--- /dev/null
+From 6dd0a3a7e0793dbeae1b951f091025d8cf896cb4 Mon Sep 17 00:00:00 2001
+From: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Date: Tue, 16 Nov 2010 15:58:52 -0800
+Subject: xhci: Don't let the USB core disable SuperSpeed ports.
+
+From: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+
+commit 6dd0a3a7e0793dbeae1b951f091025d8cf896cb4 upstream.
+
+Disabling SuperSpeed ports is a Very Bad Thing (TM). It disables
+SuperSpeed terminations, which means that devices will never connect at
+SuperSpeed on that port. For USB 2.0/1.1 ports, disabling the port meant
+that the USB core could always get a connect status change later. That's
+not true with USB 3.0 ports.
+
+Do not let the USB core disable SuperSpeed ports. We can't rely on the
+device speed in the port status registers, since that isn't valid until
+there's a USB device connected to the port. Instead, we use the port
+speed array that's created from the Extended Capabilities registers.
+
+Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Tested-by: Don Zickus <dzickus@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/host/xhci-hub.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/usb/host/xhci-hub.c
++++ b/drivers/usb/host/xhci-hub.c
+@@ -132,6 +132,13 @@ static u32 xhci_port_state_to_neutral(u3
+ static void xhci_disable_port(struct xhci_hcd *xhci, u16 wIndex,
+ u32 __iomem *addr, u32 port_status)
+ {
++ /* Don't allow the USB core to disable SuperSpeed ports. */
++ if (xhci->port_array[wIndex] == 0x03) {
++ xhci_dbg(xhci, "Ignoring request to disable "
++ "SuperSpeed port.\n");
++ return;
++ }
++
+ /* Write 1 to disable the port */
+ xhci_writel(xhci, port_status | PORT_PE, addr);
+ port_status = xhci_readl(xhci, addr);
--- /dev/null
+From 7a3783efffc7bc2e702d774e47fad5b8e37e9ad1 Mon Sep 17 00:00:00 2001
+From: Paul Zimmerman <Paul.Zimmerman@synopsys.com>
+Date: Wed, 17 Nov 2010 16:26:50 -0800
+Subject: xhci: Fix reset-device and configure-endpoint commands
+
+From: Paul Zimmerman <Paul.Zimmerman@synopsys.com>
+
+commit 7a3783efffc7bc2e702d774e47fad5b8e37e9ad1 upstream.
+
+We have been having problems with the USB-IF Gold Tree tests when plugging
+and unplugging devices from the tree. I have seen that the reset-device
+and configure-endpoint commands, which are invoked from
+xhci_discover_or_reset_device() and xhci_configure_endpoint(), will sometimes
+time out.
+
+After much debugging, I determined that the commands themselves do not actually
+time out, but rather their completion events do not get delivered to the right
+place.
+
+This happens when the command ring has just wrapped around, and it's enqueue
+pointer is left pointing to the link TRB. xhci_discover_or_reset_device() and
+xhci_configure_endpoint() use the enqueue pointer directly as their command
+TRB pointer, without checking whether it's pointing to the link TRB.
+
+When the completion event arrives, if the command TRB is pointing to the link
+TRB, the check against the command ring dequeue pointer in
+handle_cmd_in_cmd_wait_list() fails, so the completion inside the command does
+not get signaled.
+
+The patch below fixes the timeout problem for me.
+
+This should be queued for the 2.6.35 and 2.6.36 stable trees.
