29 files changed, 1325 insertions, 1063 deletions
diff --git a/drivers/usb/host/Kconfig b/drivers/usb/host/Kconfig
index 2f529828c74..c978d622fa8 100644
--- a/drivers/usb/host/Kconfig
+++ b/drivers/usb/host/Kconfig
@@ -154,6 +154,19 @@ config USB_OHCI_HCD_PCI
          Enables support for PCI-bus plug-in USB controller cards.
          If unsure, say Y.
+config USB_OHCI_HCD_SSB
+        bool "OHCI support for Broadcom SSB OHCI core"
+        depends on USB_OHCI_HCD && SSB && EXPERIMENTAL
+        default n
+        ---help---
+          Support for the Sonics Silicon Backplane (SSB) attached
+          Broadcom USB OHCI core.
+          This device is present in some embedded devices with
+          Broadcom based SSB bus.
+          If unsure, say N.
 config USB_OHCI_BIG_ENDIAN_DESC
        bool
        depends on USB_OHCI_HCD
@@ -237,7 +250,7 @@ config USB_SL811_CS
          module will be called "sl811_cs".
 config USB_R8A66597_HCD
-        tristate "R8A66597 HCD suppoort"
+        tristate "R8A66597 HCD support"
        depends on USB
        help
          The R8A66597 is a USB 2.0 host and peripheral controller.
diff --git a/drivers/usb/host/ehci-au1xxx.c b/drivers/usb/host/ehci-au1xxx.c
index 5d1b12aad77..766ef68a0b4 100644
--- a/drivers/usb/host/ehci-au1xxx.c
+++ b/drivers/usb/host/ehci-au1xxx.c
@@ -1,8 +1,6 @@
 /*
 * EHCI HCD (Host Controller Driver) for USB.
 *
- * (C) Copyright 2000-2004 David Brownell <dbrownell@users.sourceforge.net>
- *
 * Bus Glue for AMD Alchemy Au1xxx
 *
 * Based on "ohci-au1xxx.c" by Matt Porter <mporter@kernel.crashing.org>
@@ -196,6 +194,9 @@ static const struct hc_driver ehci_au1xxx_hc_driver = {
        /*
         * basic lifecycle operations
+         *
+         * FIXME -- ehci_init() doesn't do enough here.
+         * See ehci-ppc-soc for a complete implementation.
         */
        .reset = ehci_init,
        .start = ehci_run,
@@ -219,10 +220,8 @@ static const struct hc_driver ehci_au1xxx_hc_driver = {
         */
        .hub_status_data = ehci_hub_status_data,
        .hub_control = ehci_hub_control,
-#ifdef  CONFIG_PM
+        .bus_suspend = ehci_bus_suspend,
-        .hub_suspend = ehci_hub_suspend,
+        .bus_resume = ehci_bus_resume,
-        .hub_resume = ehci_hub_resume,
-#endif
 };
 /*-------------------------------------------------------------------------*/
diff --git a/drivers/usb/host/ehci-hcd.c b/drivers/usb/host/ehci-hcd.c
index c4e15ed1405..c1514442883 100644
--- a/drivers/usb/host/ehci-hcd.c
+++ b/drivers/usb/host/ehci-hcd.c
@@ -275,58 +275,6 @@ static void ehci_work(struct ehci_hcd *ehci);
 /*-------------------------------------------------------------------------*/
-#ifdef CONFIG_CPU_FREQ
-#include <linux/cpufreq.h>
-static void ehci_cpufreq_pause (struct ehci_hcd *ehci)
-{
-        unsigned long   flags;
-        spin_lock_irqsave(&ehci->lock, flags);
-        if (!ehci->cpufreq_changing++)
-                qh_inactivate_split_intr_qhs(ehci);
-        spin_unlock_irqrestore(&ehci->lock, flags);
-}
-static void ehci_cpufreq_unpause (struct ehci_hcd *ehci)
-{
-        unsigned long   flags;
-        spin_lock_irqsave(&ehci->lock, flags);
-        if (!--ehci->cpufreq_changing)
-                qh_reactivate_split_intr_qhs(ehci);
-        spin_unlock_irqrestore(&ehci->lock, flags);
-}
-/*
- * ehci_cpufreq_notifier is needed to avoid MMF errors that occur when
- * EHCI controllers that don't cache many uframes get delayed trying to
- * read main memory during CPU frequency transitions.  This can cause
- * split interrupt transactions to not be completed in the required uframe.
- * This has been observed on the Broadcom/ServerWorks HT1000 controller.
- */
-static int ehci_cpufreq_notifier(struct notifier_block *nb, unsigned long val,
-                                 void *data)
-{
-        struct ehci_hcd *ehci = container_of(nb, struct ehci_hcd,
-                                             cpufreq_transition);
-        switch (val) {
-        case CPUFREQ_PRECHANGE:
-                ehci_cpufreq_pause(ehci);
-                break;
-        case CPUFREQ_POSTCHANGE:
-                ehci_cpufreq_unpause(ehci);
-                break;
-        }
-        return 0;
-}
-#endif
-/*-------------------------------------------------------------------------*/
 static void ehci_watchdog (unsigned long param)
 {
        struct ehci_hcd         *ehci = (struct ehci_hcd *) param;
@@ -460,10 +408,6 @@ static void ehci_stop (struct usb_hcd *hcd)
        ehci_writel(ehci, 0, &ehci->regs->intr_enable);
        spin_unlock_irq(&ehci->lock);
-#ifdef CONFIG_CPU_FREQ
-        cpufreq_unregister_notifier(&ehci->cpufreq_transition,
-                                    CPUFREQ_TRANSITION_NOTIFIER);
-#endif
        /* let companion controllers work when we aren't */
        ehci_writel(ehci, 0, &ehci->regs->configured_flag);
@@ -569,17 +513,6 @@ static int ehci_init(struct usb_hcd *hcd)
        }
        ehci->command = temp;
-#ifdef CONFIG_CPU_FREQ
-        INIT_LIST_HEAD(&ehci->split_intr_qhs);
-        /*
-         * If the EHCI controller caches enough uframes, this probably
-         * isn't needed unless there are so many low/full speed devices
-         * that the controller's can't cache it all.
-         */
-        ehci->cpufreq_transition.notifier_call = ehci_cpufreq_notifier;
-        cpufreq_register_notifier(&ehci->cpufreq_transition,
-                                  CPUFREQ_TRANSITION_NOTIFIER);
-#endif
        return 0;
 }
@@ -637,10 +570,18 @@ static int ehci_run (struct usb_hcd *hcd)
         * are explicitly handed to companion controller(s), so no TT is
         * involved with the root hub.  (Except where one is integrated,
         * and there's no companion controller unless maybe for USB OTG.)
+         *
+         * Turning on the CF flag will transfer ownership of all ports
+         * from the companions to the EHCI controller.  If any of the
+         * companions are in the middle of a port reset at the time, it
+         * could cause trouble.  Write-locking ehci_cf_port_reset_rwsem
+         * guarantees that no resets are in progress.
