usb: xhci: fix config fail of FS hub behind a HS hub with MTT
[pandora-kernel.git] / drivers / usb / host / xhci.c
index 48b048f..d7ddb5a 100644 (file)
@@ -33,6 +33,8 @@
 #define DRIVER_AUTHOR "Sarah Sharp"
 #define DRIVER_DESC "'eXtensible' Host Controller (xHC) Driver"
 
+#define        PORT_WAKE_BITS  (PORT_WKOC_E | PORT_WKDISC_E | PORT_WKCONN_E)
+
 /* Some 0.95 hardware can't handle the chain bit on a Link TRB being cleared */
 static int link_quirk;
 module_param(link_quirk, int, S_IRUGO | S_IWUSR);
@@ -52,7 +54,7 @@ MODULE_PARM_DESC(link_quirk, "Don't clear the chain bit on a link TRB");
  * handshake done).  There are two failure modes:  "usec" have passed (major
  * hardware flakeout), or the register reads as all-ones (hardware removed).
  */
-static int handshake(struct xhci_hcd *xhci, void __iomem *ptr,
+int handshake(struct xhci_hcd *xhci, void __iomem *ptr,
                      u32 mask, u32 done, int usec)
 {
        u32     result;
@@ -105,9 +107,10 @@ int xhci_halt(struct xhci_hcd *xhci)
 
        ret = handshake(xhci, &xhci->op_regs->status,
                        STS_HALT, STS_HALT, XHCI_MAX_HALT_USEC);
-       if (!ret)
+       if (!ret) {
                xhci->xhc_state |= XHCI_STATE_HALTED;
-       else
+               xhci->cmd_ring_state = CMD_RING_STATE_STOPPED;
+       } else
                xhci_warn(xhci, "Host not halted after %u microseconds.\n",
                                XHCI_MAX_HALT_USEC);
        return ret;
@@ -138,7 +141,8 @@ static int xhci_start(struct xhci_hcd *xhci)
                                "waited %u microseconds.\n",
                                XHCI_MAX_HALT_USEC);
        if (!ret)
-               xhci->xhc_state &= ~XHCI_STATE_HALTED;
+               xhci->xhc_state &= ~(XHCI_STATE_HALTED | XHCI_STATE_DYING);
+
        return ret;
 }
 
@@ -166,6 +170,16 @@ int xhci_reset(struct xhci_hcd *xhci)
        command |= CMD_RESET;
        xhci_writel(xhci, command, &xhci->op_regs->command);
 
+       /* Existing Intel xHCI controllers require a delay of 1 mS,
+        * after setting the CMD_RESET bit, and before accessing any
+        * HC registers. This allows the HC to complete the
+        * reset operation and be ready for HC register access.
+        * Without this delay, the subsequent HC register access,
+        * may result in a system hang very rarely.
+        */
+       if (xhci->quirks & XHCI_INTEL_HOST)
+               udelay(1000);
+
        ret = handshake(xhci, &xhci->op_regs->command,
                        CMD_RESET, 0, 10 * 1000 * 1000);
        if (ret)
@@ -205,14 +219,14 @@ static int xhci_setup_msi(struct xhci_hcd *xhci)
 
        ret = pci_enable_msi(pdev);
        if (ret) {
-               xhci_err(xhci, "failed to allocate MSI entry\n");
+               xhci_dbg(xhci, "failed to allocate MSI entry\n");
                return ret;
        }
 
        ret = request_irq(pdev->irq, (irq_handler_t)xhci_msi_irq,
                                0, "xhci_hcd", xhci_to_hcd(xhci));
        if (ret) {
-               xhci_err(xhci, "disable MSI interrupt\n");
+               xhci_dbg(xhci, "disable MSI interrupt\n");
                pci_disable_msi(pdev);
        }
 
@@ -275,7 +289,7 @@ static int xhci_setup_msix(struct xhci_hcd *xhci)
 
        ret = pci_enable_msix(pdev, xhci->msix_entries, xhci->msix_count);
        if (ret) {
-               xhci_err(xhci, "Failed to enable MSI-X\n");
+               xhci_dbg(xhci, "Failed to enable MSI-X\n");
                goto free_entries;
        }
 
