38 files changed, 232 insertions, 126 deletions

diff --git a/Documentation/usb/typec.rst b/Documentation/usb/typec.rst
index b67a46779de9..8a7249f2ff04 100644
--- a/Documentation/usb/typec.rst
+++ b/Documentation/usb/typec.rst
@@ -114,8 +114,7 @@ the details during registration. The class offers the following API for
 registering/unregistering cables and their plugs:
 
 .. kernel-doc:: drivers/usb/typec/typec.c
-   :functions: typec_register_cable typec_unregister_cable typec_register_plug
-   typec_unregister_plug
+   :functions: typec_register_cable typec_unregister_cable typec_register_plug typec_unregister_plug
 
 The class will provide a handle to struct typec_cable and struct typec_plug if
 the registration is successful, or NULL if it isn't.
@@ -137,8 +136,7 @@ during connection of a partner or cable, the port driver must use the following
 APIs to report it to the class:
 
 .. kernel-doc:: drivers/usb/typec/typec.c
-   :functions: typec_set_data_role typec_set_pwr_role typec_set_vconn_role
-   typec_set_pwr_opmode
+   :functions: typec_set_data_role typec_set_pwr_role typec_set_vconn_role typec_set_pwr_opmode
 
 Alternate Modes
 ~~~~~~~~~~~~~~~
diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
index cfc3cff6e8d5..8e6ef671be9b 100644
--- a/drivers/usb/core/devio.c
+++ b/drivers/usb/core/devio.c
@@ -475,11 +475,11 @@ static void snoop_urb(struct usb_device *udev,
 
         if (userurb) {          /* Async */
                 if (when == SUBMIT)
-                        dev_info(&udev->dev, "userurb %p, ep%d %s-%s, "
+                        dev_info(&udev->dev, "userurb %pK, ep%d %s-%s, "
                                         "length %u\n",
                                         userurb, ep, t, d, length);
                 else
-                        dev_info(&udev->dev, "userurb %p, ep%d %s-%s, "
+                        dev_info(&udev->dev, "userurb %pK, ep%d %s-%s, "
                                         "actual_length %u status %d\n",
                                         userurb, ep, t, d, length,
                                         timeout_or_status);
@@ -1895,7 +1895,7 @@ static int proc_reapurb(struct usb_dev_state *ps, void __user *arg)
         if (as) {
                 int retval;
 
-                snoop(&ps->dev->dev, "reap %p\n", as->userurb);
+                snoop(&ps->dev->dev, "reap %pK\n", as->userurb);
                 retval = processcompl(as, (void __user * __user *)arg);
                 free_async(as);
                 return retval;
@@ -1912,7 +1912,7 @@ static int proc_reapurbnonblock(struct usb_dev_state *ps, void __user *arg)
 
         as = async_getcompleted(ps);
         if (as) {
-                snoop(&ps->dev->dev, "reap %p\n", as->userurb);
+                snoop(&ps->dev->dev, "reap %pK\n", as->userurb);
                 retval = processcompl(as, (void __user * __user *)arg);
                 free_async(as);
         } else {
@@ -2043,7 +2043,7 @@ static int proc_reapurb_compat(struct usb_dev_state *ps, void __user *arg)
         if (as) {
                 int retval;
 
-                snoop(&ps->dev->dev, "reap %p\n", as->userurb);
+                snoop(&ps->dev->dev, "reap %pK\n", as->userurb);
                 retval = processcompl_compat(as, (void __user * __user *)arg);
                 free_async(as);
                 return retval;
@@ -2060,7 +2060,7 @@ static int proc_reapurbnonblock_compat(struct usb_dev_state *ps, void __user *ar
 
         as = async_getcompleted(ps);
         if (as) {
-                snoop(&ps->dev->dev, "reap %p\n", as->userurb);
+                snoop(&ps->dev->dev, "reap %pK\n", as->userurb);
                 retval = processcompl_compat(as, (void __user * __user *)arg);
                 free_async(as);
         } else {
@@ -2489,7 +2489,7 @@ static long usbdev_do_ioctl(struct file *file, unsigned int cmd,
 #endif
 
         case USBDEVFS_DISCARDURB:
-                snoop(&dev->dev, "%s: DISCARDURB %p\n", __func__, p);
+                snoop(&dev->dev, "%s: DISCARDURB %pK\n", __func__, p);
                 ret = proc_unlinkurb(ps, p);
                 break;
 
diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c
index 49550790a3cb..5dea98358c05 100644
--- a/drivers/usb/core/hcd.c
+++ b/drivers/usb/core/hcd.c
@@ -1723,7 +1723,7 @@ int usb_hcd_unlink_urb (struct urb *urb, int status)
                 if (retval == 0)
                         retval = -EINPROGRESS;
                 else if (retval != -EIDRM && retval != -EBUSY)
-                        dev_dbg(&udev->dev, "hcd_unlink_urb %p fail %d\n",
+                        dev_dbg(&udev->dev, "hcd_unlink_urb %pK fail %d\n",
                                         urb, retval);
                 usb_put_dev(udev);
         }
@@ -1890,7 +1890,7 @@ rescan:
                 /* kick hcd */
                 unlink1(hcd, urb, -ESHUTDOWN);
                 dev_dbg (hcd->self.controller,
-                        "shutdown urb %p ep%d%s%s\n",
+                        "shutdown urb %pK ep%d%s%s\n",
                         urb, usb_endpoint_num(&ep->desc),
                         is_in ? "in" : "out",
                         ({      char *s;
@@ -2520,6 +2520,7 @@ struct usb_hcd *__usb_create_hcd(const struct hc_driver *driver,
                 hcd->bandwidth_mutex = kmalloc(sizeof(*hcd->bandwidth_mutex),
                                 GFP_KERNEL);
                 if (!hcd->bandwidth_mutex) {
+                        kfree(hcd->address0_mutex);
                         kfree(hcd);
                         dev_dbg(dev, "hcd bandwidth mutex alloc failed\n");
                         return NULL;
diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index 9dca59ef18b3..b8bb20d7acdb 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -362,7 +362,8 @@ static void usb_set_lpm_parameters(struct usb_device *udev)
 }
 
 /* USB 2.0 spec Section 11.24.4.5 */
-static int get_hub_descriptor(struct usb_device *hdev, void *data)
+static int get_hub_descriptor(struct usb_device *hdev,
+                struct usb_hub_descriptor *desc)
 {
         int i, ret, size;
         unsigned dtype;
@@ -378,10 +379,18 @@ static int get_hub_descriptor(struct usb_device *hdev, void *data)
         for (i = 0; i < 3; i++) {
                 ret = usb_control_msg(hdev, usb_rcvctrlpipe(hdev, 0),
                         USB_REQ_GET_DESCRIPTOR, USB_DIR_IN | USB_RT_HUB,
-                        dtype << 8, 0, data, size,
+                        dtype << 8, 0, desc, size,
                         USB_CTRL_GET_TIMEOUT);
-                if (ret >= (USB_DT_HUB_NONVAR_SIZE + 2))
+                if (hub_is_superspeed(hdev)) {
+                        if (ret == size)
+                                return ret;
+                } else if (ret >= USB_DT_HUB_NONVAR_SIZE + 2) {
+                        /* Make sure we have the DeviceRemovable field. */
+                        size = USB_DT_HUB_NONVAR_SIZE + desc->bNbrPorts / 8 + 1;
+                        if (ret < size)
+                                return -EMSGSIZE;
                         return ret;
+                }
         }
         return -EINVAL;
 }
@@ -1313,7 +1322,7 @@ static int hub_configure(struct usb_hub *hub,
         }
         mutex_init(&hub->status_mutex);
 
-        hub->descriptor = kmalloc(sizeof(*hub->descriptor), GFP_KERNEL);
+        hub->descriptor = kzalloc(sizeof(*hub->descriptor), GFP_KERNEL);
         if (!hub->descriptor) {
                 ret = -ENOMEM;
                 goto fail;
@@ -1321,13 +1330,19 @@ static int hub_configure(struct usb_hub *hub,
 
         /* Request the entire hub descriptor.
          * hub->descriptor can handle USB_MAXCHILDREN ports,
-         * but the hub can/will return fewer bytes here.