+
+Signed-off-by: Paul Zimmerman <paulz@synopsys.com>
+Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/host/xhci.c | 18 ++++++++++++++++++
+ 1 file changed, 18 insertions(+)
+
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -1284,6 +1284,15 @@ static int xhci_configure_endpoint(struc
+ cmd_completion = command->completion;
+ cmd_status = &command->status;
+ command->command_trb = xhci->cmd_ring->enqueue;
++
++ /* Enqueue pointer can be left pointing to the link TRB,
++ * we must handle that
++ */
++ if ((command->command_trb->link.control & TRB_TYPE_BITMASK)
++ == TRB_TYPE(TRB_LINK))
++ command->command_trb =
++ xhci->cmd_ring->enq_seg->next->trbs;
++
+ list_add_tail(&command->cmd_list, &virt_dev->cmd_list);
+ } else {
+ in_ctx = virt_dev->in_ctx;
+@@ -1993,6 +2002,15 @@ int xhci_reset_device(struct usb_hcd *hc
+ /* Attempt to submit the Reset Device command to the command ring */
+ spin_lock_irqsave(&xhci->lock, flags);
+ reset_device_cmd->command_trb = xhci->cmd_ring->enqueue;
++
++ /* Enqueue pointer can be left pointing to the link TRB,
++ * we must handle that
++ */
++ if ((reset_device_cmd->command_trb->link.control & TRB_TYPE_BITMASK)
++ == TRB_TYPE(TRB_LINK))
++ reset_device_cmd->command_trb =
++ xhci->cmd_ring->enq_seg->next->trbs;
++
+ list_add_tail(&reset_device_cmd->cmd_list, &virt_dev->cmd_list);
+ ret = xhci_queue_reset_device(xhci, slot_id);
+ if (ret) {
--- /dev/null
+From dc07c91b9b4067022210e68d914a6890a4d70622 Mon Sep 17 00:00:00 2001
+From: Andiry Xu <andiry.xu@amd.com>
+Date: Thu, 11 Nov 2010 17:43:57 +0800
+Subject: xHCI: fix wMaxPacketSize mask
+
+From: Andiry Xu <andiry.xu@amd.com>
+
+commit dc07c91b9b4067022210e68d914a6890a4d70622 upstream.
+
+USB2.0 spec 9.6.6 says: For all endpoints, bit 10..0 specify the maximum
+packet size(in bytes).
+
+So the wMaxPacketSize mask should be 0x7ff rather than 0x3ff.
+
+This patch should be queued for the stable tree. The bug in
+xhci_endpoint_init() was present as far back as 2.6.31, and the bug in
+xhci_get_max_esit_payload() was present when the function was introduced
+in 2.6.34.
+
+Reported-by: Sander Eikelenboom <linux@eikelenboom.it>
+Signed-off-by: Andiry Xu <andiry.xu@amd.com>
+Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/host/xhci-mem.c | 4 ++--
+ drivers/usb/host/xhci.h | 5 +++++
+ 2 files changed, 7 insertions(+), 2 deletions(-)
+
+--- a/drivers/usb/host/xhci-mem.c
++++ b/drivers/usb/host/xhci-mem.c
+@@ -1043,7 +1043,7 @@ static inline u32 xhci_get_max_esit_payl
+ if (udev->speed == USB_SPEED_SUPER)
+ return ep->ss_ep_comp.wBytesPerInterval;
+
+- max_packet = ep->desc.wMaxPacketSize & 0x3ff;
++ max_packet = GET_MAX_PACKET(ep->desc.wMaxPacketSize);
+ max_burst = (ep->desc.wMaxPacketSize & 0x1800) >> 11;
+ /* A 0 in max burst means 1 transfer per ESIT */
+ return max_packet * (max_burst + 1);
+@@ -1133,7 +1133,7 @@ int xhci_endpoint_init(struct xhci_hcd *
+ /* Fall through */
+ case USB_SPEED_FULL:
+ case USB_SPEED_LOW:
+- max_packet = ep->desc.wMaxPacketSize & 0x3ff;
++ max_packet = GET_MAX_PACKET(ep->desc.wMaxPacketSize);
+ ep_ctx->ep_info2 |= MAX_PACKET(max_packet);
+ break;
+ default:
+--- a/drivers/usb/host/xhci.h
++++ b/drivers/usb/host/xhci.h
+@@ -614,6 +614,11 @@ struct xhci_ep_ctx {
+ #define MAX_PACKET_MASK (0xffff << 16)
+ #define MAX_PACKET_DECODED(p) (((p) >> 16) & 0xffff)
+
++/* Get max packet size from ep desc. Bit 10..0 specify the max packet size.