         */
+        down_write(&ehci_cf_port_reset_rwsem);
        hcd->state = HC_STATE_RUNNING;
        ehci_writel(ehci, FLAG_CF, &ehci->regs->configured_flag);
        ehci_readl(ehci, &ehci->regs->command); /* unblock posted writes */
+        up_write(&ehci_cf_port_reset_rwsem);
        temp = HC_VERSION(ehci_readl(ehci, &ehci->caps->hc_capbase));
        ehci_info (ehci,
@@ -786,7 +727,6 @@ dead:
 */
 static int ehci_urb_enqueue (
        struct usb_hcd  *hcd,
-        struct usb_host_endpoint *ep,
        struct urb      *urb,
        gfp_t           mem_flags
 ) {
@@ -801,12 +741,12 @@ static int ehci_urb_enqueue (
        default:
                if (!qh_urb_transaction (ehci, urb, &qtd_list, mem_flags))
                        return -ENOMEM;
-                return submit_async (ehci, ep, urb, &qtd_list, mem_flags);
+                return submit_async(ehci, urb, &qtd_list, mem_flags);
        case PIPE_INTERRUPT:
                if (!qh_urb_transaction (ehci, urb, &qtd_list, mem_flags))
                        return -ENOMEM;
-                return intr_submit (ehci, ep, urb, &qtd_list, mem_flags);
+                return intr_submit(ehci, urb, &qtd_list, mem_flags);
        case PIPE_ISOCHRONOUS:
                if (urb->dev->speed == USB_SPEED_HIGH)
@@ -844,13 +784,18 @@ static void unlink_async (struct ehci_hcd *ehci, struct ehci_qh *qh)
 * completions normally happen asynchronously
 */
-static int ehci_urb_dequeue (struct usb_hcd *hcd, struct urb *urb)
+static int ehci_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status)
 {
        struct ehci_hcd         *ehci = hcd_to_ehci (hcd);
        struct ehci_qh          *qh;
        unsigned long           flags;
+        int                     rc;
        spin_lock_irqsave (&ehci->lock, flags);
+        rc = usb_hcd_check_unlink_urb(hcd, urb, status);
+        if (rc)
+                goto done;
        switch (usb_pipetype (urb->pipe)) {
        // case PIPE_CONTROL:
        // case PIPE_BULK:
@@ -905,7 +850,7 @@ static int ehci_urb_dequeue (struct usb_hcd *hcd, struct urb *urb)
        }
 done:
        spin_unlock_irqrestore (&ehci->lock, flags);
-        return 0;
+        return rc;
 }
 /*-------------------------------------------------------------------------*/
diff --git a/drivers/usb/host/ehci-mem.c b/drivers/usb/host/ehci-mem.c
index 8816d09903d..0431397836f 100644
--- a/drivers/usb/host/ehci-mem.c
+++ b/drivers/usb/host/ehci-mem.c
@@ -94,9 +94,6 @@ static struct ehci_qh *ehci_qh_alloc (struct ehci_hcd *ehci, gfp_t flags)
        qh->qh_dma = dma;
        // INIT_LIST_HEAD (&qh->qh_list);
        INIT_LIST_HEAD (&qh->qtd_list);
-#ifdef CONFIG_CPU_FREQ
-        INIT_LIST_HEAD (&qh->split_intr_qhs);
-#endif
        /* dummy td enables safe urb queuing */
        qh->dummy = ehci_qtd_alloc (ehci, flags);
diff --git a/drivers/usb/host/ehci-pci.c b/drivers/usb/host/ehci-pci.c
index a7816e392a8..ad0d4965f2f 100644
--- a/drivers/usb/host/ehci-pci.c
+++ b/drivers/usb/host/ehci-pci.c
@@ -58,8 +58,6 @@ static int ehci_pci_reinit(struct ehci_hcd *ehci, struct pci_dev *pdev)
        if (!retval)
                ehci_dbg(ehci, "MWI active\n");
-        ehci_port_power(ehci, 0);
        return 0;
 }
@@ -156,8 +154,7 @@ static int ehci_pci_setup(struct usb_hcd *hcd)
                break;
        }
-        if (ehci_is_TDI(ehci))
+        ehci_reset(ehci);
-                ehci_reset(ehci);
        /* at least the Genesys GL880S needs fixup here */
        temp = HCS_N_CC(ehci->hcs_params) * HCS_N_PCC(ehci->hcs_params);
diff --git a/drivers/usb/host/ehci-ppc-soc.c b/drivers/usb/host/ehci-ppc-soc.c
index c2cedb09ed8..452d4b1bc85 100644
--- a/drivers/usb/host/ehci-ppc-soc.c
+++ b/drivers/usb/host/ehci-ppc-soc.c
@@ -6,7 +6,7 @@
 * Bus Glue for PPC On-Chip EHCI driver
 * Tested on AMCC 440EPx
 *
- * Based on "ehci-au12xx.c" by David Brownell <dbrownell@users.sourceforge.net>
+ * Based on "ehci-au1xxx.c" by K.Boge <karsten.boge@amd.com>
 *
 * This file is licenced under the GPL.
