3 files changed, 11 insertions, 11 deletions

diff --git a/drivers/usb/host/uhci-hcd.c b/drivers/usb/host/uhci-hcd.c
index 071fab6b647..120ca64fe3f 100644
--- a/drivers/usb/host/uhci-hcd.c
+++ b/drivers/usb/host/uhci-hcd.c
@@ -566,7 +566,7 @@ static int uhci_start(struct usb_hcd *hcd)
         uhci->skel_bulk_qh->link = cpu_to_le32(uhci->skel_term_qh->dma_handle) | UHCI_PTR_QH;
 
         /* This dummy TD is to work around a bug in Intel PIIX controllers */
-        uhci_fill_td(uhci->term_td, 0, (UHCI_NULL_DATA_SIZE << 21) |
+        uhci_fill_td(uhci->term_td, 0, uhci_explen(0) |
                 (0x7f << TD_TOKEN_DEVADDR_SHIFT) | USB_PID_IN, 0);
         uhci->term_td->link = cpu_to_le32(uhci->term_td->dma_handle);
 
diff --git a/drivers/usb/host/uhci-hcd.h b/drivers/usb/host/uhci-hcd.h
index e576db57a92..e43282e4e80 100644
--- a/drivers/usb/host/uhci-hcd.h
+++ b/drivers/usb/host/uhci-hcd.h
@@ -71,8 +71,6 @@
 #define   USBLEGSUP_RWC         0x8f00  /* the R/WC bits */
 #define   USBLEGSUP_RO          0x5040  /* R/O and reserved bits */
 
-#define UHCI_NULL_DATA_SIZE     0x7FF   /* for UHCI controller TD */
-
 #define UHCI_PTR_BITS           cpu_to_le32(0x000F)
 #define UHCI_PTR_TERM           cpu_to_le32(0x0001)
 #define UHCI_PTR_QH             cpu_to_le32(0x0002)
@@ -168,9 +166,11 @@ static __le32 inline qh_element(struct uhci_qh *qh) {
 #define TD_TOKEN_EXPLEN_MASK    0x7FF           /* expected length, encoded as n - 1 */
 #define TD_TOKEN_PID_MASK       0xFF
 
-#define uhci_explen(len)        ((len) << TD_TOKEN_EXPLEN_SHIFT)
+#define uhci_explen(len)        ((((len) - 1) & TD_TOKEN_EXPLEN_MASK) << \
+                                        TD_TOKEN_EXPLEN_SHIFT)
 
-#define uhci_expected_length(token) ((((token) >> 21) + 1) & TD_TOKEN_EXPLEN_MASK)
+#define uhci_expected_length(token) ((((token) >> TD_TOKEN_EXPLEN_SHIFT) + \
+                                        1) & TD_TOKEN_EXPLEN_MASK)
 #define uhci_toggle(token)      (((token) >> TD_TOKEN_TOGGLE_SHIFT) & 1)
 #define uhci_endpoint(token)    (((token) >> 15) & 0xf)
 #define uhci_devaddr(token)     (((token) >> TD_TOKEN_DEVADDR_SHIFT) & 0x7f)
diff --git a/drivers/usb/host/uhci-q.c b/drivers/usb/host/uhci-q.c
index 7e46887d9e1..ace9d15f85d 100644
--- a/drivers/usb/host/uhci-q.c
+++ b/drivers/usb/host/uhci-q.c
@@ -596,7 +596,7 @@ static int uhci_submit_control(struct uhci_hcd *uhci, struct urb *urb, struct ur
                 return -ENOMEM;
 
         uhci_add_td_to_urb(urb, td);
-        uhci_fill_td(td, status, destination | uhci_explen(7),
+        uhci_fill_td(td, status, destination | uhci_explen(8),
                 urb->setup_dma);
 
         /*
@@ -628,7 +628,7 @@ static int uhci_submit_control(struct uhci_hcd *uhci, struct urb *urb, struct ur
                 destination ^= TD_TOKEN_TOGGLE;
         
                 uhci_add_td_to_urb(urb, td);
-                uhci_fill_td(td, status, destination | uhci_explen(pktsze - 1),
+                uhci_fill_td(td, status, destination | uhci_explen(pktsze),
                         data);
 
                 data += pktsze;
@@ -658,7 +658,7 @@ static int uhci_submit_control(struct uhci_hcd *uhci, struct urb *urb, struct ur
 
         uhci_add_td_to_urb(urb, td);
         uhci_fill_td(td, status | TD_CTRL_IOC,
-                destination | uhci_explen(UHCI_NULL_DATA_SIZE), 0);
+                destination | uhci_explen(0), 0);
 
         qh = uhci_alloc_qh(uhci);
         if (!qh)
@@ -864,7 +864,7 @@ static int uhci_submit_common(struct uhci_hcd *uhci, struct urb *urb, struct urb
                         return -ENOMEM;
 
                 uhci_add_td_to_urb(urb, td);
-                uhci_fill_td(td, status, destination | uhci_explen(pktsze - 1) |
+                uhci_fill_td(td, status, destination | uhci_explen(pktsze) |
                         (usb_gettoggle(urb->dev, usb_pipeendpoint(urb->pipe),
                          usb_pipeout(urb->pipe)) << TD_TOKEN_TOGGLE_SHIFT),
                         data);
@@ -890,7 +890,7 @@ static int uhci_submit_common(struct uhci_hcd *uhci, struct urb *urb, struct urb
                         return -ENOMEM;
 
                 uhci_add_td_to_urb(urb, td);
-                uhci_fill_td(td, status, destination | uhci_explen(UHCI_NULL_DATA_SIZE) |
+                uhci_fill_td(td, status, destination | uhci_explen(0) |
                         (usb_gettoggle(urb->dev, usb_pipeendpoint(urb->pipe),
                          usb_pipeout(urb->pipe)) << TD_TOKEN_TOGGLE_SHIFT),
                         data);
@@ -1092,7 +1092,7 @@ static int uhci_submit_isochronous(struct uhci_hcd *uhci, struct urb *urb)
                         return -ENOMEM;
 
                 uhci_add_td_to_urb(urb, td);
-                uhci_fill_td(td, status, destination | uhci_explen(urb->iso_frame_desc[i].length - 1),
+                uhci_fill_td(td, status, destination | uhci_explen(urb->iso_frame_desc[i].length),
                         urb->transfer_dma + urb->iso_frame_desc[i].offset);
 
                 if (i + 1 >= urb->number_of_packets)