++ * USB2.0 spec 9.6.6.
++ */
++#define GET_MAX_PACKET(p) ((p) & 0x7ff)
++
+ /* tx_info bitmasks */
+ #define AVG_TRB_LENGTH_FOR_EP(p) ((p) & 0xffff)
+ #define MAX_ESIT_PAYLOAD_FOR_EP(p) (((p) & 0xffff) << 16)
--- /dev/null
+From da6699ce4a889c3795624ccdcfe7181cc89f18e8 Mon Sep 17 00:00:00 2001
+From: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Date: Tue, 26 Oct 2010 16:47:13 -0700
+Subject: xhci: Setup array of USB 2.0 and USB 3.0 ports.
+
+From: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+
+commit da6699ce4a889c3795624ccdcfe7181cc89f18e8 upstream.
+
+An xHCI host controller contains USB 2.0 and USB 3.0 ports, which can
+occur in any order in the PORTSC registers. We cannot read the port speed
+bits in the PORTSC registers at init time to determine the port speed,
+since those bits are only valid when a USB device is plugged into the
+port.
+
+Instead, we read the "Supported Protocol Capability" registers in the xHC
+Extended Capabilities space. Those describe the protocol, port offset in
+the PORTSC registers, and port count. We use those registers to create
+two arrays of pointers to the PORTSC registers, one for USB 3.0 ports, and
+another for USB 2.0 ports. A third array keeps track of the port protocol
+major revision, and is indexed with the internal xHCI port number.
+
+This commit is a bit big, but it should be queued for stable because the "Don't
+let the USB core disable SuperSpeed ports" patch depends on it. There is no
+other way to determine which ports are SuperSpeed ports without this patch.
+
+Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Tested-by: Don Zickus <dzickus@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/host/xhci-mem.c | 164 ++++++++++++++++++++++++++++++++++++++++++++
+ drivers/usb/host/xhci.h | 27 +++++++
+ 2 files changed, 191 insertions(+)
+
+--- a/drivers/usb/host/xhci-mem.c
++++ b/drivers/usb/host/xhci-mem.c
+@@ -1441,6 +1441,13 @@ void xhci_mem_cleanup(struct xhci_hcd *x
+ xhci->dcbaa = NULL;
+
+ scratchpad_free(xhci);
++
++ xhci->num_usb2_ports = 0;
++ xhci->num_usb3_ports = 0;
++ kfree(xhci->usb2_ports);
++ kfree(xhci->usb3_ports);
++ kfree(xhci->port_array);
++
+ xhci->page_size = 0;
+ xhci->page_shift = 0;
+ }
+@@ -1624,6 +1631,161 @@ static void xhci_set_hc_event_deq(struct
+ &xhci->ir_set->erst_dequeue);
+ }
+
++static void xhci_add_in_port(struct xhci_hcd *xhci, unsigned int num_ports,
++ u32 __iomem *addr, u8 major_revision)
++{
++ u32 temp, port_offset, port_count;
++ int i;
++
++ if (major_revision > 0x03) {
++ xhci_warn(xhci, "Ignoring unknown port speed, "
++ "Ext Cap %p, revision = 0x%x\n",
++ addr, major_revision);
++ /* Ignoring port protocol we can't understand. FIXME */
++ return;
++ }
++
++ /* Port offset and count in the third dword, see section 7.2 */
++ temp = xhci_readl(xhci, addr + 2);
++ port_offset = XHCI_EXT_PORT_OFF(temp);
++ port_count = XHCI_EXT_PORT_COUNT(temp);
++ xhci_dbg(xhci, "Ext Cap %p, port offset = %u, "
++ "count = %u, revision = 0x%x\n",
++ addr, port_offset, port_count, major_revision);
++ /* Port count includes the current port offset */
++ if (port_offset == 0 || (port_offset + port_count - 1) > num_ports)
++ /* WTF? "Valid values are ‘1’ to MaxPorts" */
++ return;
++ port_offset--;
++ for (i = port_offset; i < (port_offset + port_count); i++) {
++ /* Duplicate entry. Ignore the port if the revisions differ. */
++ if (xhci->port_array[i] != 0) {
++ xhci_warn(xhci, "Duplicate port entry, Ext Cap %p,"
++ " port %u\n", addr, i);
++ xhci_warn(xhci, "Port was marked as USB %u, "
++ "duplicated as USB %u\n",
++ xhci->port_array[i], major_revision);
++ /* Only adjust the roothub port counts if we haven't
++ * found a similar duplicate.