@@ -291,7 +305,7 @@ static int xhci_setup_msix(struct xhci_hcd *xhci)
        return ret;
 
 disable_msix:
-       xhci_err(xhci, "disable MSI-X interrupt\n");
+       xhci_dbg(xhci, "disable MSI-X interrupt\n");
        xhci_free_irq(xhci);
        pci_disable_msix(pdev);
 free_entries:
@@ -341,7 +355,7 @@ static int xhci_try_enable_msi(struct usb_hcd *hcd)
         * generate interrupts.  Don't even try to enable MSI.
         */
        if (xhci->quirks & XHCI_BROKEN_MSI)
-               return 0;
+               goto legacy_irq;
 
        /* unregister the legacy interrupt */
        if (hcd->irq)
@@ -362,6 +376,7 @@ static int xhci_try_enable_msi(struct usb_hcd *hcd)
                return -EINVAL;
        }
 
+ legacy_irq:
        /* fall back to legacy interrupt*/
        ret = request_irq(pdev->irq, &usb_hcd_irq, IRQF_SHARED,
                        hcd->irq_descr, hcd);
@@ -376,16 +391,16 @@ static int xhci_try_enable_msi(struct usb_hcd *hcd)
 
 #else
 
-static int xhci_try_enable_msi(struct usb_hcd *hcd)
+static inline int xhci_try_enable_msi(struct usb_hcd *hcd)
 {
        return 0;
 }
 
-static void xhci_cleanup_msix(struct xhci_hcd *xhci)
+static inline void xhci_cleanup_msix(struct xhci_hcd *xhci)
 {
 }
 
-static void xhci_msix_sync_irqs(struct xhci_hcd *xhci)
+static inline void xhci_msix_sync_irqs(struct xhci_hcd *xhci)
 {
 }
 
@@ -462,13 +477,16 @@ static bool compliance_mode_recovery_timer_quirk_check(void)
 
        dmi_product_name = dmi_get_system_info(DMI_PRODUCT_NAME);
        dmi_sys_vendor = dmi_get_system_info(DMI_SYS_VENDOR);
+       if (!dmi_product_name || !dmi_sys_vendor)
+               return false;
 
        if (!(strstr(dmi_sys_vendor, "Hewlett-Packard")))
                return false;
 
        if (strstr(dmi_product_name, "Z420") ||
                        strstr(dmi_product_name, "Z620") ||
-                       strstr(dmi_product_name, "Z820"))
+                       strstr(dmi_product_name, "Z820") ||
+                       strstr(dmi_product_name, "Z1 Workstation"))
                return true;
 
        return false;
@@ -573,6 +591,7 @@ static int xhci_run_finished(struct xhci_hcd *xhci)
                return -ENODEV;
        }
        xhci->shared_hcd->state = HC_STATE_RUNNING;
+       xhci->cmd_ring_state = CMD_RING_STATE_RUNNING;
 
        if (xhci->quirks & XHCI_NEC_HOST)
                xhci_ring_cmd_db(xhci);
@@ -757,12 +776,19 @@ void xhci_shutdown(struct usb_hcd *hcd)
 
        spin_lock_irq(&xhci->lock);
        xhci_halt(xhci);
+       /* Workaround for spurious wakeups at shutdown with HSW */
+       if (xhci->quirks & XHCI_SPURIOUS_WAKEUP)
+               xhci_reset(xhci);
        spin_unlock_irq(&xhci->lock);
 
        xhci_cleanup_msix(xhci);
 
        xhci_dbg(xhci, "xhci_shutdown completed - status = %x\n",
                    xhci_readl(xhci, &xhci->op_regs->status));
+
+       /* Yet another workaround for spurious wakeups at shutdown with HSW */
+       if (xhci->quirks & XHCI_SPURIOUS_WAKEUP)
+               pci_set_power_state(to_pci_dev(hcd->self.controller), PCI_D3hot);
 }
 
 #ifdef CONFIG_PM
@@ -854,18 +880,62 @@ static void xhci_clear_command_ring(struct xhci_hcd *xhci)
        xhci_set_cmd_ring_deq(xhci);
 }
 