 */
@@ -15,6 +15,24 @@
 extern int usb_disabled(void);
+/* called during probe() after chip reset completes */
+static int ehci_ppc_soc_setup(struct usb_hcd *hcd)
+{
+        struct ehci_hcd *ehci = hcd_to_ehci(hcd);
+        int             retval;
+        retval = ehci_halt(ehci);
+        if (retval)
+                return retval;
+        retval = ehci_init(hcd);
+        if (retval)
+                return retval;
+        ehci->sbrn = 0x20;
+        return ehci_reset(ehci);
+}
 /**
 * usb_ehci_ppc_soc_probe - initialize PPC-SoC-based HCDs
 * Context: !in_interrupt()
@@ -120,7 +138,7 @@ static const struct hc_driver ehci_ppc_soc_hc_driver = {
        /*
         * basic lifecycle operations
         */
-        .reset = ehci_init,
+        .reset = ehci_ppc_soc_setup,
        .start = ehci_run,
        .stop = ehci_stop,
        .shutdown = ehci_shutdown,
@@ -142,10 +160,8 @@ static const struct hc_driver ehci_ppc_soc_hc_driver = {
         */
        .hub_status_data = ehci_hub_status_data,
        .hub_control = ehci_hub_control,
-#ifdef  CONFIG_PM
+        .bus_suspend = ehci_bus_suspend,
-        .hub_suspend = ehci_hub_suspend,
+        .bus_resume = ehci_bus_resume,
-        .hub_resume = ehci_hub_resume,
-#endif
 };
 static int ehci_hcd_ppc_soc_drv_probe(struct platform_device *pdev)
diff --git a/drivers/usb/host/ehci-ps3.c b/drivers/usb/host/ehci-ps3.c
index 829fe649a98..03a6b2f4e6e 100644
--- a/drivers/usb/host/ehci-ps3.c
+++ b/drivers/usb/host/ehci-ps3.c
@@ -47,7 +47,7 @@ static int ps3_ehci_hc_reset(struct usb_hcd *hcd)
        if (result)
                return result;
-        ehci_port_power(ehci, 0);
+        ehci_reset(ehci);
        return result;
 }
diff --git a/drivers/usb/host/ehci-q.c b/drivers/usb/host/ehci-q.c
index 2284028f8aa..b10f39c047e 100644
--- a/drivers/usb/host/ehci-q.c
+++ b/drivers/usb/host/ehci-q.c
@@ -139,63 +139,65 @@ qh_refresh (struct ehci_hcd *ehci, struct ehci_qh *qh)
 /*-------------------------------------------------------------------------*/
-static void qtd_copy_status (
+static int qtd_copy_status (
        struct ehci_hcd *ehci,
        struct urb *urb,
        size_t length,
        u32 token
 )
 {
+        int     status = -EINPROGRESS;
        /* count IN/OUT bytes, not SETUP (even short packets) */
        if (likely (QTD_PID (token) != 2))
                urb->actual_length += length - QTD_LENGTH (token);
        /* don't modify error codes */
-        if (unlikely (urb->status != -EINPROGRESS))
+        if (unlikely(urb->unlinked))
-                return;
+                return status;
        /* force cleanup after short read; not always an error */
        if (unlikely (IS_SHORT_READ (token)))
-                urb->status = -EREMOTEIO;
+                status = -EREMOTEIO;
        /* serious "can't proceed" faults reported by the hardware */
        if (token & QTD_STS_HALT) {
                if (token & QTD_STS_BABBLE) {
                        /* FIXME "must" disable babbling device's port too */
-                        urb->status = -EOVERFLOW;
+                        status = -EOVERFLOW;
                } else if (token & QTD_STS_MMF) {
                        /* fs/ls interrupt xfer missed the complete-split */
-                        urb->status = -EPROTO;
+                        status = -EPROTO;
                } else if (token & QTD_STS_DBE) {
-                        urb->status = (QTD_PID (token) == 1) /* IN ? */
+                        status = (QTD_PID (token) == 1) /* IN ? */
                                ? -ENOSR  /* hc couldn't read data */
                                : -ECOMM; /* hc couldn't write data */
                } else if (token & QTD_STS_XACT) {
                        /* timeout, bad crc, wrong PID, etc; retried */
                        if (QTD_CERR (token))
-                                urb->status = -EPIPE;
+                                status = -EPIPE;
                        else {
                                ehci_dbg (ehci, "devpath %s ep%d%s 3strikes\n",
                                        urb->dev->devpath,
                                        usb_pipeendpoint (urb->pipe),
                                        usb_pipein (urb->pipe) ? "in" : "out");
-                                urb->status = -EPROTO;
+                                status = -EPROTO;
                        }
                /* CERR nonzero + no errors + halt --> stall */
                } else if (QTD_CERR (token))
-                        urb->status = -EPIPE;
+                        status = -EPIPE;
                else    /* unknown */
-                        urb->status = -EPROTO;
+                        status = -EPROTO;
                ehci_vdbg (ehci,
                        "dev%d ep%d%s qtd token %08x --> status %d\n",
                        usb_pipedevice (urb->pipe),
                        usb_pipeendpoint (urb->pipe),
                        usb_pipein (urb->pipe) ? "in" : "out",
-                        token, urb->status);
+                        token, status);
                /* if async CSPLIT failed, try cleaning out the TT buffer */
-                if (urb->status != -EPIPE
+                if (status != -EPIPE
                                && urb->dev->tt && !usb_pipeint (urb->pipe)
                                && ((token & QTD_STS_MMF) != 0
                                        || QTD_CERR(token) == 0)
@@ -212,10 +214,12 @@ static void qtd_copy_status (
                        usb_hub_tt_clear_buffer (urb->dev, urb->pipe);
                }
        }
+        return status;
 }
 static void
-ehci_urb_done (struct ehci_hcd *ehci, struct urb *urb)
+ehci_urb_done(struct ehci_hcd *ehci, struct urb *urb, int status)
 __releases(ehci->lock)
 __acquires(ehci->lock)
 {
@@ -231,25 +235,13 @@ __acquires(ehci->lock)
                qh_put (qh);
        }
-        spin_lock (&urb->lock);
+        if (unlikely(urb->unlinked)) {
-        urb->hcpriv = NULL;
+                COUNT(ehci->stats.unlink);
-        switch (urb->status) {
+        } else {
-        case -EINPROGRESS:              /* success */
+                if (likely(status == -EINPROGRESS))
-                urb->status = 0;
+                        status = 0;
-        default:                        /* fault */
+                COUNT(ehci->stats.complete);
-                COUNT (ehci->stats.complete);
-                break;
-        case -EREMOTEIO:                /* fault or normal */
-                if (!(urb->transfer_flags & URB_SHORT_NOT_OK))
-                        urb->status = 0;
-                COUNT (ehci->stats.complete);
-                break;
-        case -ECONNRESET:               /* canceled */
-        case -ENOENT:
-                COUNT (ehci->stats.unlink);
-                break;
        }
-        spin_unlock (&urb->lock);
 #ifdef EHCI_URB_TRACE
        ehci_dbg (ehci,
@@ -257,13 +249,14 @@ __acquires(ehci->lock)
                __FUNCTION__, urb->dev->devpath, urb,
                usb_pipeendpoint (urb->pipe),
                usb_pipein (urb->pipe) ? "in" : "out",
-                urb->status,
+                status,
                urb->actual_length, urb->transfer_buffer_length);
 #endif
        /* complete() can reenter this HCD */
+        usb_hcd_unlink_urb_from_ep(ehci_to_hcd(ehci), urb);
        spin_unlock (&ehci->lock);
-        usb_hcd_giveback_urb (ehci_to_hcd(ehci), urb);
+        usb_hcd_giveback_urb(ehci_to_hcd(ehci), urb, status);
        spin_lock (&ehci->lock);
 }
@@ -283,6 +276,7 @@ qh_completions (struct ehci_hcd *ehci, struct ehci_qh *qh)
 {
        struct ehci_qtd         *last = NULL, *end = qh->dummy;
        struct list_head        *entry, *tmp;
+        int                     last_status = -EINPROGRESS;
        int                     stopped;
        unsigned                count = 0;
        int                     do_status = 0;
@@ -311,10 +305,7 @@ qh_completions (struct ehci_hcd *ehci, struct ehci_qh *qh)
                struct ehci_qtd *qtd;
                struct urb      *urb;
                u32             token = 0;
+                int             qtd_status;
-                /* ignore QHs that are currently inactive */
-                if (qh->hw_info1 & __constant_cpu_to_le32(QH_INACTIVATE))
-                        break;
                qtd = list_entry (entry, struct ehci_qtd, qtd_list);
                urb = qtd->urb;
@@ -322,11 +313,12 @@ qh_completions (struct ehci_hcd *ehci, struct ehci_qh *qh)
                /* clean up any state from previous QTD ...*/
                if (last) {
                        if (likely (last->urb != urb)) {
-                                ehci_urb_done (ehci, last->urb);
+                                ehci_urb_done(ehci, last->urb, last_status);
                                count++;
                        }
                        ehci_qtd_free (ehci, last);
                        last = NULL;
+                        last_status = -EINPROGRESS;
                }
                /* ignore urbs submitted during completions we reported */
@@ -362,13 +354,14 @@ qh_completions (struct ehci_hcd *ehci, struct ehci_qh *qh)
                        stopped = 1;
                        if (unlikely (!HC_IS_RUNNING (ehci_to_hcd(ehci)->state)))
-                                urb->status = -ESHUTDOWN;
+                                last_status = -ESHUTDOWN;
                        /* ignore active urbs unless some previous qtd
                         * for the urb faulted (including short read) or
                         * its urb was canceled.  we may patch qh or qtds.
