1 files changed, 102 insertions, 38 deletions

diff --git a/drivers/usb/host/ehci-q.c b/drivers/usb/host/ehci-q.c
index 3192f683f807..9a1384747f3b 100644
--- a/drivers/usb/host/ehci-q.c
+++ b/drivers/usb/host/ehci-q.c
@@ -93,6 +93,22 @@ qh_update (struct ehci_hcd *ehci, struct ehci_qh *qh, struct ehci_qtd *qtd)
         qh->hw_qtd_next = QTD_NEXT(ehci, qtd->qtd_dma);
         qh->hw_alt_next = EHCI_LIST_END(ehci);
 
+        /* Except for control endpoints, we make hardware maintain data
+         * toggle (like OHCI) ... here (re)initialize the toggle in the QH,
+         * and set the pseudo-toggle in udev. Only usb_clear_halt() will
+         * ever clear it.
+         */
+        if (!(qh->hw_info1 & cpu_to_hc32(ehci, 1 << 14))) {
+                unsigned        is_out, epnum;
+
+                is_out = !(qtd->hw_token & cpu_to_hc32(ehci, 1 << 8));
+                epnum = (hc32_to_cpup(ehci, &qh->hw_info1) >> 8) & 0x0f;
+                if (unlikely (!usb_gettoggle (qh->dev, epnum, is_out))) {
+                        qh->hw_token &= ~cpu_to_hc32(ehci, QTD_TOGGLE);
+                        usb_settoggle (qh->dev, epnum, is_out, 1);
+                }
+        }
+
         /* HC must see latest qtd and qh data before we clear ACTIVE+HALT */
         wmb ();
         qh->hw_token &= cpu_to_hc32(ehci, QTD_TOGGLE | QTD_STS_PING);
@@ -123,6 +139,55 @@ qh_refresh (struct ehci_hcd *ehci, struct ehci_qh *qh)
 
 /*-------------------------------------------------------------------------*/
 
+static void qh_link_async(struct ehci_hcd *ehci, struct ehci_qh *qh);
+
+static void ehci_clear_tt_buffer_complete(struct usb_hcd *hcd,
+                struct usb_host_endpoint *ep)
+{
+        struct ehci_hcd         *ehci = hcd_to_ehci(hcd);
+        struct ehci_qh          *qh = ep->hcpriv;
+        unsigned long           flags;
+
+        spin_lock_irqsave(&ehci->lock, flags);
+        qh->clearing_tt = 0;
+        if (qh->qh_state == QH_STATE_IDLE && !list_empty(&qh->qtd_list)
+                        && HC_IS_RUNNING(hcd->state))
+                qh_link_async(ehci, qh);
+        spin_unlock_irqrestore(&ehci->lock, flags);
+}
+
+static void ehci_clear_tt_buffer(struct ehci_hcd *ehci, struct ehci_qh *qh,
+                struct urb *urb, u32 token)
+{
+
+        /* If an async split transaction gets an error or is unlinked,
+         * the TT buffer may be left in an indeterminate state.  We
+         * have to clear the TT buffer.
+         *
+         * Note: this routine is never called for Isochronous transfers.
+         */
+        if (urb->dev->tt && !usb_pipeint(urb->pipe) && !qh->clearing_tt) {
+#ifdef DEBUG
+                struct usb_device *tt = urb->dev->tt->hub;
+                dev_dbg(&tt->dev,
+                        "clear tt buffer port %d, a%d ep%d t%08x\n",
+                        urb->dev->ttport, urb->dev->devnum,
+                        usb_pipeendpoint(urb->pipe), token);
+#endif /* DEBUG */
+                if (!ehci_is_TDI(ehci)
+                                || urb->dev->tt->hub !=
+                                   ehci_to_hcd(ehci)->self.root_hub) {
+                        if (usb_hub_clear_tt_buffer(urb) == 0)
+                                qh->clearing_tt = 1;
+                } else {
+
+                        /* REVISIT ARC-derived cores don't clear the root
+                         * hub TT buffer in this way...
+                         */
+                }
+        }
+}
+
 static int qtd_copy_status (
         struct ehci_hcd *ehci,
         struct urb *urb,
@@ -149,6 +214,14 @@ static int qtd_copy_status (
                 if (token & QTD_STS_BABBLE) {
                         /* FIXME "must" disable babbling device's port too */
                         status = -EOVERFLOW;
+                /* CERR nonzero + halt --> stall */
+                } else if (QTD_CERR(token)) {
+                        status = -EPIPE;
+
+                /* In theory, more than one of the following bits can be set
+                 * since they are sticky and the transaction is retried.
+                 * Which to test first is rather arbitrary.
+                 */
                 } else if (token & QTD_STS_MMF) {
                         /* fs/ls interrupt xfer missed the complete-split */
                         status = -EPROTO;
@@ -157,21 +230,15 @@ static int qtd_copy_status (
                                 ? -ENOSR  /* hc couldn't read data */
                                 : -ECOMM; /* hc couldn't write data */
                 } else if (token & QTD_STS_XACT) {
-                        /* timeout, bad crc, wrong PID, etc; retried */
-                        if (QTD_CERR (token))
-                                status = -EPIPE;
-                        else {
-                                ehci_dbg (ehci, "devpath %s ep%d%s 3strikes\n",
-                                        urb->dev->devpath,
-                                        usb_pipeendpoint (urb->pipe),
-                                        usb_pipein (urb->pipe) ? "in" : "out");
-                                status = -EPROTO;
-                        }
-                /* CERR nonzero + no errors + halt --> stall */
-                } else if (QTD_CERR (token))
-                        status = -EPIPE;
-                else    /* unknown */
+                        /* timeout, bad CRC, wrong PID, etc */
+                        ehci_dbg(ehci, "devpath %s ep%d%s 3strikes\n",
+                                urb->dev->devpath,
+                                usb_pipeendpoint(urb->pipe),
+                                usb_pipein(urb->pipe) ? "in" : "out");
+                        status = -EPROTO;
+                } else {        /* unknown */
                         status = -EPROTO;
+                }
 