+static void xhci_disable_port_wake_on_bits(struct xhci_hcd *xhci)
+{
+       int port_index;
+       __le32 __iomem **port_array;
+       unsigned long flags;
+       u32 t1, t2;
+
+       spin_lock_irqsave(&xhci->lock, flags);
+
+       /* disble usb3 ports Wake bits*/
+       port_index = xhci->num_usb3_ports;
+       port_array = xhci->usb3_ports;
+       while (port_index--) {
+               t1 = readl(port_array[port_index]);
+               t1 = xhci_port_state_to_neutral(t1);
+               t2 = t1 & ~PORT_WAKE_BITS;
+               if (t1 != t2)
+                       writel(t2, port_array[port_index]);
+       }
+
+       /* disble usb2 ports Wake bits*/
+       port_index = xhci->num_usb2_ports;
+       port_array = xhci->usb2_ports;
+       while (port_index--) {
+               t1 = readl(port_array[port_index]);
+               t1 = xhci_port_state_to_neutral(t1);
+               t2 = t1 & ~PORT_WAKE_BITS;
+               if (t1 != t2)
+                       writel(t2, port_array[port_index]);
+       }
+
+       spin_unlock_irqrestore(&xhci->lock, flags);
+}
+
 /*
  * Stop HC (not bus-specific)
  *
  * This is called when the machine transition into S3/S4 mode.
  *
  */
-int xhci_suspend(struct xhci_hcd *xhci)
+int xhci_suspend(struct xhci_hcd *xhci, bool do_wakeup)
 {
        int                     rc = 0;
+       unsigned int            delay = XHCI_MAX_HALT_USEC;
        struct usb_hcd          *hcd = xhci_to_hcd(xhci);
        u32                     command;
 
+       /* Clear root port wake on bits if wakeup not allowed. */
+       if (!do_wakeup)
+               xhci_disable_port_wake_on_bits(xhci);
+
+       /* Don't poll the roothubs on bus suspend. */
+       xhci_dbg(xhci, "%s: stopping port polling.\n", __func__);
+       clear_bit(HCD_FLAG_POLL_RH, &hcd->flags);
+       del_timer_sync(&hcd->rh_timer);
+
        spin_lock_irq(&xhci->lock);
        clear_bit(HCD_FLAG_HW_ACCESSIBLE, &hcd->flags);
        clear_bit(HCD_FLAG_HW_ACCESSIBLE, &xhci->shared_hcd->flags);
@@ -876,8 +946,12 @@ int xhci_suspend(struct xhci_hcd *xhci)
        command = xhci_readl(xhci, &xhci->op_regs->command);
        command &= ~CMD_RUN;
        xhci_writel(xhci, command, &xhci->op_regs->command);
+
+       /* Some chips from Fresco Logic need an extraordinary delay */
+       delay *= (xhci->quirks & XHCI_SLOW_SUSPEND) ? 10 : 1;
+
        if (handshake(xhci, &xhci->op_regs->status,
-                     STS_HALT, STS_HALT, 100*100)) {
+                     STS_HALT, STS_HALT, delay)) {
                xhci_warn(xhci, "WARN: xHC CMD_RUN timeout\n");
                spin_unlock_irq(&xhci->lock);
                return -ETIMEDOUT;
@@ -923,10 +997,11 @@ int xhci_suspend(struct xhci_hcd *xhci)
  */
 int xhci_resume(struct xhci_hcd *xhci, bool hibernated)
 {
-       u32                     command, temp = 0;
+       u32                     command, temp = 0, status;
        struct usb_hcd          *hcd = xhci_to_hcd(xhci);
        struct usb_hcd          *secondary_hcd;
        int                     retval = 0;
+       bool                    comp_timer_running = false;
 
        /* Wait a bit if either of the roothubs need to settle from the
         * transition into bus suspend.
@@ -964,6 +1039,13 @@ int xhci_resume(struct xhci_hcd *xhci, bool hibernated)
 