++ */
++ if (xhci->port_array[i] != major_revision &&
++ xhci->port_array[i] != (u8) -1) {
++ if (xhci->port_array[i] == 0x03)
++ xhci->num_usb3_ports--;
++ else
++ xhci->num_usb2_ports--;
++ xhci->port_array[i] = (u8) -1;
++ }
++ /* FIXME: Should we disable the port? */
++ }
++ xhci->port_array[i] = major_revision;
++ if (major_revision == 0x03)
++ xhci->num_usb3_ports++;
++ else
++ xhci->num_usb2_ports++;
++ }
++ /* FIXME: Should we disable ports not in the Extended Capabilities? */
++}
++
++/*
++ * Scan the Extended Capabilities for the "Supported Protocol Capabilities" that
++ * specify what speeds each port is supposed to be. We can't count on the port
++ * speed bits in the PORTSC register being correct until a device is connected,
++ * but we need to set up the two fake roothubs with the correct number of USB
++ * 3.0 and USB 2.0 ports at host controller initialization time.
++ */
++static int xhci_setup_port_arrays(struct xhci_hcd *xhci, gfp_t flags)
++{
++ u32 __iomem *addr;
++ u32 offset;
++ unsigned int num_ports;
++ int i, port_index;
++
++ addr = &xhci->cap_regs->hcc_params;
++ offset = XHCI_HCC_EXT_CAPS(xhci_readl(xhci, addr));
++ if (offset == 0) {
++ xhci_err(xhci, "No Extended Capability registers, "
++ "unable to set up roothub.\n");
++ return -ENODEV;
++ }
++
++ num_ports = HCS_MAX_PORTS(xhci->hcs_params1);
++ xhci->port_array = kzalloc(sizeof(*xhci->port_array)*num_ports, flags);
++ if (!xhci->port_array)
++ return -ENOMEM;
++
++ /*
++ * For whatever reason, the first capability offset is from the
++ * capability register base, not from the HCCPARAMS register.
++ * See section 5.3.6 for offset calculation.
++ */
++ addr = &xhci->cap_regs->hc_capbase + offset;
++ while (1) {
++ u32 cap_id;
++
++ cap_id = xhci_readl(xhci, addr);
++ if (XHCI_EXT_CAPS_ID(cap_id) == XHCI_EXT_CAPS_PROTOCOL)
++ xhci_add_in_port(xhci, num_ports, addr,
++ (u8) XHCI_EXT_PORT_MAJOR(cap_id));
++ offset = XHCI_EXT_CAPS_NEXT(cap_id);
++ if (!offset || (xhci->num_usb2_ports + xhci->num_usb3_ports)
++ == num_ports)
++ break;
++ /*
++ * Once you're into the Extended Capabilities, the offset is
++ * always relative to the register holding the offset.
++ */
++ addr += offset;
++ }
++
++ if (xhci->num_usb2_ports == 0 && xhci->num_usb3_ports == 0) {
++ xhci_warn(xhci, "No ports on the roothubs?\n");
++ return -ENODEV;
++ }
++ xhci_dbg(xhci, "Found %u USB 2.0 ports and %u USB 3.0 ports.\n",
++ xhci->num_usb2_ports, xhci->num_usb3_ports);
++ /*
++ * Note we could have all USB 3.0 ports, or all USB 2.0 ports.
