1: Transfer Type field */
+       if (xhci->hci_version >= 0x100) {
                if (urb->transfer_buffer_length > 0) {
                        if (setup->bRequestType & USB_DIR_IN)
                                field |= TRB_TX_TYPE(TRB_DATA_IN);
@@ -3536,7 +3793,7 @@ static unsigned int xhci_get_burst_count(struct xhci_hcd *xhci,
                return 0;
 
        max_burst = urb->ep->ss_ep_comp.bMaxBurst;
-       return roundup(total_packet_count, max_burst + 1) - 1;
+       return DIV_ROUND_UP(total_packet_count, max_burst + 1) - 1;
 }
 
 /*
@@ -3616,8 +3873,9 @@ static int xhci_queue_isoc_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
                addr = start_addr + urb->iso_frame_desc[i].offset;
                td_len = urb->iso_frame_desc[i].length;
                td_remain_len = td_len;
-               total_packet_count = roundup(td_len,
-                               usb_endpoint_maxp(&urb->ep->desc));
+               total_packet_count = DIV_ROUND_UP(td_len,
+                               GET_MAX_PACKET(
+                                       usb_endpoint_maxp(&urb->ep->desc)));
                /* A zero-length transfer still involves at least one packet. */
                if (total_packet_count == 0)
                        total_packet_count++;
@@ -3639,9 +3897,11 @@ static int xhci_queue_isoc_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
                td = urb_priv->td[i];
                for (j = 0; j < trbs_per_td; j++) {
                        u32 remainder = 0;
-                       field = TRB_TBC(burst_count) | TRB_TLBPC(residue);
+                       field = 0;
 
                        if (first_trb) {
+                               field = TRB_TBC(burst_count) |
+                                       TRB_TLBPC(residue);
                                /* Queue the isoc TRB */
                                field |= TRB_TYPE(TRB_ISOC);
                                /* Assume URB_ISO_ASAP is set */
@@ -3672,7 +3932,9 @@ static int xhci_queue_isoc_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
                        } else {
                                td->last_trb = ep_ring->enqueue;
                                field |= TRB_IOC;
-                               if (xhci->hci_version == 0x100) {
+                               if (xhci->hci_version == 0x100 &&
+                                               !(xhci->quirks &
+                                                       XHCI_AVOID_BEI)) {
                                        /* Set BEI bit except for the last td */
                                        if (i < num_tds - 1)
                                                field |= TRB_BEI;
@@ -3693,7 +3955,8 @@ static int xhci_queue_isoc_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
                        } else {
                                remainder = xhci_v1_0_td_remainder(
                                                running_total, trb_buff_len,
-                                               total_packet_count, urb);
+                                               total_packet_count, urb,
+                                               (trbs_per_td - j - 1));
                        }
                        length_field = TRB_LEN(trb_buff_len) |
                                remainder |
@@ -3969,3 +4232,14 @@ int xhci_queue_reset_ep(struct xhci_hcd *xhci, int slot_id,
        return queue_command(xhci, 0, 0, 0, trb_slot_id | trb_ep_index | type,
                        false);
 }
+
+int xhci_queue_soft_retry(struct xhci_hcd *xhci, int slot_id,
+               unsigned int ep_index)
+{
+       u32 trb_slot_id = SLOT_ID_FOR_TRB(slot_id);
+       u32 trb_ep_index = EP_ID_FOR_TRB(ep_index);
+       u32 type = TRB_TYPE(TRB_RESET_EP) | TRB_TSP;
+
+       return queue_command(xhci, 0, 0, 0, trb_slot_id | trb_ep_index | type,
+                       false);
+}