        /* If restore operation fails, re-initialize the HC during resume */
        if ((temp & STS_SRE) || hibernated) {
+
+               if ((xhci->quirks & XHCI_COMP_MODE_QUIRK) &&
+                               !(xhci_all_ports_seen_u0(xhci))) {
+                       del_timer_sync(&xhci->comp_mode_recovery_timer);
+                       xhci_dbg(xhci, "Compliance Mode Recovery Timer deleted!\n");
+               }
+
                /* Let the USB core know _both_ roothubs lost power. */
                usb_root_hub_lost_power(xhci->main_hcd->self.root_hub);
                usb_root_hub_lost_power(xhci->shared_hcd->self.root_hub);
@@ -1006,6 +1088,8 @@ int xhci_resume(struct xhci_hcd *xhci, bool hibernated)
                retval = xhci_init(hcd->primary_hcd);
                if (retval)
                        return retval;
+               comp_timer_running = true;
+
                xhci_dbg(xhci, "Start the primary HCD\n");
                retval = xhci_run(hcd->primary_hcd);
                if (!retval) {
@@ -1037,8 +1121,12 @@ int xhci_resume(struct xhci_hcd *xhci, bool hibernated)
 
  done:
        if (retval == 0) {
-               usb_hcd_resume_root_hub(hcd);
-               usb_hcd_resume_root_hub(xhci->shared_hcd);
+               /* Resume root hubs only when have pending events. */
+               status = readl(&xhci->op_regs->status);
+               if (status & STS_EINT) {
+                       usb_hcd_resume_root_hub(hcd);
+                       usb_hcd_resume_root_hub(xhci->shared_hcd);
+               }
        }
 
        /*
@@ -1047,9 +1135,14 @@ int xhci_resume(struct xhci_hcd *xhci, bool hibernated)
         * to suffer the Compliance Mode issue again. It doesn't matter if
         * ports have entered previously to U0 before system's suspension.
         */
-       if (xhci->quirks & XHCI_COMP_MODE_QUIRK)
+       if ((xhci->quirks & XHCI_COMP_MODE_QUIRK) && !comp_timer_running)
                compliance_mode_recovery_timer_init(xhci);
 
+       /* Re-enable port polling. */
+       xhci_dbg(xhci, "%s: starting port polling.\n", __func__);
+       set_bit(HCD_FLAG_POLL_RH, &hcd->flags);
+       usb_hcd_poll_rh_status(hcd);
+
        return retval;
 }
 #endif /* CONFIG_PM */
@@ -1127,9 +1220,6 @@ static int xhci_check_args(struct usb_hcd *hcd, struct usb_device *udev,
        }
 
        xhci = hcd_to_xhci(hcd);
-       if (xhci->xhc_state & XHCI_STATE_HALTED)
-               return -ENODEV;
-
        if (check_virt_dev) {
                if (!udev->slot_id || !xhci->devs[udev->slot_id]) {
                        printk(KERN_DEBUG "xHCI %s called with unaddressed "
@@ -1145,6 +1235,9 @@ static int xhci_check_args(struct usb_hcd *hcd, struct usb_device *udev,
                }
        }
 
+       if (xhci->xhc_state & XHCI_STATE_HALTED)
+               return -ENODEV;
+
        return 1;
 }
 
@@ -2236,7 +2329,7 @@ static bool xhci_is_async_ep(unsigned int ep_type)
 
 static bool xhci_is_sync_in_ep(unsigned int ep_type)
 {
-       return (ep_type == ISOC_IN_EP || ep_type != INT_IN_EP);
+       return (ep_type == ISOC_IN_EP || ep_type == INT_IN_EP);
 }
 
 static unsigned int xhci_get_ss_bw_consumed(struct xhci_bw_info *ep_bw)
@@ -2509,6 +2602,7 @@ static int xhci_configure_endpoint(struct xhci_hcd *xhci,
        struct completion *cmd_completion;
        u32 *cmd_status;
        struct xhci_virt_device *virt_dev;
+       union xhci_trb *cmd_trb;
 
        spin_lock_irqsave(&xhci->lock, flags);
        virt_dev = xhci->devs[udev->slot_id];
@@ -2554,6 +2648,7 @@ static int xhci_configure_endpoint(struct xhci_hcd *xhci,
        }
        init_completion(cmd_completion);
 