                 ehci_vdbg (ehci,
                         "dev%d ep%d%s qtd token %08x --> status %d\n",
@@ -179,28 +246,6 @@ static int qtd_copy_status (
                         usb_pipeendpoint (urb->pipe),
                         usb_pipein (urb->pipe) ? "in" : "out",
                         token, status);
-
-                /* if async CSPLIT failed, try cleaning out the TT buffer */
-                if (status != -EPIPE
-                                && urb->dev->tt
-                                && !usb_pipeint(urb->pipe)
-                                && ((token & QTD_STS_MMF) != 0
-                                        || QTD_CERR(token) == 0)
-                                && (!ehci_is_TDI(ehci)
-                                        || urb->dev->tt->hub !=
-                                           ehci_to_hcd(ehci)->self.root_hub)) {
-#ifdef DEBUG
-                        struct usb_device *tt = urb->dev->tt->hub;
-                        dev_dbg (&tt->dev,
-                                "clear tt buffer port %d, a%d ep%d t%08x\n",
-                                urb->dev->ttport, urb->dev->devnum,
-                                usb_pipeendpoint (urb->pipe), token);
-#endif /* DEBUG */
-                        /* REVISIT ARC-derived cores don't clear the root
-                         * hub TT buffer in this way...
-                         */
-                        usb_hub_tt_clear_buffer (urb->dev, urb->pipe);
-                }
         }
 
         return status;
@@ -391,9 +436,16 @@ qh_completions (struct ehci_hcd *ehci, struct ehci_qh *qh)
                         /* qh unlinked; token in overlay may be most current */
                         if (state == QH_STATE_IDLE
                                         && cpu_to_hc32(ehci, qtd->qtd_dma)
-                                                == qh->hw_current)
+                                                == qh->hw_current) {
                                 token = hc32_to_cpu(ehci, qh->hw_token);
 
+                                /* An unlink may leave an incomplete
+                                 * async transaction in the TT buffer.
+                                 * We have to clear it.
+                                 */
+                                ehci_clear_tt_buffer(ehci, qh, urb, token);
+                        }
+
                         /* force halt for unlinked or blocked qh, so we'll
                          * patch the qh later and so that completions can't
                          * activate it while we "know" it's stopped.
@@ -419,6 +471,13 @@ halt:
                                         && (qtd->hw_alt_next
                                                 & EHCI_LIST_END(ehci)))
                                 last_status = -EINPROGRESS;
+
+                        /* As part of low/full-speed endpoint-halt processing
+                         * we must clear the TT buffer (11.17.5).
+                         */
+                        if (unlikely(last_status != -EINPROGRESS &&
+                                        last_status != -EREMOTEIO))
+                                ehci_clear_tt_buffer(ehci, qh, urb, token);
                 }
 
                 /* if we're removing something not at the queue head,
@@ -834,6 +893,7 @@ done:
         qh->qh_state = QH_STATE_IDLE;
         qh->hw_info1 = cpu_to_hc32(ehci, info1);
         qh->hw_info2 = cpu_to_hc32(ehci, info2);
+        usb_settoggle (urb->dev, usb_pipeendpoint (urb->pipe), !is_input, 1);
         qh_refresh (ehci, qh);
         return qh;
 }
@@ -847,6 +907,10 @@ static void qh_link_async (struct ehci_hcd *ehci, struct ehci_qh *qh)
         __hc32          dma = QH_NEXT(ehci, qh->qh_dma);
         struct ehci_qh  *head;
 
+        /* Don't link a QH if there's a Clear-TT-Buffer pending */
+        if (unlikely(qh->clearing_tt))
+                return;
+
         /* (re)start the async schedule? */
         head = ehci->async;
         timer_action_done (ehci, TIMER_ASYNC_OFF);
@@ -864,7 +928,7 @@ static void qh_link_async (struct ehci_hcd *ehci, struct ehci_qh *qh)
                 }
         }
 
-        /* clear halt and maybe recover from silicon quirk */
+        /* clear halt and/or toggle; and maybe recover from silicon quirk */
         if (qh->qh_state == QH_STATE_IDLE)
                 qh_refresh (ehci, qh);