                         */
-                        if (likely (urb->status == -EINPROGRESS))
+                        if (likely(last_status == -EINPROGRESS &&
+                                        !urb->unlinked))
                                continue;
                        /* issue status after short control reads */
@@ -396,11 +389,14 @@ halt:
                }
                /* remove it from the queue */
-                spin_lock (&urb->lock);
+                qtd_status = qtd_copy_status(ehci, urb, qtd->length, token);
-                qtd_copy_status (ehci, urb, qtd->length, token);
+                if (unlikely(qtd_status == -EREMOTEIO)) {
-                do_status = (urb->status == -EREMOTEIO)
+                        do_status = (!urb->unlinked &&
-                                && usb_pipecontrol (urb->pipe);
+                                        usb_pipecontrol(urb->pipe));
-                spin_unlock (&urb->lock);
+                        qtd_status = 0;
+                }
+                if (likely(last_status == -EINPROGRESS))
+                        last_status = qtd_status;
                if (stopped && qtd->qtd_list.prev != &qh->qtd_list) {
                        last = list_entry (qtd->qtd_list.prev,
@@ -413,7 +409,7 @@ halt:
        /* last urb's completion might still need calling */
        if (likely (last != NULL)) {
-                ehci_urb_done (ehci, last->urb);
+                ehci_urb_done(ehci, last->urb, last_status);
                count++;
                ehci_qtd_free (ehci, last);
        }
@@ -917,7 +913,6 @@ static struct ehci_qh *qh_append_tds (
 static int
 submit_async (
        struct ehci_hcd         *ehci,
-        struct usb_host_endpoint *ep,
        struct urb              *urb,
        struct list_head        *qtd_list,
        gfp_t                   mem_flags
@@ -926,10 +921,10 @@ submit_async (
        int                     epnum;
        unsigned long           flags;
        struct ehci_qh          *qh = NULL;
-        int                     rc = 0;
+        int                     rc;
        qtd = list_entry (qtd_list->next, struct ehci_qtd, qtd_list);
-        epnum = ep->desc.bEndpointAddress;
+        epnum = urb->ep->desc.bEndpointAddress;
 #ifdef EHCI_URB_TRACE
        ehci_dbg (ehci,
@@ -937,7 +932,7 @@ submit_async (
                __FUNCTION__, urb->dev->devpath, urb,
                epnum & 0x0f, (epnum & USB_DIR_IN) ? "in" : "out",
                urb->transfer_buffer_length,
-                qtd, ep->hcpriv);
+                qtd, urb->ep->hcpriv);
 #endif
        spin_lock_irqsave (&ehci->lock, flags);
@@ -946,9 +941,13 @@ submit_async (
                rc = -ESHUTDOWN;
                goto done;
        }
+        rc = usb_hcd_link_urb_to_ep(ehci_to_hcd(ehci), urb);
+        if (unlikely(rc))
+                goto done;
-        qh = qh_append_tds (ehci, urb, qtd_list, epnum, &ep->hcpriv);
+        qh = qh_append_tds(ehci, urb, qtd_list, epnum, &urb->ep->hcpriv);
        if (unlikely(qh == NULL)) {
+                usb_hcd_unlink_urb_from_ep(ehci_to_hcd(ehci), urb);
                rc = -ENOMEM;
                goto done;
        }
diff --git a/drivers/usb/host/ehci-sched.c b/drivers/usb/host/ehci-sched.c
index d4a8ace4967..80d99bce2b3 100644
--- a/drivers/usb/host/ehci-sched.c
+++ b/drivers/usb/host/ehci-sched.c
@@ -479,109 +479,6 @@ static int disable_periodic (struct ehci_hcd *ehci)
 }
 /*-------------------------------------------------------------------------*/
-#ifdef CONFIG_CPU_FREQ
-static int safe_to_modify_i (struct ehci_hcd *ehci, struct ehci_qh *qh)
-{
-        int now; /* current (frame * 8) + uframe */
-        int prev_start, next_start; /* uframes from/to split start */
-        int start_uframe = ffs(le32_to_cpup (&qh->hw_info2) & QH_SMASK);
-        int end_uframe = fls((le32_to_cpup (&qh->hw_info2) & QH_CMASK) >> 8);
-        int split_duration = end_uframe - start_uframe;
-        now = readl(&ehci->regs->frame_index) % (ehci->periodic_size << 3);
-        next_start = ((1024 << 3) + (qh->start << 3) + start_uframe - now)
-                        % (qh->period << 3);
-        prev_start = (qh->period << 3) - next_start;
-        /*
-         * Make sure there will be at least one uframe when qh is safe.
-         */
-        if ((qh->period << 3) <= (ehci->i_thresh + 2 + split_duration))
-                /* never safe */
-                return -EINVAL;
-        /*
-         * Wait 1 uframe after transaction should have started, to make
-         * sure controller has time to write back overlay, so we can
-         * check QTD_STS_STS to see if transaction is in progress.
-         */
-        if ((next_start > ehci->i_thresh) && (prev_start > 1))
-                /* safe to set "i" bit if split isn't in progress */
-                return (qh->hw_token & STATUS_BIT(ehci)) ? 0 : 1;
-        else
-                return 0;
-}
-/* Set inactivate bit for all the split interrupt QHs. */
-static void qh_inactivate_split_intr_qhs (struct ehci_hcd *ehci)
-{
-        struct ehci_qh  *qh;
-        int             not_done, safe;
-        u32             inactivate = INACTIVATE_BIT(ehci);
-        u32             active = ACTIVE_BIT(ehci);
-        do {
-                not_done = 0;
-                list_for_each_entry(qh, &ehci->split_intr_qhs,
-                                split_intr_qhs) {
-                        if (qh->hw_info1 & inactivate)
-                                /* already off */
-                                continue;
-                        /*
-                         * To avoid setting "I" after the start split happens,
-                         * don't set it if the QH might be cached in the
-                         * controller.  Some HCs (Broadcom/ServerWorks HT1000)
-                         * will stop in the middle of a split transaction when
-                         * the "I" bit is set.