+       cmd_trb = xhci->cmd_ring->dequeue;
        if (!ctx_change)
                ret = xhci_queue_configure_endpoint(xhci, in_ctx->dma,
                                udev->slot_id, must_succeed);
@@ -2575,14 +2670,17 @@ static int xhci_configure_endpoint(struct xhci_hcd *xhci,
        /* Wait for the configure endpoint command to complete */
        timeleft = wait_for_completion_interruptible_timeout(
                        cmd_completion,
-                       USB_CTRL_SET_TIMEOUT);
+                       XHCI_CMD_DEFAULT_TIMEOUT);
        if (timeleft <= 0) {
                xhci_warn(xhci, "%s while waiting for %s command\n",
                                timeleft == 0 ? "Timeout" : "Signal",
                                ctx_change == 0 ?
                                        "configure endpoint" :
                                        "evaluate context");
-               /* FIXME cancel the configure endpoint command */
+               /* cancel the configure endpoint command */
+               ret = xhci_cancel_cmd(xhci, command, cmd_trb);
+               if (ret < 0)
+                       return ret;
                return -ETIME;
        }
 
@@ -2772,6 +2870,9 @@ void xhci_cleanup_stalled_ring(struct xhci_hcd *xhci,
                        ep_index, ep->stopped_stream, ep->stopped_td,
                        &deq_state);
 
+       if (!deq_state.new_deq_ptr || !deq_state.new_deq_seg)
+               return;
+
        /* HW with the reset endpoint quirk will use the saved dequeue state to
         * issue a configure endpoint command later.
         */
@@ -2792,61 +2893,33 @@ void xhci_cleanup_stalled_ring(struct xhci_hcd *xhci,
        }
 }
 
-/* Deal with stalled endpoints.  The core should have sent the control message
- * to clear the halt condition.  However, we need to make the xHCI hardware
- * reset its sequence number, since a device will expect a sequence number of
- * zero after the halt condition is cleared.
+/* Called when clearing halted device. The core should have sent the control
+ * message to clear the device halt condition. The host side of the halt should
+ * already be cleared with a reset endpoint command issued when the STALL tx
+ * event was received.
+ *
  * Context: in_interrupt
  */
+
 void xhci_endpoint_reset(struct usb_hcd *hcd,
                struct usb_host_endpoint *ep)
 {
        struct xhci_hcd *xhci;
-       struct usb_device *udev;
-       unsigned int ep_index;
-       unsigned long flags;
-       int ret;
-       struct xhci_virt_ep *virt_ep;
 
        xhci = hcd_to_xhci(hcd);
-       udev = (struct usb_device *) ep->hcpriv;
-       /* Called with a root hub endpoint (or an endpoint that wasn't added
-        * with xhci_add_endpoint()
-        */
-       if (!ep->hcpriv)
-               return;
-       ep_index = xhci_get_endpoint_index(&ep->desc);
-       virt_ep = &xhci->devs[udev->slot_id]->eps[ep_index];
-       if (!virt_ep->stopped_td) {
-               xhci_dbg(xhci, "Endpoint 0x%x not halted, refusing to reset.\n",
-                               ep->desc.bEndpointAddress);
-               return;
-       }
-       if (usb_endpoint_xfer_control(&ep->desc)) {
-               xhci_dbg(xhci, "Control endpoint stall already handled.\n");
-               return;
-       }
 
-       xhci_dbg(xhci, "Queueing reset endpoint command\n");
-       spin_lock_irqsave(&xhci->lock, flags);
-       ret = xhci_queue_reset_ep(xhci, udev->slot_id, ep_index);
        /*
-        * Can't change the ring dequeue pointer until it's transitioned to the
-        * stopped state, which is only upon a successful reset endpoint
-        * command.  Better hope that last command worked!
+        * We might need to implement the config ep cmd in xhci 4.8.1 note:
+        * The Reset Endpoint Command may only be issued to endpoints in the
+        * Halted state. If software wishes reset the Data Toggle or Sequence
+        * Number of an endpoint that isn't in the Halted state, then software
+        * may issue a Configure Endpoint Command with the Drop and Add bits set
+        * for the target endpoint. that is in the Stopped state.
         */
-       if (!ret) {
-               xhci_cleanup_stalled_ring(xhci, udev, ep_index);
-               kfree(virt_ep->stopped_td);
-               xhci_ring_cmd_db(xhci);
-       }
-       virt_ep->stopped_td = NULL;
-       virt_ep->stopped_trb = NULL;
-       virt_ep->stopped_stream = 0;
-       spin_unlock_irqrestore(&xhci->lock, flags);
 