+         * but a (non-SS) hub can/will return fewer bytes here.
          */
         ret = get_hub_descriptor(hdev, hub->descriptor);
         if (ret < 0) {
                 message = "can't read hub descriptor";
                 goto fail;
-        } else if (hub->descriptor->bNbrPorts > USB_MAXCHILDREN) {
+        }
+
+        maxchild = USB_MAXCHILDREN;
+        if (hub_is_superspeed(hdev))
+                maxchild = min_t(unsigned, maxchild, USB_SS_MAXPORTS);
+
+        if (hub->descriptor->bNbrPorts > maxchild) {
                 message = "hub has too many ports!";
                 ret = -ENODEV;
                 goto fail;
diff --git a/drivers/usb/core/of.c b/drivers/usb/core/of.c
index d787f195a9a6..d563cbcf76cf 100644
--- a/drivers/usb/core/of.c
+++ b/drivers/usb/core/of.c
@@ -53,6 +53,9 @@ EXPORT_SYMBOL_GPL(usb_of_get_child_node);
  *
  * Find the companion device from platform bus.
  *
+ * Takes a reference to the returned struct device which needs to be dropped
+ * after use.
+ *
  * Return: On success, a pointer to the companion device, %NULL on failure.
  */
 struct device *usb_of_get_companion_dev(struct device *dev)
diff --git a/drivers/usb/core/urb.c b/drivers/usb/core/urb.c
index d75cb8c0f7df..47903d510955 100644
--- a/drivers/usb/core/urb.c
+++ b/drivers/usb/core/urb.c
@@ -338,7 +338,7 @@ int usb_submit_urb(struct urb *urb, gfp_t mem_flags)
         if (!urb || !urb->complete)
                 return -EINVAL;
         if (urb->hcpriv) {
-                WARN_ONCE(1, "URB %p submitted while active\n", urb);
+                WARN_ONCE(1, "URB %pK submitted while active\n", urb);
                 return -EBUSY;
         }
 
diff --git a/drivers/usb/dwc3/dwc3-keystone.c b/drivers/usb/dwc3/dwc3-keystone.c
index 72664700b8a2..12ee23f53cdd 100644
--- a/drivers/usb/dwc3/dwc3-keystone.c
+++ b/drivers/usb/dwc3/dwc3-keystone.c
@@ -107,6 +107,10 @@ static int kdwc3_probe(struct platform_device *pdev)
                 return PTR_ERR(kdwc->usbss);
 
         kdwc->clk = devm_clk_get(kdwc->dev, "usb");
+        if (IS_ERR(kdwc->clk)) {
+                dev_err(kdwc->dev, "unable to get usb clock\n");
+                return PTR_ERR(kdwc->clk);
+        }
 
         error = clk_prepare_enable(kdwc->clk);
         if (error < 0) {
diff --git a/drivers/usb/dwc3/dwc3-pci.c b/drivers/usb/dwc3/dwc3-pci.c
index a15ec71d0423..84a2cebfc712 100644
--- a/drivers/usb/dwc3/dwc3-pci.c
+++ b/drivers/usb/dwc3/dwc3-pci.c
@@ -39,6 +39,8 @@
 #define PCI_DEVICE_ID_INTEL_APL                 0x5aaa
 #define PCI_DEVICE_ID_INTEL_KBP                 0xa2b0
 #define PCI_DEVICE_ID_INTEL_GLK                 0x31aa
+#define PCI_DEVICE_ID_INTEL_CNPLP               0x9dee
+#define PCI_DEVICE_ID_INTEL_CNPH                0xa36e
 
 #define PCI_INTEL_BXT_DSM_UUID          "732b85d5-b7a7-4a1b-9ba0-4bbd00ffd511"
 #define PCI_INTEL_BXT_FUNC_PMU_PWR      4
@@ -270,6 +272,8 @@ static const struct pci_device_id dwc3_pci_id_table[] = {
         { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_APL), },
         { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_KBP), },
         { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_GLK), },
+        { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_CNPLP), },
+        { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_CNPH), },
         { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_NL_USB), },
         {  }    /* Terminating Entry */
 };
diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index 6f6f0b3be3ad..aea9a5b948b4 100644
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -1261,14 +1261,24 @@ static int __dwc3_gadget_ep_queue(struct dwc3_ep *dep, struct dwc3_request *req)
                                 __dwc3_gadget_start_isoc(dwc, dep, cur_uf);
                                 dep->flags &= ~DWC3_EP_PENDING_REQUEST;
                         }
+                        return 0;
                 }
-                return 0;
+
+                if ((dep->flags & DWC3_EP_BUSY) &&
+                    !(dep->flags & DWC3_EP_MISSED_ISOC)) {
+                        WARN_ON_ONCE(!dep->resource_index);
+                        ret = __dwc3_gadget_kick_transfer(dep,
+                                                          dep->resource_index);
+                }
+
+                goto out;
         }
 
         if (!dwc3_calc_trbs_left(dep))
                 return 0;
 
         ret = __dwc3_gadget_kick_transfer(dep, 0);
+out:
         if (ret == -EBUSY)
                 ret = 0;
 
@@ -3026,6 +3036,15 @@ static irqreturn_t dwc3_check_event_buf(struct dwc3_event_buffer *evt)
                 return IRQ_HANDLED;
         }
 
+        /*
+         * With PCIe legacy interrupt, test shows that top-half irq handler can
+         * be called again after HW interrupt deassertion. Check if bottom-half
+         * irq event handler completes before caching new event to prevent
+         * losing events.
+         */
+        if (evt->flags & DWC3_EVENT_PENDING)
+                return IRQ_HANDLED;
+
         count = dwc3_readl(dwc->regs, DWC3_GEVNTCOUNT(0));
         count &= DWC3_GEVNTCOUNT_MASK;
         if (!count)
diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
index 71dd27c0d7f2..47dda3450abd 100644
--- a/drivers/usb/gadget/function/f_fs.c
+++ b/drivers/usb/gadget/function/f_fs.c
@@ -1858,12 +1858,12 @@ static int ffs_func_eps_enable(struct ffs_function *func)
                 ep->ep->driver_data = ep;
                 ep->ep->desc = ds;
 
-                comp_desc = (struct usb_ss_ep_comp_descriptor *)(ds +
-                                USB_DT_ENDPOINT_SIZE);
-                ep->ep->maxburst = comp_desc->bMaxBurst + 1;
-
-                if (needs_comp_desc)
+                if (needs_comp_desc) {
+                        comp_desc = (struct usb_ss_ep_comp_descriptor *)(ds +
+                                        USB_DT_ENDPOINT_SIZE);
+                        ep->ep->maxburst = comp_desc->bMaxBurst + 1;
                         ep->ep->comp_desc = comp_desc;
+                }
 
                 ret = usb_ep_enable(ep->ep);
                 if (likely(!ret)) {
diff --git a/drivers/usb/gadget/function/u_serial.c b/drivers/usb/gadget/function/u_serial.c
index 000677c991b0..9b0805f55ad7 100644
--- a/drivers/usb/gadget/function/u_serial.c
+++ b/drivers/usb/gadget/function/u_serial.c
@@ -1256,7 +1256,7 @@ static void gserial_console_exit(void)
         struct gscons_info *info = &gscons_info;
 
         unregister_console(&gserial_cons);
-        if (info->console_thread != NULL)
+        if (!IS_ERR_OR_NULL(info->console_thread))
                 kthread_stop(info->console_thread);
         gs_buf_free(&info->con_buf);
 }
diff --git a/drivers/usb/gadget/udc/dummy_hcd.c b/drivers/usb/gadget/udc/dummy_hcd.c
index c79081952ea0..ccabb51cb98d 100644
--- a/drivers/usb/gadget/udc/dummy_hcd.c