-                         */
-                        safe = safe_to_modify_i(ehci, qh);
-                        if (safe == 0) {
-                                not_done = 1;
-                        } else if (safe > 0) {
-                                qh->was_active = qh->hw_token & active;
-                                qh->hw_info1 |= inactivate;
-                        }
-                }
-        } while (not_done);
-        wmb();
-}
-static void qh_reactivate_split_intr_qhs (struct ehci_hcd *ehci)
-{
-        struct ehci_qh  *qh;
-        u32             token;
-        int             not_done, safe;
-        u32             inactivate = INACTIVATE_BIT(ehci);
-        u32             active = ACTIVE_BIT(ehci);
-        u32             halt = HALT_BIT(ehci);
-        do {
-                not_done = 0;
-                list_for_each_entry(qh, &ehci->split_intr_qhs, split_intr_qhs) {
-                        if (!(qh->hw_info1 & inactivate)) /* already on */
-                                continue;
-                        /*
-                         * Don't reactivate if cached, or controller might
-                         * overwrite overlay after we modify it!
-                         */
-                        safe = safe_to_modify_i(ehci, qh);
-                        if (safe == 0) {
-                                not_done = 1;
-                        } else if (safe > 0) {
-                                /* See EHCI 1.0 section 4.15.2.4. */
-                                token = qh->hw_token;
-                                qh->hw_token = (token | halt) & ~active;
-                                wmb();
-                                qh->hw_info1 &= ~inactivate;
-                                wmb();
-                                qh->hw_token = (token & ~halt) | qh->was_active;
-                        }
-                }
-        } while (not_done);
-}
-#endif
 /* periodic schedule slots have iso tds (normal or split) first, then a
 * sparse tree for active interrupt transfers.
@@ -599,17 +496,6 @@ static int qh_link_periodic (struct ehci_hcd *ehci, struct ehci_qh *qh)
                period, hc32_to_cpup(ehci, &qh->hw_info2) & (QH_CMASK | QH_SMASK),
                qh, qh->start, qh->usecs, qh->c_usecs);
-#ifdef CONFIG_CPU_FREQ
-        /*
-         * If low/full speed interrupt QHs are inactive (because of
-         * cpufreq changing processor speeds), start QH with I flag set--
-         * it will automatically be cleared when cpufreq is done.
-         */
-        if (ehci->cpufreq_changing)
-                if (!(qh->hw_info1 & (cpu_to_le32(1 << 13))))
-                        qh->hw_info1 |= INACTIVATE_BIT(ehci);
-#endif
        /* high bandwidth, or otherwise every microframe */
        if (period == 0)
                period = 1;
@@ -658,12 +544,6 @@ static int qh_link_periodic (struct ehci_hcd *ehci, struct ehci_qh *qh)
                ? ((qh->usecs + qh->c_usecs) / qh->period)
                : (qh->usecs * 8);
-#ifdef CONFIG_CPU_FREQ
-        /* add qh to list of low/full speed interrupt QHs, if applicable */
-        if (!(qh->hw_info1 & (cpu_to_le32(1 << 13)))) {
-                list_add(&qh->split_intr_qhs, &ehci->split_intr_qhs);
-        }
-#endif
        /* maybe enable periodic schedule processing */
        if (!ehci->periodic_sched++)
                return enable_periodic (ehci);
@@ -683,13 +563,6 @@ static void qh_unlink_periodic (struct ehci_hcd *ehci, struct ehci_qh *qh)
        // THEN
        //   qh->hw_info1 |= __constant_cpu_to_hc32(1 << 7 /* "ignore" */);
-#ifdef CONFIG_CPU_FREQ
-        /* remove qh from list of low/full speed interrupt QHs */
-        if (!(qh->hw_info1 & (cpu_to_le32(1 << 13)))) {
-                list_del_init(&qh->split_intr_qhs);
-        }
-#endif
        /* high bandwidth, or otherwise part of every microframe */
        if ((period = qh->period) == 0)
                period = 1;
@@ -924,7 +797,6 @@ done:
 static int intr_submit (
        struct ehci_hcd         *ehci,
-        struct usb_host_endpoint *ep,
        struct urb              *urb,
        struct list_head        *qtd_list,
        gfp_t                   mem_flags
@@ -932,23 +804,26 @@ static int intr_submit (
        unsigned                epnum;
        unsigned long           flags;
        struct ehci_qh          *qh;
-        int                     status = 0;
+        int                     status;
        struct list_head        empty;
        /* get endpoint and transfer/schedule data */
-        epnum = ep->desc.bEndpointAddress;
+        epnum = urb->ep->desc.bEndpointAddress;
        spin_lock_irqsave (&ehci->lock, flags);
        if (unlikely(!test_bit(HCD_FLAG_HW_ACCESSIBLE,
                        &ehci_to_hcd(ehci)->flags))) {
                status = -ESHUTDOWN;
-                goto done;
+                goto done_not_linked;
        }
+        status = usb_hcd_link_urb_to_ep(ehci_to_hcd(ehci), urb);
+        if (unlikely(status))
+                goto done_not_linked;
        /* get qh and force any scheduling errors */
        INIT_LIST_HEAD (&empty);
-        qh = qh_append_tds (ehci, urb, &empty, epnum, &ep->hcpriv);
+        qh = qh_append_tds(ehci, urb, &empty, epnum, &urb->ep->hcpriv);
        if (qh == NULL) {
                status = -ENOMEM;
                goto done;
@@ -959,13 +834,16 @@ static int intr_submit (
        }
        /* then queue the urb's tds to the qh */
-        qh = qh_append_tds (ehci, urb, qtd_list, epnum, &ep->hcpriv);
+        qh = qh_append_tds(ehci, urb, qtd_list, epnum, &urb->ep->hcpriv);
        BUG_ON (qh == NULL);
        /* ... update usbfs periodic stats */
        ehci_to_hcd(ehci)->self.bandwidth_int_reqs++;
 done:
+        if (unlikely(status))
+                usb_hcd_unlink_urb_from_ep(ehci_to_hcd(ehci), urb);
+done_not_linked:
        spin_unlock_irqrestore (&ehci->lock, flags);
        if (status)
                qtd_list_free (ehci, urb, qtd_list);
@@ -1749,7 +1627,7 @@ itd_complete (
        /* give urb back to the driver ... can be out-of-order */
        dev = urb->dev;
-        ehci_urb_done (ehci, urb);
+        ehci_urb_done(ehci, urb, 0);
        urb = NULL;
        /* defer stopping schedule; completion can submit */
@@ -1813,12 +1691,19 @@ static int itd_submit (struct ehci_hcd *ehci, struct urb *urb,
        /* schedule ... need to lock */
        spin_lock_irqsave (&ehci->lock, flags);
        if (unlikely(!test_bit(HCD_FLAG_HW_ACCESSIBLE,
-                               &ehci_to_hcd(ehci)->flags)))
+                               &ehci_to_hcd(ehci)->flags))) {
                status = -ESHUTDOWN;
-        else
+                goto done_not_linked;
-                status = iso_stream_schedule (ehci, urb, stream);
+        }