-       if (ret)
-               xhci_warn(xhci, "FIXME allocate a new ring segment\n");
+       /* For now just print debug to follow the situation */
+       xhci_dbg(xhci, "Endpoint 0x%x ep reset callback called\n",
+                ep->desc.bEndpointAddress);
 }
 
 static int xhci_check_streams_endpoint(struct xhci_hcd *xhci,
@@ -3299,6 +3372,9 @@ int xhci_discover_or_reset_device(struct usb_hcd *hcd, struct usb_device *udev)
                        return -EINVAL;
        }
 
+       if (virt_dev->tt_info)
+               old_active_eps = virt_dev->tt_info->active_eps;
+
        if (virt_dev->udev != udev) {
                /* If the virt_dev and the udev does not match, this virt_dev
                 * may belong to another udev.
@@ -3453,10 +3529,21 @@ void xhci_free_dev(struct usb_hcd *hcd, struct usb_device *udev)
 {
        struct xhci_hcd *xhci = hcd_to_xhci(hcd);
        struct xhci_virt_device *virt_dev;
+       struct device *dev = hcd->self.controller;
        unsigned long flags;
        u32 state;
        int i, ret;
 
+#ifndef CONFIG_USB_DEFAULT_PERSIST
+       /*
+        * We called pm_runtime_get_noresume when the device was attached.
+        * Decrement the counter here to allow controller to runtime suspend
+        * if no devices remain.
+        */
+       if (xhci->quirks & XHCI_RESET_ON_RESUME)
+               pm_runtime_put_noidle(dev);
+#endif
+
        ret = xhci_check_args(hcd, udev, NULL, 0, true, __func__);
        /* If the host is halted due to driver unload, we still need to free the
         * device.
@@ -3528,11 +3615,14 @@ static int xhci_reserve_host_control_ep_resources(struct xhci_hcd *xhci)
 int xhci_alloc_dev(struct usb_hcd *hcd, struct usb_device *udev)
 {
        struct xhci_hcd *xhci = hcd_to_xhci(hcd);
+       struct device *dev = hcd->self.controller;
        unsigned long flags;
        int timeleft;
        int ret;
+       union xhci_trb *cmd_trb;
 
        spin_lock_irqsave(&xhci->lock, flags);
+       cmd_trb = xhci->cmd_ring->dequeue;
        ret = xhci_queue_slot_control(xhci, TRB_ENABLE_SLOT, 0);
        if (ret) {
                spin_unlock_irqrestore(&xhci->lock, flags);
@@ -3544,12 +3634,12 @@ int xhci_alloc_dev(struct usb_hcd *hcd, struct usb_device *udev)
 
        /* XXX: how much time for xHC slot assignment? */
        timeleft = wait_for_completion_interruptible_timeout(&xhci->addr_dev,
-                       USB_CTRL_SET_TIMEOUT);
+                       XHCI_CMD_DEFAULT_TIMEOUT);
        if (timeleft <= 0) {
                xhci_warn(xhci, "%s while waiting for a slot\n",
                                timeleft == 0 ? "Timeout" : "Signal");
-               /* FIXME cancel the enable slot request */
-               return 0;
+               /* cancel the enable slot request */
+               return xhci_cancel_cmd(xhci, NULL, cmd_trb);
        }
 