+++ b/drivers/usb/gadget/udc/dummy_hcd.c
@@ -2008,7 +2008,7 @@ ss_hub_descriptor(struct usb_hub_descriptor *desc)
                         HUB_CHAR_COMMON_OCPM);
         desc->bNbrPorts = 1;
         desc->u.ss.bHubHdrDecLat = 0x04; /* Worst case: 0.4 micro sec*/
-        desc->u.ss.DeviceRemovable = 0xffff;
+        desc->u.ss.DeviceRemovable = 0;
 }
 
 static inline void hub_descriptor(struct usb_hub_descriptor *desc)
@@ -2020,8 +2020,8 @@ static inline void hub_descriptor(struct usb_hub_descriptor *desc)
                         HUB_CHAR_INDV_PORT_LPSM |
                         HUB_CHAR_COMMON_OCPM);
         desc->bNbrPorts = 1;
-        desc->u.hs.DeviceRemovable[0] = 0xff;
-        desc->u.hs.DeviceRemovable[1] = 0xff;
+        desc->u.hs.DeviceRemovable[0] = 0;
+        desc->u.hs.DeviceRemovable[1] = 0xff;   /* PortPwrCtrlMask */
 }
 
 static int dummy_hub_control(
diff --git a/drivers/usb/host/ehci-platform.c b/drivers/usb/host/ehci-platform.c
index bc7b9be12f54..f1908ea9fbd8 100644
--- a/drivers/usb/host/ehci-platform.c
+++ b/drivers/usb/host/ehci-platform.c
@@ -384,8 +384,10 @@ static int ehci_platform_resume(struct device *dev)
         }
 
         companion_dev = usb_of_get_companion_dev(hcd->self.controller);
-        if (companion_dev)
+        if (companion_dev) {
                 device_pm_wait_for_dev(hcd->self.controller, companion_dev);
+                put_device(companion_dev);
+        }
 
         ehci_resume(hcd, priv->reset_on_resume);
         return 0;
diff --git a/drivers/usb/host/r8a66597-hcd.c b/drivers/usb/host/r8a66597-hcd.c
index bfa7fa3d2eea..7bf78be1fd32 100644
--- a/drivers/usb/host/r8a66597-hcd.c
+++ b/drivers/usb/host/r8a66597-hcd.c
@@ -1269,7 +1269,7 @@ static void set_td_timer(struct r8a66597 *r8a66597, struct r8a66597_td *td)
                         time = 30;
                         break;
                 default:
-                        time = 300;
+                        time = 50;
                         break;
                 }
 
@@ -1785,6 +1785,7 @@ static void r8a66597_td_timer(unsigned long _r8a66597)
                 pipe = td->pipe;
                 pipe_stop(r8a66597, pipe);
 
+                /* Select a different address or endpoint */
                 new_td = td;
                 do {
                         list_move_tail(&new_td->queue,
@@ -1794,7 +1795,8 @@ static void r8a66597_td_timer(unsigned long _r8a66597)
                                 new_td = td;
                                 break;
                         }
-                } while (td != new_td && td->address == new_td->address);
+                } while (td != new_td && td->address == new_td->address &&
+                        td->pipe->info.epnum == new_td->pipe->info.epnum);
 
                 start_transfer(r8a66597, new_td);
 
diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
index 5e3e9d4c6956..0dde49c35dd2 100644
--- a/drivers/usb/host/xhci-hub.c
+++ b/drivers/usb/host/xhci-hub.c
@@ -419,7 +419,7 @@ static int xhci_stop_device(struct xhci_hcd *xhci, int slot_id, int suspend)
         wait_for_completion(cmd->completion);
 
         if (cmd->status == COMP_COMMAND_ABORTED ||
-                        cmd->status == COMP_STOPPED) {
+            cmd->status == COMP_COMMAND_RING_STOPPED) {
                 xhci_warn(xhci, "Timeout while waiting for stop endpoint command\n");
                 ret = -ETIME;
         }
diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
index bbe22bcc550a..1f1687e888d6 100644
--- a/drivers/usb/host/xhci-mem.c
+++ b/drivers/usb/host/xhci-mem.c
@@ -56,7 +56,7 @@ static struct xhci_segment *xhci_segment_alloc(struct xhci_hcd *xhci,
         }
 
         if (max_packet) {
-                seg->bounce_buf = kzalloc(max_packet, flags | GFP_DMA);
+                seg->bounce_buf = kzalloc(max_packet, flags);
                 if (!seg->bounce_buf) {
                         dma_pool_free(xhci->segment_pool, seg->trbs, dma);
                         kfree(seg);
@@ -1724,7 +1724,7 @@ static int scratchpad_alloc(struct xhci_hcd *xhci, gfp_t flags)
         xhci->dcbaa->dev_context_ptrs[0] = cpu_to_le64(xhci->scratchpad->sp_dma);
         for (i = 0; i < num_sp; i++) {
                 dma_addr_t dma;
-                void *buf = dma_alloc_coherent(dev, xhci->page_size, &dma,
+                void *buf = dma_zalloc_coherent(dev, xhci->page_size, &dma,
                                 flags);
                 if (!buf)
                         goto fail_sp4;
@@ -2307,10 +2307,11 @@ static int xhci_setup_port_arrays(struct xhci_hcd *xhci, gfp_t flags)
         /* Place limits on the number of roothub ports so that the hub
          * descriptors aren't longer than the USB core will allocate.
          */
-        if (xhci->num_usb3_ports > 15) {
+        if (xhci->num_usb3_ports > USB_SS_MAXPORTS) {
                 xhci_dbg_trace(xhci, trace_xhci_dbg_init,
-                                "Limiting USB 3.0 roothub ports to 15.");
-                xhci->num_usb3_ports = 15;
+                                "Limiting USB 3.0 roothub ports to %u.",
+                                USB_SS_MAXPORTS);
+                xhci->num_usb3_ports = USB_SS_MAXPORTS;
         }
         if (xhci->num_usb2_ports > USB_MAXCHILDREN) {
                 xhci_dbg_trace(xhci, trace_xhci_dbg_init,
diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
index 7b86508ac8cf..fcf1f3f63e7a 100644
--- a/drivers/usb/host/xhci-pci.c
+++ b/drivers/usb/host/xhci-pci.c
@@ -52,6 +52,7 @@
 #define PCI_DEVICE_ID_INTEL_BROXTON_M_XHCI              0x0aa8
 #define PCI_DEVICE_ID_INTEL_BROXTON_B_XHCI              0x1aa8
 #define PCI_DEVICE_ID_INTEL_APL_XHCI                    0x5aa8
+#define PCI_DEVICE_ID_INTEL_DNV_XHCI                    0x19d0
 
 static const char hcd_name[] = "xhci_hcd";
 
@@ -166,7 +167,8 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
                  pdev->device == PCI_DEVICE_ID_INTEL_CHERRYVIEW_XHCI ||
                  pdev->device == PCI_DEVICE_ID_INTEL_BROXTON_M_XHCI ||
                  pdev->device == PCI_DEVICE_ID_INTEL_BROXTON_B_XHCI ||
-                 pdev->device == PCI_DEVICE_ID_INTEL_APL_XHCI)) {
+                 pdev->device == PCI_DEVICE_ID_INTEL_APL_XHCI ||
+                 pdev->device == PCI_DEVICE_ID_INTEL_DNV_XHCI)) {
                 xhci->quirks |= XHCI_PME_STUCK_QUIRK;
         }
         if (pdev->vendor == PCI_VENDOR_ID_INTEL &&
@@ -175,7 +177,8 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
         }
         if (pdev->vendor == PCI_VENDOR_ID_INTEL &&
             (pdev->device == PCI_DEVICE_ID_INTEL_CHERRYVIEW_XHCI ||
-             pdev->device == PCI_DEVICE_ID_INTEL_APL_XHCI))
+             pdev->device == PCI_DEVICE_ID_INTEL_APL_XHCI ||
+             pdev->device == PCI_DEVICE_ID_INTEL_DNV_XHCI))