+        status = usb_hcd_link_urb_to_ep(ehci_to_hcd(ehci), urb);
+        if (unlikely(status))
+                goto done_not_linked;
+        status = iso_stream_schedule(ehci, urb, stream);
        if (likely (status == 0))
                itd_link_urb (ehci, urb, ehci->periodic_size << 3, stream);
+        else
+                usb_hcd_unlink_urb_from_ep(ehci_to_hcd(ehci), urb);
+done_not_linked:
        spin_unlock_irqrestore (&ehci->lock, flags);
 done:
@@ -2115,7 +2000,7 @@ sitd_complete (
        /* give urb back to the driver */
        dev = urb->dev;
-        ehci_urb_done (ehci, urb);
+        ehci_urb_done(ehci, urb, 0);
        urb = NULL;
        /* defer stopping schedule; completion can submit */
@@ -2176,12 +2061,19 @@ static int sitd_submit (struct ehci_hcd *ehci, struct urb *urb,
        /* schedule ... need to lock */
        spin_lock_irqsave (&ehci->lock, flags);
        if (unlikely(!test_bit(HCD_FLAG_HW_ACCESSIBLE,
-                               &ehci_to_hcd(ehci)->flags)))
+                               &ehci_to_hcd(ehci)->flags))) {
                status = -ESHUTDOWN;
-        else
+                goto done_not_linked;
-                status = iso_stream_schedule (ehci, urb, stream);
+        }
+        status = usb_hcd_link_urb_to_ep(ehci_to_hcd(ehci), urb);
+        if (unlikely(status))
+                goto done_not_linked;
+        status = iso_stream_schedule(ehci, urb, stream);
        if (status == 0)
                sitd_link_urb (ehci, urb, ehci->periodic_size << 3, stream);
+        else
+                usb_hcd_unlink_urb_from_ep(ehci_to_hcd(ehci), urb);
+done_not_linked:
        spin_unlock_irqrestore (&ehci->lock, flags);
 done:
diff --git a/drivers/usb/host/ehci.h b/drivers/usb/host/ehci.h
index 2c68a04230c..951d69fec51 100644
--- a/drivers/usb/host/ehci.h
+++ b/drivers/usb/host/ehci.h
@@ -71,12 +71,6 @@ struct ehci_hcd {			/* one per controller */
        __u32                   hcs_params;     /* cached register copy */
        spinlock_t              lock;
-#ifdef CONFIG_CPU_FREQ
-        struct notifier_block   cpufreq_transition;
-        int                     cpufreq_changing;
-        struct list_head        split_intr_qhs;
-#endif
        /* async schedule support */
        struct ehci_qh          *async;
        struct ehci_qh          *reclaim;
@@ -439,10 +433,6 @@ struct ehci_qh {
        __hc32                  hw_next;        /* see EHCI 3.6.1 */
        __hc32                  hw_info1;       /* see EHCI 3.6.2 */
 #define QH_HEAD         0x00008000
-#define QH_INACTIVATE   0x00000080
-#define INACTIVATE_BIT(ehci)    cpu_to_hc32(ehci, QH_INACTIVATE)
        __hc32                  hw_info2;        /* see EHCI 3.6.2 */
 #define QH_SMASK        0x000000ff
 #define QH_CMASK        0x0000ff00
@@ -492,10 +482,6 @@ struct ehci_qh {
        unsigned short          start;          /* where polling starts */
 #define NO_FRAME ((unsigned short)~0)                   /* pick new start */
        struct usb_device       *dev;           /* access to TT */
-#ifdef CONFIG_CPU_FREQ
-        struct list_head        split_intr_qhs; /* list of split qhs */
-        __le32                  was_active;     /* active bit before "i" set */
-#endif
 } __attribute__ ((aligned (32)));
 /*-------------------------------------------------------------------------*/
diff --git a/drivers/usb/host/isp116x-hcd.c b/drivers/usb/host/isp116x-hcd.c
index 46873f2534b..c27417f5b9d 100644
--- a/drivers/usb/host/isp116x-hcd.c
+++ b/drivers/usb/host/isp116x-hcd.c
@@ -228,7 +228,6 @@ static void preproc_atl_queue(struct isp116x *isp116x)
                                   struct urb, urb_list);
                ptd = &ep->ptd;
                len = ep->length;
-                spin_lock(&urb->lock);
                ep->data = (unsigned char *)urb->transfer_buffer
                    + urb->actual_length;
@@ -264,7 +263,6 @@ static void preproc_atl_queue(struct isp116x *isp116x)
                    | PTD_EP(ep->epnum);
                ptd->len = PTD_LEN(len) | PTD_DIR(dir);
                ptd->faddr = PTD_FA(usb_pipedevice(urb->pipe));
-                spin_unlock(&urb->lock);
                if (!ep->active) {
                        ptd->mps |= PTD_LAST_MSK;
                        isp116x->atl_last_dir = dir;
@@ -275,6 +273,61 @@ static void preproc_atl_queue(struct isp116x *isp116x)
 }
 /*
+  Take done or failed requests out of schedule. Give back
+  processed urbs.
+*/
+static void finish_request(struct isp116x *isp116x, struct isp116x_ep *ep,
+                           struct urb *urb, int status)
+__releases(isp116x->lock) __acquires(isp116x->lock)
+{
+        unsigned i;
+        ep->error_count = 0;
+        if (usb_pipecontrol(urb->pipe))
+                ep->nextpid = USB_PID_SETUP;
+        urb_dbg(urb, "Finish");
+        usb_hcd_unlink_urb_from_ep(isp116x_to_hcd(isp116x), urb);
+        spin_unlock(&isp116x->lock);
+        usb_hcd_giveback_urb(isp116x_to_hcd(isp116x), urb, status);
+        spin_lock(&isp116x->lock);
+        /* take idle endpoints out of the schedule */
+        if (!list_empty(&ep->hep->urb_list))
+                return;
+        /* async deschedule */
+        if (!list_empty(&ep->schedule)) {
+                list_del_init(&ep->schedule);
+                return;
+        }
+        /* periodic deschedule */
+        DBG("deschedule qh%d/%p branch %d\n", ep->period, ep, ep->branch);
+        for (i = ep->branch; i < PERIODIC_SIZE; i += ep->period) {
+                struct isp116x_ep *temp;
+                struct isp116x_ep **prev = &isp116x->periodic[i];
+                while (*prev && ((temp = *prev) != ep))
+                        prev = &temp->next;
+                if (*prev)
+                        *prev = ep->next;
+                isp116x->load[i] -= ep->load;
+        }
+        ep->branch = PERIODIC_SIZE;
+        isp116x_to_hcd(isp116x)->self.bandwidth_allocated -=
+            ep->load / ep->period;
+        /* switch irq type? */
+        if (!--isp116x->periodic_count) {
+                isp116x->irqenb &= ~HCuPINT_SOF;
+                isp116x->irqenb |= HCuPINT_ATL;
+        }
+}
+/*
  Analyze transfer results, handle partial transfers and errors
 */
 static void postproc_atl_queue(struct isp116x *isp116x)
@@ -284,6 +337,7 @@ static void postproc_atl_queue(struct isp116x *isp116x)
        struct usb_device *udev;
        struct ptd *ptd;
        int short_not_ok;
+        int status;
        u8 cc;
        for (ep = isp116x->atl_active; ep; ep = ep->active) {
@@ -294,7 +348,7 @@ static void postproc_atl_queue(struct isp116x *isp116x)
                ptd = &ep->ptd;
                cc = PTD_GET_CC(ptd);
                short_not_ok = 1;
-                spin_lock(&urb->lock);
+                status = -EINPROGRESS;