        if (!xhci->slot_id) {
@@ -3578,6 +3668,16 @@ int xhci_alloc_dev(struct usb_hcd *hcd, struct usb_device *udev)
                goto disable_slot;
        }
        udev->slot_id = xhci->slot_id;
+
+#ifndef CONFIG_USB_DEFAULT_PERSIST
+       /*
+        * If resetting upon resume, we can't put the controller into runtime
+        * suspend if there is a device attached.
+        */
+       if (xhci->quirks & XHCI_RESET_ON_RESUME)
+               pm_runtime_get_noresume(dev);
+#endif
+
        /* Is this a LS or FS device under a HS hub? */
        /* Hub or peripherial? */
        return 1;
@@ -3610,6 +3710,7 @@ int xhci_address_device(struct usb_hcd *hcd, struct usb_device *udev)
        struct xhci_slot_ctx *slot_ctx;
        struct xhci_input_control_ctx *ctrl_ctx;
        u64 temp_64;
+       union xhci_trb *cmd_trb;
 
        if (!udev->slot_id) {
                xhci_dbg(xhci, "Bad Slot ID %d\n", udev->slot_id);
@@ -3648,6 +3749,7 @@ int xhci_address_device(struct usb_hcd *hcd, struct usb_device *udev)
        xhci_dbg_ctx(xhci, virt_dev->in_ctx, 2);
 
        spin_lock_irqsave(&xhci->lock, flags);
+       cmd_trb = xhci->cmd_ring->dequeue;
        ret = xhci_queue_address_device(xhci, virt_dev->in_ctx->dma,
                                        udev->slot_id);
        if (ret) {
@@ -3660,7 +3762,7 @@ int xhci_address_device(struct usb_hcd *hcd, struct usb_device *udev)
 
        /* ctrl tx can take up to 5 sec; XXX: need more time for xHC? */
        timeleft = wait_for_completion_interruptible_timeout(&xhci->addr_dev,
-                       USB_CTRL_SET_TIMEOUT);
+                       XHCI_CMD_DEFAULT_TIMEOUT);
        /* FIXME: From section 4.3.4: "Software shall be responsible for timing
         * the SetAddress() "recovery interval" required by USB and aborting the
         * command on a timeout.
@@ -3668,7 +3770,10 @@ int xhci_address_device(struct usb_hcd *hcd, struct usb_device *udev)
        if (timeleft <= 0) {
                xhci_warn(xhci, "%s while waiting for address device command\n",
                                timeleft == 0 ? "Timeout" : "Signal");
-               /* FIXME cancel the address device command */
+               /* cancel the address device command */
+               ret = xhci_cancel_cmd(xhci, NULL, cmd_trb);
+               if (ret < 0)
+                       return ret;
                return -ETIME;
        }
 
@@ -4025,8 +4130,16 @@ int xhci_update_hub_device(struct usb_hcd *hcd, struct usb_device *hdev,
        ctrl_ctx->add_flags |= cpu_to_le32(SLOT_FLAG);
        slot_ctx = xhci_get_slot_ctx(xhci, config_cmd->in_ctx);
        slot_ctx->dev_info |= cpu_to_le32(DEV_HUB);
+       /*
+        * refer to section 6.2.2: MTT should be 0 for full speed hub,
+        * but it may be already set to 1 when setup an xHCI virtual
+        * device, so clear it anyway.
+        */
        if (tt->multi)
                slot_ctx->dev_info |= cpu_to_le32(DEV_MTT);
+       else if (hdev->speed == USB_SPEED_FULL)
+               slot_ctx->dev_info &= cpu_to_le32(~DEV_MTT);
+
        if (xhci->hci_version > 0x95) {
                xhci_dbg(xhci, "xHCI version %x needs hub "
                                "TT think time and number of ports\n",
@@ -4140,6 +4253,13 @@ int xhci_gen_setup(struct usb_hcd *hcd, xhci_get_quirks_t get_quirks)
 
        get_quirks(dev, xhci);
 
+       /* In xhci controllers which follow xhci 1.0 spec gives a spurious
+        * success event after a short transfer. This quirk will ignore such
+        * spurious event.
+        */
+       if (xhci->hci_version > 0x96)
+               xhci->quirks |= XHCI_SPURIOUS_SUCCESS;
+
        /* Make sure the HC is halted. */
        retval = xhci_halt(xhci);
        if (retval)