                 xhci->quirks |= XHCI_MISSING_CAS;
 
         if (pdev->vendor == PCI_VENDOR_ID_ETRON &&
diff --git a/drivers/usb/host/xhci-plat.c b/drivers/usb/host/xhci-plat.c
index 7c2a9e7c8e0f..c04144b25a67 100644
--- a/drivers/usb/host/xhci-plat.c
+++ b/drivers/usb/host/xhci-plat.c
@@ -177,7 +177,7 @@ static int xhci_plat_probe(struct platform_device *pdev)
 
         irq = platform_get_irq(pdev, 0);
         if (irq < 0)
-                return -ENODEV;
+                return irq;
 
         /*
          * sysdev must point to a device that is known to the system firmware
diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index 74bf5c60a260..03f63f50afb6 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -323,7 +323,7 @@ static void xhci_handle_stopped_cmd_ring(struct xhci_hcd *xhci,
                 if (i_cmd->status != COMP_COMMAND_ABORTED)
                         continue;
 
-                i_cmd->status = COMP_STOPPED;
+                i_cmd->status = COMP_COMMAND_RING_STOPPED;
 
                 xhci_dbg(xhci, "Turn aborted command %p to no-op\n",
                          i_cmd->command_trb);
@@ -641,8 +641,8 @@ static void xhci_giveback_urb_in_irq(struct xhci_hcd *xhci,
         xhci_urb_free_priv(urb_priv);
         usb_hcd_unlink_urb_from_ep(hcd, urb);
         spin_unlock(&xhci->lock);
-        usb_hcd_giveback_urb(hcd, urb, status);
         trace_xhci_urb_giveback(urb);
+        usb_hcd_giveback_urb(hcd, urb, status);
         spin_lock(&xhci->lock);
 }
 
@@ -1380,7 +1380,7 @@ static void handle_cmd_completion(struct xhci_hcd *xhci,
         cmd_comp_code = GET_COMP_CODE(le32_to_cpu(event->status));
 
         /* If CMD ring stopped we own the trbs between enqueue and dequeue */
-        if (cmd_comp_code == COMP_STOPPED) {
+        if (cmd_comp_code == COMP_COMMAND_RING_STOPPED) {
                 complete_all(&xhci->cmd_ring_stop_completion);
                 return;
         }
@@ -1436,8 +1436,8 @@ static void handle_cmd_completion(struct xhci_hcd *xhci,
                 break;
         case TRB_CMD_NOOP:
                 /* Is this an aborted command turned to NO-OP? */
-                if (cmd->status == COMP_STOPPED)
-                        cmd_comp_code = COMP_STOPPED;
+                if (cmd->status == COMP_COMMAND_RING_STOPPED)
+                        cmd_comp_code = COMP_COMMAND_RING_STOPPED;
                 break;
         case TRB_RESET_EP:
                 WARN_ON(slot_id != TRB_TO_SLOT_ID(
@@ -2677,11 +2677,12 @@ irqreturn_t xhci_irq(struct usb_hcd *hcd)
         struct xhci_hcd *xhci = hcd_to_xhci(hcd);
         union xhci_trb *event_ring_deq;
         irqreturn_t ret = IRQ_NONE;
+        unsigned long flags;
         dma_addr_t deq;
         u64 temp_64;
         u32 status;
 
-        spin_lock(&xhci->lock);
+        spin_lock_irqsave(&xhci->lock, flags);
         /* Check if the xHC generated the interrupt, or the irq is shared */
         status = readl(&xhci->op_regs->status);
         if (status == ~(u32)0) {
@@ -2707,12 +2708,9 @@ irqreturn_t xhci_irq(struct usb_hcd *hcd)
          */
         status |= STS_EINT;
         writel(status, &xhci->op_regs->status);
-        /* FIXME when MSI-X is supported and there are multiple vectors */
-        /* Clear the MSI-X event interrupt status */
 
-        if (hcd->irq) {
+        if (!hcd->msi_enabled) {
                 u32 irq_pending;
-                /* Acknowledge the PCI interrupt */
                 irq_pending = readl(&xhci->ir_set->irq_pending);
                 irq_pending |= IMAN_IP;
                 writel(irq_pending, &xhci->ir_set->irq_pending);
@@ -2757,7 +2755,7 @@ irqreturn_t xhci_irq(struct usb_hcd *hcd)
         ret = IRQ_HANDLED;
 
 out:
-        spin_unlock(&xhci->lock);
+        spin_unlock_irqrestore(&xhci->lock, flags);
 
         return ret;
 }
diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index 2d1310220832..30f47d92a610 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -359,9 +359,10 @@ static int xhci_try_enable_msi(struct usb_hcd *hcd)
                 /* fall back to msi*/
                 ret = xhci_setup_msi(xhci);
 
-        if (!ret)
-                /* hcd->irq is 0, we have MSI */
+        if (!ret) {
+                hcd->msi_enabled = 1;
                 return 0;
+        }
 
         if (!pdev->irq) {
                 xhci_err(xhci, "No msi-x/msi found and no IRQ in BIOS\n");
@@ -1763,7 +1764,7 @@ static int xhci_configure_endpoint_result(struct xhci_hcd *xhci,
 
         switch (*cmd_status) {
         case COMP_COMMAND_ABORTED:
-        case COMP_STOPPED:
+        case COMP_COMMAND_RING_STOPPED:
                 xhci_warn(xhci, "Timeout while waiting for configure endpoint command\n");
                 ret = -ETIME;
                 break;
@@ -1813,7 +1814,7 @@ static int xhci_evaluate_context_result(struct xhci_hcd *xhci,
 
         switch (*cmd_status) {
         case COMP_COMMAND_ABORTED:
-        case COMP_STOPPED:
+        case COMP_COMMAND_RING_STOPPED:
                 xhci_warn(xhci, "Timeout while waiting for evaluate context command\n");
                 ret = -ETIME;
                 break;
@@ -3432,7 +3433,7 @@ static int xhci_discover_or_reset_device(struct usb_hcd *hcd,
         ret = reset_device_cmd->status;
         switch (ret) {
         case COMP_COMMAND_ABORTED:
-        case COMP_STOPPED:
+        case COMP_COMMAND_RING_STOPPED:
                 xhci_warn(xhci, "Timeout waiting for reset device command\n");
                 ret = -ETIME;
                 goto command_cleanup;
@@ -3817,7 +3818,7 @@ static int xhci_setup_device(struct usb_hcd *hcd, struct usb_device *udev,
          */
         switch (command->status) {
         case COMP_COMMAND_ABORTED:
-        case COMP_STOPPED:
+        case COMP_COMMAND_RING_STOPPED:
                 xhci_warn(xhci, "Timeout while waiting for setup device command\n");
                 ret = -ETIME;
                 break;
diff --git a/drivers/usb/misc/chaoskey.c b/drivers/usb/misc/chaoskey.c
index e9cae4d82af2..15d4e64d3b65 100644
--- a/drivers/usb/misc/chaoskey.c
+++ b/drivers/usb/misc/chaoskey.c
@@ -192,7 +192,7 @@ static int chaoskey_probe(struct usb_interface *interface,
 
         dev->in_ep = in_ep;
 
-        if (udev->descriptor.idVendor != ALEA_VENDOR_ID)
+        if (le16_to_cpu(udev->descriptor.idVendor) != ALEA_VENDOR_ID)
                 dev->reads_started = 1;
 
         dev->size = size;
diff --git a/drivers/usb/misc/iowarrior.c b/drivers/usb/misc/iowarrior.c
index 77569531b78a..83b05a287b0c 100644
--- a/drivers/usb/misc/iowarrior.c
+++ b/drivers/usb/misc/iowarrior.c
@@ -554,7 +554,7 @@ static long iowarrior_ioctl(struct file *file, unsigned int cmd,
                         info.revision = le16_to_cpu(dev->udev->descriptor.bcdDevice);
 
                         /* 0==UNKNOWN, 1==LOW(usb1.1) ,2=FULL(usb1.1), 3=HIGH(usb2.0) */