++ * Not sure how the USB core will handle a hub with no ports...
++ */
++ if (xhci->num_usb2_ports) {
++ xhci->usb2_ports = kmalloc(sizeof(*xhci->usb2_ports)*
++ xhci->num_usb2_ports, flags);
++ if (!xhci->usb2_ports)
++ return -ENOMEM;
++
++ port_index = 0;
++ for (i = 0; i < num_ports; i++)
++ if (xhci->port_array[i] != 0x03) {
++ xhci->usb2_ports[port_index] =
++ &xhci->op_regs->port_status_base +
++ NUM_PORT_REGS*i;
++ xhci_dbg(xhci, "USB 2.0 port at index %u, "
++ "addr = %p\n", i,
++ xhci->usb2_ports[port_index]);
++ port_index++;
++ }
++ }
++ if (xhci->num_usb3_ports) {
++ xhci->usb3_ports = kmalloc(sizeof(*xhci->usb3_ports)*
++ xhci->num_usb3_ports, flags);
++ if (!xhci->usb3_ports)
++ return -ENOMEM;
++
++ port_index = 0;
++ for (i = 0; i < num_ports; i++)
++ if (xhci->port_array[i] == 0x03) {
++ xhci->usb3_ports[port_index] =
++ &xhci->op_regs->port_status_base +
++ NUM_PORT_REGS*i;
++ xhci_dbg(xhci, "USB 3.0 port at index %u, "
++ "addr = %p\n", i,
++ xhci->usb3_ports[port_index]);
++ port_index++;
++ }
++ }
++ return 0;
++}
+
+ int xhci_mem_init(struct xhci_hcd *xhci, gfp_t flags)
+ {
+@@ -1804,6 +1966,8 @@ int xhci_mem_init(struct xhci_hcd *xhci,
+
+ if (scratchpad_alloc(xhci, flags))
+ goto fail;
++ if (xhci_setup_port_arrays(xhci, flags))
++ goto fail;
+
+ return 0;
+
+--- a/drivers/usb/host/xhci.h
++++ b/drivers/usb/host/xhci.h
+@@ -448,6 +448,24 @@ struct xhci_doorbell_array {
+
+
+ /**
++ * struct xhci_protocol_caps
++ * @revision: major revision, minor revision, capability ID,
++ * and next capability pointer.
++ * @name_string: Four ASCII characters to say which spec this xHC
++ * follows, typically "USB ".
++ * @port_info: Port offset, count, and protocol-defined information.
++ */
++struct xhci_protocol_caps {
++ u32 revision;
++ u32 name_string;
++ u32 port_info;
++};
++
++#define XHCI_EXT_PORT_MAJOR(x) (((x) >> 24) & 0xff)
++#define XHCI_EXT_PORT_OFF(x) ((x) & 0xff)
++#define XHCI_EXT_PORT_COUNT(x) (((x) >> 8) & 0xff)
++
++/**
+ * struct xhci_container_ctx
+ * @type: Type of context. Used to calculated offsets to contained contexts.
+ * @size: Size of the context data
+@@ -1204,6 +1222,15 @@ struct xhci_hcd {
+ #define XHCI_LINK_TRB_QUIRK (1 << 0)
+ #define XHCI_RESET_EP_QUIRK (1 << 1)
+ #define XHCI_NEC_HOST (1 << 2)
++
++ /* Is each xHCI roothub port a USB 3.0, USB 2.0, or USB 1.1 port? */
++ u8 *port_array;
++ /* Array of pointers to USB 3.0 PORTSC registers */
++ u32 __iomem **usb3_ports;
++ unsigned int num_usb3_ports;
++ /* Array of pointers to USB 2.0 PORTSC registers */
++ u32 __iomem **usb2_ports;
++ unsigned int num_usb2_ports;
+ };
+
+ /* For testing purposes */