                /* Data underrun is special. For allowed underrun
                   we clear the error and continue as normal. For
@@ -302,47 +356,36 @@ static void postproc_atl_queue(struct isp116x *isp116x)
                   immediately while for control transfer,
                   we do a STATUS stage. */
                if (cc == TD_DATAUNDERRUN) {
-                        if (!(urb->transfer_flags & URB_SHORT_NOT_OK)) {
+                        if (!(urb->transfer_flags & URB_SHORT_NOT_OK) ||
-                                DBG("Allowed data underrun\n");
+                                        usb_pipecontrol(urb->pipe)) {
+                                DBG("Allowed or control data underrun\n");
                                cc = TD_CC_NOERROR;
                                short_not_ok = 0;
                        } else {
                                ep->error_count = 1;
-                                if (usb_pipecontrol(urb->pipe))
+                                usb_settoggle(udev, ep->epnum,
-                                        ep->nextpid = USB_PID_ACK;
+                                              ep->nextpid == USB_PID_OUT,
-                                else
+                                              PTD_GET_TOGGLE(ptd));
-                                        usb_settoggle(udev, ep->epnum,
-                                                      ep->nextpid ==
-                                                      USB_PID_OUT,
-                                                      PTD_GET_TOGGLE(ptd));
                                urb->actual_length += PTD_GET_COUNT(ptd);
-                                urb->status = cc_to_error[TD_DATAUNDERRUN];
+                                status = cc_to_error[TD_DATAUNDERRUN];
-                                spin_unlock(&urb->lock);
+                                goto done;
-                                continue;
                        }
                }
-                /* Keep underrun error through the STATUS stage */
-                if (urb->status == cc_to_error[TD_DATAUNDERRUN])
-                        cc = TD_DATAUNDERRUN;
                if (cc != TD_CC_NOERROR && cc != TD_NOTACCESSED
                    && (++ep->error_count >= 3 || cc == TD_CC_STALL
                        || cc == TD_DATAOVERRUN)) {
-                        if (urb->status == -EINPROGRESS)
+                        status = cc_to_error[cc];
-                                urb->status = cc_to_error[cc];
                        if (ep->nextpid == USB_PID_ACK)
                                ep->nextpid = 0;
-                        spin_unlock(&urb->lock);
+                        goto done;
-                        continue;
                }
                /* According to usb spec, zero-length Int transfer signals
                   finishing of the urb. Hey, does this apply only
                   for IN endpoints? */
                if (usb_pipeint(urb->pipe) && !PTD_GET_LEN(ptd)) {
-                        if (urb->status == -EINPROGRESS)
+                        status = 0;
-                                urb->status = 0;
+                        goto done;
-                        spin_unlock(&urb->lock);
-                        continue;
                }
                /* Relax after previously failed, but later succeeded
@@ -381,8 +424,8 @@ static void postproc_atl_queue(struct isp116x *isp116x)
                        /* All data for this URB is transferred, let's finish */
                        if (usb_pipecontrol(urb->pipe))
                                ep->nextpid = USB_PID_ACK;
-                        else if (urb->status == -EINPROGRESS)
+                        else
-                                urb->status = 0;
+                                status = 0;
                        break;
                case USB_PID_SETUP:
                        if (PTD_GET_ACTIVE(ptd)
@@ -402,69 +445,16 @@ static void postproc_atl_queue(struct isp116x *isp116x)
                        if (PTD_GET_ACTIVE(ptd)
                            || (cc != TD_CC_NOERROR && cc < 0x0E))
                                break;
-                        if (urb->status == -EINPROGRESS)
+                        status = 0;
-                                urb->status = 0;
                        ep->nextpid = 0;
                        break;
                default:
                        BUG();
                }
-                spin_unlock(&urb->lock);
-        }
-}
-/*
+ done:
-  Take done or failed requests out of schedule. Give back
+                if (status != -EINPROGRESS || urb->unlinked)
-  processed urbs.
+                        finish_request(isp116x, ep, urb, status);
-*/
-static void finish_request(struct isp116x *isp116x, struct isp116x_ep *ep,
-                           struct urb *urb)
-__releases(isp116x->lock) __acquires(isp116x->lock)
-{
-        unsigned i;
-        urb->hcpriv = NULL;
-        ep->error_count = 0;
-        if (usb_pipecontrol(urb->pipe))
-                ep->nextpid = USB_PID_SETUP;
-        urb_dbg(urb, "Finish");
-        spin_unlock(&isp116x->lock);
-        usb_hcd_giveback_urb(isp116x_to_hcd(isp116x), urb);
-        spin_lock(&isp116x->lock);
-        /* take idle endpoints out of the schedule */
-        if (!list_empty(&ep->hep->urb_list))
-                return;
-        /* async deschedule */
-        if (!list_empty(&ep->schedule)) {
-                list_del_init(&ep->schedule);
-                return;
-        }
-        /* periodic deschedule */
-        DBG("deschedule qh%d/%p branch %d\n", ep->period, ep, ep->branch);
-        for (i = ep->branch; i < PERIODIC_SIZE; i += ep->period) {
-                struct isp116x_ep *temp;
-                struct isp116x_ep **prev = &isp116x->periodic[i];
-                while (*prev && ((temp = *prev) != ep))
-                        prev = &temp->next;
-                if (*prev)
-                        *prev = ep->next;
-                isp116x->load[i] -= ep->load;
-        }
-        ep->branch = PERIODIC_SIZE;
-        isp116x_to_hcd(isp116x)->self.bandwidth_allocated -=
-            ep->load / ep->period;
-        /* switch irq type? */
-        if (!--isp116x->periodic_count) {
-                isp116x->irqenb &= ~HCuPINT_SOF;
-                isp116x->irqenb |= HCuPINT_ATL;
        }
 }
@@ -570,9 +560,6 @@ static void start_atl_transfers(struct isp116x *isp116x)
 */
 static void finish_atl_transfers(struct isp116x *isp116x)
 {
-        struct isp116x_ep *ep;
-        struct urb *urb;
        if (!isp116x->atl_active)
                return;
        /* Fifo not ready? */
@@ -582,16 +569,6 @@ static void finish_atl_transfers(struct isp116x *isp116x)
        atomic_inc(&isp116x->atl_finishing);