-                        info.speed = le16_to_cpu(dev->udev->speed);
+                        info.speed = dev->udev->speed;
                         info.if_num = dev->interface->cur_altsetting->desc.bInterfaceNumber;
                         info.report_size = dev->report_size;
 
diff --git a/drivers/usb/misc/legousbtower.c b/drivers/usb/misc/legousbtower.c
index aa3c280fdf8d..0782ac6f5edf 100644
--- a/drivers/usb/misc/legousbtower.c
+++ b/drivers/usb/misc/legousbtower.c
@@ -926,6 +926,7 @@ static int tower_probe (struct usb_interface *interface, const struct usb_device
                  USB_MAJOR, dev->minor);
 
 exit:
+        kfree(get_version_reply);
         return retval;
 
 error:
diff --git a/drivers/usb/misc/sisusbvga/sisusb_con.c b/drivers/usb/misc/sisusbvga/sisusb_con.c
index 3c6948af726a..f019d80ca9e4 100644
--- a/drivers/usb/misc/sisusbvga/sisusb_con.c
+++ b/drivers/usb/misc/sisusbvga/sisusb_con.c
@@ -973,7 +973,7 @@ sisusbcon_set_origin(struct vc_data *c)
 
         mutex_unlock(&sisusb->lock);
 
-        return 1;
+        return true;
 }
 
 /* Interface routine */
diff --git a/drivers/usb/musb/musb_host.c b/drivers/usb/musb/musb_host.c
index ac3a4952abb4..dbe617a735d8 100644
--- a/drivers/usb/musb/musb_host.c
+++ b/drivers/usb/musb/musb_host.c
@@ -2780,10 +2780,11 @@ int musb_host_setup(struct musb *musb, int power_budget)
         int ret;
         struct usb_hcd *hcd = musb->hcd;
 
-        MUSB_HST_MODE(musb);
-        musb->xceiv->otg->default_a = 1;
-        musb->xceiv->otg->state = OTG_STATE_A_IDLE;
-
+        if (musb->port_mode == MUSB_PORT_MODE_HOST) {
+                MUSB_HST_MODE(musb);
+                musb->xceiv->otg->default_a = 1;
+                musb->xceiv->otg->state = OTG_STATE_A_IDLE;
+        }
         otg_set_host(musb->xceiv->otg, &hcd->self);
         hcd->self.otg_port = 1;
         musb->xceiv->otg->host = &hcd->self;
diff --git a/drivers/usb/musb/tusb6010_omap.c b/drivers/usb/musb/tusb6010_omap.c
index 8b43c4b99f04..7870b37e0ea5 100644
--- a/drivers/usb/musb/tusb6010_omap.c
+++ b/drivers/usb/musb/tusb6010_omap.c
@@ -219,6 +219,7 @@ static int tusb_omap_dma_program(struct dma_channel *channel, u16 packet_sz,
         u32                             dma_remaining;
         int                             src_burst, dst_burst;
         u16                             csr;
+        u32                             psize;
         int                             ch;
         s8                              dmareq;
         s8                              sync_dev;
@@ -390,15 +391,19 @@ static int tusb_omap_dma_program(struct dma_channel *channel, u16 packet_sz,
 
         if (chdat->tx) {
                 /* Send transfer_packet_sz packets at a time */
-                musb_writel(ep_conf, TUSB_EP_MAX_PACKET_SIZE_OFFSET,
-                        chdat->transfer_packet_sz);
+                psize = musb_readl(ep_conf, TUSB_EP_MAX_PACKET_SIZE_OFFSET);
+                psize &= ~0x7ff;
+                psize |= chdat->transfer_packet_sz;
+                musb_writel(ep_conf, TUSB_EP_MAX_PACKET_SIZE_OFFSET, psize);
 
                 musb_writel(ep_conf, TUSB_EP_TX_OFFSET,
                         TUSB_EP_CONFIG_XFR_SIZE(chdat->transfer_len));
         } else {
                 /* Receive transfer_packet_sz packets at a time */
-                musb_writel(ep_conf, TUSB_EP_MAX_PACKET_SIZE_OFFSET,
-                        chdat->transfer_packet_sz << 16);
+                psize = musb_readl(ep_conf, TUSB_EP_MAX_PACKET_SIZE_OFFSET);
+                psize &= ~(0x7ff << 16);
+                psize |= (chdat->transfer_packet_sz << 16);
+                musb_writel(ep_conf, TUSB_EP_MAX_PACKET_SIZE_OFFSET, psize);
 
                 musb_writel(ep_conf, TUSB_EP_RX_OFFSET,
                         TUSB_EP_CONFIG_XFR_SIZE(chdat->transfer_len));
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index d38780fa8788..aba74f817dc6 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -809,10 +809,10 @@ static const struct usb_device_id id_table_combined[] = {
         { USB_DEVICE(FTDI_VID, FTDI_PROPOX_ISPCABLEIII_PID) },
         { USB_DEVICE(FTDI_VID, CYBER_CORTEX_AV_PID),
                 .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
-        { USB_DEVICE(OLIMEX_VID, OLIMEX_ARM_USB_OCD_PID),
-                .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
-        { USB_DEVICE(OLIMEX_VID, OLIMEX_ARM_USB_OCD_H_PID),
-                .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
+        { USB_DEVICE_INTERFACE_NUMBER(OLIMEX_VID, OLIMEX_ARM_USB_OCD_PID, 1) },
+        { USB_DEVICE_INTERFACE_NUMBER(OLIMEX_VID, OLIMEX_ARM_USB_OCD_H_PID, 1) },
+        { USB_DEVICE_INTERFACE_NUMBER(OLIMEX_VID, OLIMEX_ARM_USB_TINY_PID, 1) },
+        { USB_DEVICE_INTERFACE_NUMBER(OLIMEX_VID, OLIMEX_ARM_USB_TINY_H_PID, 1) },
         { USB_DEVICE(FIC_VID, FIC_NEO1973_DEBUG_PID),
                 .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
         { USB_DEVICE(FTDI_VID, FTDI_OOCDLINK_PID),
@@ -1527,9 +1527,9 @@ static int set_serial_info(struct tty_struct *tty,
                                         (new_serial.flags & ASYNC_FLAGS));
         priv->custom_divisor = new_serial.custom_divisor;
 
+check_and_exit:
         write_latency_timer(port);
 
-check_and_exit:
         if ((old_priv.flags & ASYNC_SPD_MASK) !=
              (priv->flags & ASYNC_SPD_MASK)) {
                 if ((priv->flags & ASYNC_SPD_MASK) == ASYNC_SPD_HI)
diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
index 71fb9e59db71..4fcf1cecb6d7 100644
--- a/drivers/usb/serial/ftdi_sio_ids.h
+++ b/drivers/usb/serial/ftdi_sio_ids.h
@@ -882,6 +882,8 @@
 /* Olimex */
 #define OLIMEX_VID                      0x15BA
 #define OLIMEX_ARM_USB_OCD_PID          0x0003
+#define OLIMEX_ARM_USB_TINY_PID 0x0004
+#define OLIMEX_ARM_USB_TINY_H_PID       0x002a
 #define OLIMEX_ARM_USB_OCD_H_PID        0x002b
 
 /*
diff --git a/drivers/usb/serial/io_ti.c b/drivers/usb/serial/io_ti.c
index 87798e625d6c..6cefb9cb133d 100644
--- a/drivers/usb/serial/io_ti.c
+++ b/drivers/usb/serial/io_ti.c
@@ -2336,8 +2336,11 @@ static void change_port_settings(struct tty_struct *tty,
         if (!baud) {
                 /* pick a default, any default... */
                 baud = 9600;
-        } else
+        } else {
+                /* Avoid a zero divisor. */
+                baud = min(baud, 461550);
                 tty_encode_baud_rate(tty, baud, baud);
+        }
 
         edge_port->baud_rate = baud;
         config->wBaudRate = (__u16)((461550L + baud/2) / baud);
diff --git a/drivers/usb/serial/ir-usb.c b/drivers/usb/serial/ir-usb.c
index 73956d48a0c5..f9734a96d516 100644
--- a/drivers/usb/serial/ir-usb.c
+++ b/drivers/usb/serial/ir-usb.c
@@ -197,6 +197,7 @@ static u8 ir_xbof_change(u8 xbof)
 static int ir_startup(struct usb_serial *serial)
 {
         struct usb_irda_cs_descriptor *irda_desc;
+        int rates;
 
         irda_desc = irda_usb_find_class_desc(serial, 0);
         if (!irda_desc) {
@@ -205,18 +206,20 @@ static int ir_startup(struct usb_serial *serial)
                 return -ENODEV;
         }
 
+        rates = le16_to_cpu(irda_desc->wBaudRate);
+
         dev_dbg(&serial->dev->dev,
                 "%s - Baud rates supported:%s%s%s%s%s%s%s%s%s\n",
                 __func__,
-                (irda_desc->wBaudRate & USB_IRDA_BR_2400) ? " 2400" : "",
-                (irda_desc->wBaudRate & USB_IRDA_BR_9600) ? " 9600" : "",
-                (irda_desc->wBaudRate & USB_IRDA_BR_19200) ? " 19200" : "",
-                (irda_desc->wBaudRate & USB_IRDA_BR_38400) ? " 38400" : "",
-                (irda_desc->wBaudRate & USB_IRDA_BR_57600) ? " 57600" : "",
-                (irda_desc->wBaudRate & USB_IRDA_BR_115200) ? " 115200" : "",
-                (irda_desc->wBaudRate & USB_IRDA_BR_576000) ? " 576000" : "",
-                (irda_desc->wBaudRate & USB_IRDA_BR_1152000) ? " 1152000" : "",
-                (irda_desc->wBaudRate & USB_IRDA_BR_4000000) ? " 4000000" : "");
+                (rates & USB_IRDA_BR_2400) ? " 2400" : "",
+                (rates & USB_IRDA_BR_9600) ? " 9600" : "",
+                (rates & USB_IRDA_BR_19200) ? " 19200" : "",
+                (rates & USB_IRDA_BR_38400) ? " 38400" : "",
+                (rates & USB_IRDA_BR_57600) ? " 57600" : "",
+                (rates & USB_IRDA_BR_115200) ? " 115200" : "",
+                (rates & USB_IRDA_BR_576000) ? " 576000" : "",
+                (rates & USB_IRDA_BR_1152000) ? " 1152000" : "",
+                (rates & USB_IRDA_BR_4000000) ? " 4000000" : "");
 
         switch (irda_desc->bmAdditionalBOFs) {
         case USB_IRDA_AB_48:
diff --git a/drivers/usb/serial/mct_u232.c b/drivers/usb/serial/mct_u232.c
index edbc81f205c2..70f346f1aa86 100644
--- a/drivers/usb/serial/mct_u232.c
+++ b/drivers/usb/serial/mct_u232.c
@@ -189,7 +189,7 @@ static int mct_u232_set_baud_rate(struct tty_struct *tty,
                 return -ENOMEM;
 
         divisor = mct_u232_calculate_baud_rate(serial, value, &speed);
-        put_unaligned_le32(cpu_to_le32(divisor), buf);
+        put_unaligned_le32(divisor, buf);
         rc = usb_control_msg(serial->dev, usb_sndctrlpipe(serial->dev, 0),
                                 MCT_U232_SET_BAUD_RATE_REQUEST,
                                 MCT_U232_SET_REQUEST_TYPE,
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index af67a0de6b5d..3bf61acfc26b 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -281,6 +281,7 @@ static void option_instat_callback(struct urb *urb);
 #define TELIT_PRODUCT_LE922_USBCFG0             0x1042
 #define TELIT_PRODUCT_LE922_USBCFG3             0x1043
 #define TELIT_PRODUCT_LE922_USBCFG5             0x1045
+#define TELIT_PRODUCT_ME910                     0x1100
 #define TELIT_PRODUCT_LE920                     0x1200
 #define TELIT_PRODUCT_LE910                     0x1201
 #define TELIT_PRODUCT_LE910_USBCFG4             0x1206
@@ -640,6 +641,11 @@ static const struct option_blacklist_info simcom_sim7100e_blacklist = {
         .reserved = BIT(5) | BIT(6),
 };
 
+static const struct option_blacklist_info telit_me910_blacklist = {
+        .sendsetup = BIT(0),
+        .reserved = BIT(1) | BIT(3),
+};
+
 static const struct option_blacklist_info telit_le910_blacklist = {
         .sendsetup = BIT(0),
         .reserved = BIT(1) | BIT(2),
@@ -1235,6 +1241,8 @@ static const struct usb_device_id option_ids[] = {
                 .driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg3 },
         { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, TELIT_PRODUCT_LE922_USBCFG5, 0xff),
                 .driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg0 },
+        { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910),
+                .driver_info = (kernel_ulong_t)&telit_me910_blacklist },
         { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE910),
                 .driver_info = (kernel_ulong_t)&telit_le910_blacklist },
         { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE910_USBCFG4),
diff --git a/drivers/usb/serial/qcserial.c b/drivers/usb/serial/qcserial.c
index 38b3f0d8cd58..fd509ed6cf70 100644
--- a/drivers/usb/serial/qcserial.c
+++ b/drivers/usb/serial/qcserial.c
@@ -162,6 +162,8 @@ static const struct usb_device_id id_table[] = {
         {DEVICE_SWI(0x1199, 0x9071)},   /* Sierra Wireless MC74xx */
         {DEVICE_SWI(0x1199, 0x9078)},   /* Sierra Wireless EM74xx */
         {DEVICE_SWI(0x1199, 0x9079)},   /* Sierra Wireless EM74xx */
+        {DEVICE_SWI(0x1199, 0x907a)},   /* Sierra Wireless EM74xx QDL */
+        {DEVICE_SWI(0x1199, 0x907b)},   /* Sierra Wireless EM74xx */
         {DEVICE_SWI(0x413c, 0x81a2)},   /* Dell Wireless 5806 Gobi(TM) 4G LTE Mobile Broadband Card */
         {DEVICE_SWI(0x413c, 0x81a3)},   /* Dell Wireless 5570 HSPA+ (42Mbps) Mobile Broadband Card */
         {DEVICE_SWI(0x413c, 0x81a4)},   /* Dell Wireless 5570e HSPA+ (42Mbps) Mobile Broadband Card */
diff --git a/drivers/usb/storage/ene_ub6250.c b/drivers/usb/storage/ene_ub6250.c
index 369f3c24815a..44af719194b2 100644
--- a/drivers/usb/storage/ene_ub6250.c
+++ b/drivers/usb/storage/ene_ub6250.c
@@ -446,6 +446,10 @@ struct ms_lib_ctrl {
 #define SD_BLOCK_LEN  9
 
 struct ene_ub6250_info {
+
+        /* I/O bounce buffer */
+        u8              *bbuf;
+
         /* for 6250 code */
         struct SD_STATUS        SD_Status;
         struct MS_STATUS        MS_Status;
@@ -493,8 +497,11 @@ static int ene_load_bincode(struct us_data *us, unsigned char flag);
 
 static void ene_ub6250_info_destructor(void *extra)
 {
+        struct ene_ub6250_info *info = (struct ene_ub6250_info *) extra;
+
         if (!extra)
                 return;
+        kfree(info->bbuf);
 }
 
 static int ene_send_scsi_cmd(struct us_data *us, u8 fDir, void *buf, int use_sg)
@@ -860,8 +867,9 @@ static int ms_read_readpage(struct us_data *us, u32 PhyBlockAddr,
                 u8 PageNum, u32 *PageBuf, struct ms_lib_type_extdat *ExtraDat)
 {
         struct bulk_cb_wrap *bcb = (struct bulk_cb_wrap *) us->iobuf;
+        struct ene_ub6250_info *info = (struct ene_ub6250_info *) us->extra;
+        u8 *bbuf = info->bbuf;
         int result;
-        u8 ExtBuf[4];
         u32 bn = PhyBlockAddr * 0x20 + PageNum;
 
         result = ene_load_bincode(us, MS_RW_PATTERN);
@@ -901,7 +909,7 @@ static int ms_read_readpage(struct us_data *us, u32 PhyBlockAddr,
         bcb->CDB[2]     = (unsigned char)(PhyBlockAddr>>16);
         bcb->CDB[6]     = 0x01;
 
-        result = ene_send_scsi_cmd(us, FDIR_READ, &ExtBuf, 0);
+        result = ene_send_scsi_cmd(us, FDIR_READ, bbuf, 0);
         if (result != USB_STOR_XFER_GOOD)
                 return USB_STOR_TRANSPORT_ERROR;
 
@@ -910,9 +918,9 @@ static int ms_read_readpage(struct us_data *us, u32 PhyBlockAddr,
         ExtraDat->status0  = 0x10;  /* Not yet,fireware support */
 
         ExtraDat->status1  = 0x00;  /* Not yet,fireware support */
-        ExtraDat->ovrflg   = ExtBuf[0];
-        ExtraDat->mngflg   = ExtBuf[1];
-        ExtraDat->logadr   = memstick_logaddr(ExtBuf[2], ExtBuf[3]);
+        ExtraDat->ovrflg   = bbuf[0];
+        ExtraDat->mngflg   = bbuf[1];
+        ExtraDat->logadr   = memstick_logaddr(bbuf[2], bbuf[3]);
 
         return USB_STOR_TRANSPORT_GOOD;
 }
@@ -1332,8 +1340,9 @@ static int ms_lib_read_extra(struct us_data *us, u32 PhyBlock,
                                 u8 PageNum, struct ms_lib_type_extdat *ExtraDat)
 {
         struct bulk_cb_wrap *bcb = (struct bulk_cb_wrap *) us->iobuf;
+        struct ene_ub6250_info *info = (struct ene_ub6250_info *) us->extra;
+        u8 *bbuf = info->bbuf;
         int result;
-        u8 ExtBuf[4];
 
         memset(bcb, 0, sizeof(struct bulk_cb_wrap));
         bcb->Signature = cpu_to_le32(US_BULK_CB_SIGN);
@@ -1347,7 +1356,7 @@ static int ms_lib_read_extra(struct us_data *us, u32 PhyBlock,
         bcb->CDB[2]     = (unsigned char)(PhyBlock>>16);
         bcb->CDB[6]     = 0x01;
 
-        result = ene_send_scsi_cmd(us, FDIR_READ, &ExtBuf, 0);
+        result = ene_send_scsi_cmd(us, FDIR_READ, bbuf, 0);
         if (result != USB_STOR_XFER_GOOD)
                 return USB_STOR_TRANSPORT_ERROR;
 
@@ -1355,9 +1364,9 @@ static int ms_lib_read_extra(struct us_data *us, u32 PhyBlock,
         ExtraDat->intr     = 0x80;  /* Not yet, waiting for fireware support */
         ExtraDat->status0  = 0x10;  /* Not yet, waiting for fireware support */
         ExtraDat->status1  = 0x00;  /* Not yet, waiting for fireware support */
-        ExtraDat->ovrflg   = ExtBuf[0];
-        ExtraDat->mngflg   = ExtBuf[1];
-        ExtraDat->logadr   = memstick_logaddr(ExtBuf[2], ExtBuf[3]);
+        ExtraDat->ovrflg   = bbuf[0];
+        ExtraDat->mngflg   = bbuf[1];
+        ExtraDat->logadr   = memstick_logaddr(bbuf[2], bbuf[3]);
 
         return USB_STOR_TRANSPORT_GOOD;
 }
@@ -1556,9 +1565,9 @@ static int ms_lib_scan_logicalblocknumber(struct us_data *us, u16 btBlk1st)
         u16 PhyBlock, newblk, i;
         u16 LogStart, LogEnde;
         struct ms_lib_type_extdat extdat;
-        u8 buf[0x200];
         u32 count = 0, index = 0;
         struct ene_ub6250_info *info = (struct ene_ub6250_info *) us->extra;
+        u8 *bbuf = info->bbuf;
 
         for (PhyBlock = 0; PhyBlock < info->MS_Lib.NumberOfPhyBlock;) {
                 ms_lib_phy_to_log_range(PhyBlock, &LogStart, &LogEnde);
@@ -1572,14 +1581,16 @@ static int ms_lib_scan_logicalblocknumber(struct us_data *us, u16 btBlk1st)
                         }
 
                         if (count == PhyBlock) {
-                                ms_lib_read_extrablock(us, PhyBlock, 0, 0x80, &buf);
+                                ms_lib_read_extrablock(us, PhyBlock, 0, 0x80,
+                                                bbuf);
                                 count += 0x80;
                         }
                         index = (PhyBlock % 0x80) * 4;
 
-                        extdat.ovrflg = buf[index];
-                        extdat.mngflg = buf[index+1];
-                        extdat.logadr = memstick_logaddr(buf[index+2], buf[index+3]);
+                        extdat.ovrflg = bbuf[index];
+                        extdat.mngflg = bbuf[index+1];
+                        extdat.logadr = memstick_logaddr(bbuf[index+2],
+                                        bbuf[index+3]);
 
                         if ((extdat.ovrflg & MS_REG_OVR_BKST) != MS_REG_OVR_BKST_OK) {
                                 ms_lib_setacquired_errorblock(us, PhyBlock);
@@ -2062,9 +2073,9 @@ static int ene_ms_init(struct us_data *us)
 {
         struct bulk_cb_wrap *bcb = (struct bulk_cb_wrap *) us->iobuf;
         int result;
-        u8 buf[0x200];
         u16 MSP_BlockSize, MSP_UserAreaBlocks;
         struct ene_ub6250_info *info = (struct ene_ub6250_info *) us->extra;
+        u8 *bbuf = info->bbuf;
 
         printk(KERN_INFO "transport --- ENE_MSInit\n");
 
@@ -2083,13 +2094,13 @@ static int ene_ms_init(struct us_data *us)
         bcb->CDB[0]     = 0xF1;
         bcb->CDB[1]     = 0x01;
 
-        result = ene_send_scsi_cmd(us, FDIR_READ, &buf, 0);
+        result = ene_send_scsi_cmd(us, FDIR_READ, bbuf, 0);
         if (result != USB_STOR_XFER_GOOD) {
                 printk(KERN_ERR "Execution MS Init Code Fail !!\n");
                 return USB_STOR_TRANSPORT_ERROR;
         }
         /* the same part to test ENE */
-        info->MS_Status = *(struct MS_STATUS *)&buf[0];
+        info->MS_Status = *(struct MS_STATUS *) bbuf;
 
         if (info->MS_Status.Insert && info->MS_Status.Ready) {
                 printk(KERN_INFO "Insert     = %x\n", info->MS_Status.Insert);
@@ -2098,15 +2109,15 @@ static int ene_ms_init(struct us_data *us)
                 printk(KERN_INFO "IsMSPHG    = %x\n", info->MS_Status.IsMSPHG);
                 printk(KERN_INFO "WtP= %x\n", info->MS_Status.WtP);
                 if (info->MS_Status.IsMSPro) {
-                        MSP_BlockSize      = (buf[6] << 8) | buf[7];
-                        MSP_UserAreaBlocks = (buf[10] << 8) | buf[11];
+                        MSP_BlockSize      = (bbuf[6] << 8) | bbuf[7];
+                        MSP_UserAreaBlocks = (bbuf[10] << 8) | bbuf[11];
                         info->MSP_TotalBlock = MSP_BlockSize * MSP_UserAreaBlocks;
                 } else {
                         ms_card_init(us); /* Card is MS (to ms.c)*/
                 }
                 usb_stor_dbg(us, "MS Init Code OK !!\n");
         } else {
-                usb_stor_dbg(us, "MS Card Not Ready --- %x\n", buf[0]);
+                usb_stor_dbg(us, "MS Card Not Ready --- %x\n", bbuf[0]);
                 return USB_STOR_TRANSPORT_ERROR;
         }
 
@@ -2116,9 +2127,9 @@ static int ene_ms_init(struct us_data *us)
 static int ene_sd_init(struct us_data *us)
 {
         int result;
-        u8  buf[0x200];
         struct bulk_cb_wrap *bcb = (struct bulk_cb_wrap *) us->iobuf;
         struct ene_ub6250_info *info = (struct ene_ub6250_info *) us->extra;
+        u8 *bbuf = info->bbuf;
 
         usb_stor_dbg(us, "transport --- ENE_SDInit\n");
         /* SD Init Part-1 */
@@ -2152,17 +2163,17 @@ static int ene_sd_init(struct us_data *us)
         bcb->Flags              = US_BULK_FLAG_IN;
         bcb->CDB[0]             = 0xF1;
 
-        result = ene_send_scsi_cmd(us, FDIR_READ, &buf, 0);
+        result = ene_send_scsi_cmd(us, FDIR_READ, bbuf, 0);
         if (result != USB_STOR_XFER_GOOD) {
                 usb_stor_dbg(us, "Execution SD Init Code Fail !!\n");
                 return USB_STOR_TRANSPORT_ERROR;
         }
 
-        info->SD_Status =  *(struct SD_STATUS *)&buf[0];
+        info->SD_Status =  *(struct SD_STATUS *) bbuf;
         if (info->SD_Status.Insert && info->SD_Status.Ready) {
                 struct SD_STATUS *s = &info->SD_Status;
 
-                ene_get_card_status(us, (unsigned char *)&buf);
+                ene_get_card_status(us, bbuf);
                 usb_stor_dbg(us, "Insert     = %x\n", s->Insert);
                 usb_stor_dbg(us, "Ready      = %x\n", s->Ready);
                 usb_stor_dbg(us, "IsMMC      = %x\n", s->IsMMC);
@@ -2170,7 +2181,7 @@ static int ene_sd_init(struct us_data *us)
                 usb_stor_dbg(us, "HiSpeed    = %x\n", s->HiSpeed);
                 usb_stor_dbg(us, "WtP        = %x\n", s->WtP);
         } else {
-                usb_stor_dbg(us, "SD Card Not Ready --- %x\n", buf[0]);
+                usb_stor_dbg(us, "SD Card Not Ready --- %x\n", bbuf[0]);
                 return USB_STOR_TRANSPORT_ERROR;
         }
         return USB_STOR_TRANSPORT_GOOD;
@@ -2180,13 +2191,15 @@ static int ene_sd_init(struct us_data *us)
 static int ene_init(struct us_data *us)
 {
         int result;
-        u8  misc_reg03 = 0;
+        u8  misc_reg03;
         struct ene_ub6250_info *info = (struct ene_ub6250_info *)(us->extra);
+        u8 *bbuf = info->bbuf;
 
-        result = ene_get_card_type(us, REG_CARD_STATUS, &misc_reg03);
+        result = ene_get_card_type(us, REG_CARD_STATUS, bbuf);
         if (result != USB_STOR_XFER_GOOD)
                 return USB_STOR_TRANSPORT_ERROR;
 
+        misc_reg03 = bbuf[0];
         if (misc_reg03 & 0x01) {
                 if (!info->SD_Status.Ready) {
                         result = ene_sd_init(us);
@@ -2303,8 +2316,9 @@ static int ene_ub6250_probe(struct usb_interface *intf,
                          const struct usb_device_id *id)
 {
         int result;
-        u8  misc_reg03 = 0;
+        u8  misc_reg03;
         struct us_data *us;
+        struct ene_ub6250_info *info;
 
         result = usb_stor_probe1(&us, intf, id,
                    (id - ene_ub6250_usb_ids) + ene_ub6250_unusual_dev_list,
@@ -2313,11 +2327,16 @@ static int ene_ub6250_probe(struct usb_interface *intf,
                 return result;
 
         /* FIXME: where should the code alloc extra buf ? */
-        if (!us->extra) {
-                us->extra = kzalloc(sizeof(struct ene_ub6250_info), GFP_KERNEL);
-                if (!us->extra)
-                        return -ENOMEM;
-                us->extra_destructor = ene_ub6250_info_destructor;
+        us->extra = kzalloc(sizeof(struct ene_ub6250_info), GFP_KERNEL);
+        if (!us->extra)
+                return -ENOMEM;
+        us->extra_destructor = ene_ub6250_info_destructor;
+
+        info = (struct ene_ub6250_info *)(us->extra);
+        info->bbuf = kmalloc(512, GFP_KERNEL);
+        if (!info->bbuf) {
+                kfree(us->extra);
+                return -ENOMEM;
         }
 
         us->transport_name = "ene_ub6250";
@@ -2329,12 +2348,13 @@ static int ene_ub6250_probe(struct usb_interface *intf,
                 return result;
 
         /* probe card type */
-        result = ene_get_card_type(us, REG_CARD_STATUS, &misc_reg03);
+        result = ene_get_card_type(us, REG_CARD_STATUS, info->bbuf);
         if (result != USB_STOR_XFER_GOOD) {
                 usb_stor_disconnect(intf);
                 return USB_STOR_TRANSPORT_ERROR;
         }
 
+        misc_reg03 = info->bbuf[0];
         if (!(misc_reg03 & 0x01)) {
                 pr_info("ums_eneub6250: This driver only supports SD/MS cards. "
                         "It does not support SM cards.\n");
diff --git a/drivers/usb/usbip/vhci_hcd.c b/drivers/usb/usbip/vhci_hcd.c
index 5d8b2c261940..0585078638db 100644
--- a/drivers/usb/usbip/vhci_hcd.c
+++ b/drivers/usb/usbip/vhci_hcd.c
@@ -235,14 +235,19 @@ done:
 
 static inline void hub_descriptor(struct usb_hub_descriptor *desc)
 {
+        int width;
+
         memset(desc, 0, sizeof(*desc));
         desc->bDescriptorType = USB_DT_HUB;
-        desc->bDescLength = 9;
         desc->wHubCharacteristics = cpu_to_le16(
                 HUB_CHAR_INDV_PORT_LPSM | HUB_CHAR_COMMON_OCPM);
+
         desc->bNbrPorts = VHCI_HC_PORTS;
-        desc->u.hs.DeviceRemovable[0] = 0xff;
-        desc->u.hs.DeviceRemovable[1] = 0xff;
+        BUILD_BUG_ON(VHCI_HC_PORTS > USB_MAXCHILDREN);
+        width = desc->bNbrPorts / 8 + 1;
+        desc->bDescLength = USB_DT_HUB_NONVAR_SIZE + 2 * width;
+        memset(&desc->u.hs.DeviceRemovable[0], 0, width);
+        memset(&desc->u.hs.DeviceRemovable[width], 0xff, width);
 }
 
 static int vhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
diff --git a/drivers/uwb/i1480/dfu/usb.c b/drivers/uwb/i1480/dfu/usb.c
index 6345e85822a4..a50cf45e530f 100644
--- a/drivers/uwb/i1480/dfu/usb.c
+++ b/drivers/uwb/i1480/dfu/usb.c
@@ -341,6 +341,7 @@ error_submit_ep1:
 static
 int i1480_usb_probe(struct usb_interface *iface, const struct usb_device_id *id)
 {
+        struct usb_device *udev = interface_to_usbdev(iface);
         struct i1480_usb *i1480_usb;
         struct i1480 *i1480;
         struct device *dev = &iface->dev;
@@ -352,8 +353,8 @@ int i1480_usb_probe(struct usb_interface *iface, const struct usb_device_id *id)
                         iface->cur_altsetting->desc.bInterfaceNumber);
                 goto error;
         }
-        if (iface->num_altsetting > 1
-            && interface_to_usbdev(iface)->descriptor.idProduct == 0xbabe) {
+        if (iface->num_altsetting > 1 &&
+                        le16_to_cpu(udev->descriptor.idProduct) == 0xbabe) {
                 /* Need altsetting #1 [HW QUIRK] or EP1 won't work */
                 result = usb_set_interface(interface_to_usbdev(iface), 0, 1);
                 if (result < 0)
diff --git a/include/linux/usb/hcd.h b/include/linux/usb/hcd.h
index a469999a106d..50398b69ca44 100644
--- a/include/linux/usb/hcd.h
+++ b/include/linux/usb/hcd.h
@@ -148,6 +148,7 @@ struct usb_hcd {
         unsigned                rh_registered:1;/* is root hub registered? */
         unsigned                rh_pollable:1;  /* may we poll the root hub? */
         unsigned                msix_enabled:1; /* driver has MSI-X enabled? */
+        unsigned                msi_enabled:1;  /* driver has MSI enabled? */
         unsigned                remove_phy:1;   /* auto-remove USB phy */
 
         /* The next flag is a stopgap, to be removed when all the HCDs
diff --git a/include/uapi/linux/usb/ch11.h b/include/uapi/linux/usb/ch11.h
index 361297e96f58..576c704e3fb8 100644
--- a/include/uapi/linux/usb/ch11.h
+++ b/include/uapi/linux/usb/ch11.h
@@ -22,6 +22,9 @@
  */
 #define USB_MAXCHILDREN         31
 
+/* See USB 3.1 spec Table 10-5 */
+#define USB_SS_MAXPORTS         15
+
 /*
  * Hub request types
  */