        unpack_fifo(isp116x);
        postproc_atl_queue(isp116x);
-        for (ep = isp116x->atl_active; ep; ep = ep->active) {
-                urb =
-                    container_of(ep->hep->urb_list.next, struct urb, urb_list);
-                /* USB_PID_ACK check here avoids finishing of
-                   control transfers, for which TD_DATAUNDERRUN
-                   occured, while URB_SHORT_NOT_OK was set */
-                if (urb && urb->status != -EINPROGRESS
-                    && ep->nextpid != USB_PID_ACK)
-                        finish_request(isp116x, ep, urb);
-        }
        atomic_dec(&isp116x->atl_finishing);
 }
@@ -685,7 +662,7 @@ static int balance(struct isp116x *isp116x, u16 period, u16 load)
 /*-----------------------------------------------------------------*/
 static int isp116x_urb_enqueue(struct usb_hcd *hcd,
-                               struct usb_host_endpoint *hep, struct urb *urb,
+                               struct urb *urb,
                               gfp_t mem_flags)
 {
        struct isp116x *isp116x = hcd_to_isp116x(hcd);
@@ -694,6 +671,7 @@ static int isp116x_urb_enqueue(struct usb_hcd *hcd,
        int is_out = !usb_pipein(pipe);
        int type = usb_pipetype(pipe);
        int epnum = usb_pipeendpoint(pipe);
+        struct usb_host_endpoint *hep = urb->ep;
        struct isp116x_ep *ep = NULL;
        unsigned long flags;
        int i;
@@ -717,7 +695,12 @@ static int isp116x_urb_enqueue(struct usb_hcd *hcd,
        if (!HC_IS_RUNNING(hcd->state)) {
                kfree(ep);
                ret = -ENODEV;
-                goto fail;
+                goto fail_not_linked;
+        }
+        ret = usb_hcd_link_urb_to_ep(hcd, urb);
+        if (ret) {
+                kfree(ep);
+                goto fail_not_linked;
        }
        if (hep->hcpriv)
@@ -820,19 +803,13 @@ static int isp116x_urb_enqueue(struct usb_hcd *hcd,
                }
        }
-        /* in case of unlink-during-submit */
-        spin_lock(&urb->lock);
-        if (urb->status != -EINPROGRESS) {
-                spin_unlock(&urb->lock);
-                finish_request(isp116x, ep, urb);
-                ret = 0;
-                goto fail;
-        }
        urb->hcpriv = hep;
-        spin_unlock(&urb->lock);
        start_atl_transfers(isp116x);
      fail:
+        if (ret)
+                usb_hcd_unlink_urb_from_ep(hcd, urb);
+      fail_not_linked:
        spin_unlock_irqrestore(&isp116x->lock, flags);
        return ret;
 }
@@ -840,20 +817,21 @@ static int isp116x_urb_enqueue(struct usb_hcd *hcd,
 /*
   Dequeue URBs.
 */
-static int isp116x_urb_dequeue(struct usb_hcd *hcd, struct urb *urb)
+static int isp116x_urb_dequeue(struct usb_hcd *hcd, struct urb *urb,
+                int status)
 {
        struct isp116x *isp116x = hcd_to_isp116x(hcd);
        struct usb_host_endpoint *hep;
        struct isp116x_ep *ep, *ep_act;
        unsigned long flags;
+        int rc;
        spin_lock_irqsave(&isp116x->lock, flags);
+        rc = usb_hcd_check_unlink_urb(hcd, urb, status);
+        if (rc)
+                goto done;
        hep = urb->hcpriv;
-        /* URB already unlinked (or never linked)? */
-        if (!hep) {
-                spin_unlock_irqrestore(&isp116x->lock, flags);
-                return 0;
-        }
        ep = hep->hcpriv;
        WARN_ON(hep != ep->hep);
@@ -870,10 +848,10 @@ static int isp116x_urb_dequeue(struct usb_hcd *hcd, struct urb *urb)
                        }
        if (urb)
-                finish_request(isp116x, ep, urb);
+                finish_request(isp116x, ep, urb, status);
+ done:
        spin_unlock_irqrestore(&isp116x->lock, flags);
-        return 0;
+        return rc;
 }
 static void isp116x_endpoint_disable(struct usb_hcd *hcd,
diff --git a/drivers/usb/host/ohci-dbg.c b/drivers/usb/host/ohci-dbg.c
index 6f9e43e9a6c..ebab5ce8f5c 100644
--- a/drivers/usb/host/ohci-dbg.c
+++ b/drivers/usb/host/ohci-dbg.c
@@ -24,7 +24,7 @@
 * small: 0) header + data packets 1) just header
 */
 static void __maybe_unused
-urb_print (struct urb * urb, char * str, int small)
+urb_print(struct urb * urb, char * str, int small, int status)
 {
        unsigned int pipe= urb->pipe;
@@ -34,7 +34,7 @@ urb_print (struct urb * urb, char * str, int small)
        }
 #ifndef OHCI_VERBOSE_DEBUG
-        if (urb->status != 0)
+        if (status != 0)
 #endif
        dbg("%s %p dev=%d ep=%d%s-%s flags=%x len=%d/%d stat=%d",
                    str,
@@ -46,7 +46,7 @@ urb_print (struct urb * urb, char * str, int small)
                    urb->transfer_flags,
                    urb->actual_length,
                    urb->transfer_buffer_length,
-                    urb->status);
+                    status);
 #ifdef  OHCI_VERBOSE_DEBUG
        if (!small) {
@@ -66,7 +66,7 @@ urb_print (struct urb * urb, char * str, int small)
                                                urb->transfer_buffer_length: urb->actual_length;
                        for (i = 0; i < 16 && i < len; i++)
                                printk (" %02x", ((__u8 *) urb->transfer_buffer) [i]);
-                        printk ("%s stat:%d\n", i < len? "...": "", urb->status);
+                        printk ("%s stat:%d\n", i < len? "...": "", status);
                }
        }
 #endif
@@ -74,7 +74,7 @@ urb_print (struct urb * urb, char * str, int small)
 #define ohci_dbg_sw(ohci, next, size, format, arg...) \
        do { \
-        if (next) { \
+        if (next != NULL) { \
                unsigned s_len; \
                s_len = scnprintf (*next, *size, format, ## arg ); \
                *size -= s_len; *next += s_len; \
diff --git a/drivers/usb/host/ohci-hcd.c b/drivers/usb/host/ohci-hcd.c
index 2038125b7f8..240c7f50754 100644
--- a/drivers/usb/host/ohci-hcd.c
+++ b/drivers/usb/host/ohci-hcd.c
@@ -81,7 +81,6 @@ static void ohci_dump (struct ohci_hcd *ohci, int verbose);
 static int ohci_init (struct ohci_hcd *ohci);
 static void ohci_stop (struct usb_hcd *hcd);
 static int ohci_restart (struct ohci_hcd *ohci);
-static void ohci_quirk_nec_worker (struct work_struct *work);
 #include "ohci-hub.c"
 #include "ohci-dbg.c"
@@ -118,7 +117,6 @@ MODULE_PARM_DESC (no_handshake, "true (not default) disables BIOS handshake");
 */
 static int ohci_urb_enqueue (
        struct usb_hcd  *hcd,
-        struct usb_host_endpoint *ep,
        struct urb      *urb,
        gfp_t           mem_flags
 ) {
@@ -131,11 +129,11 @@ static int ohci_urb_enqueue (
        int             retval = 0;
 #ifdef OHCI_VERBOSE_DEBUG
-        urb_print (urb, "SUB", usb_pipein (pipe));
+        urb_print(urb, "SUB", usb_pipein(pipe), -EINPROGRESS);
 #endif
        /* every endpoint has a ed, locate and maybe (re)initialize it */
-        if (! (ed = ed_get (ohci, ep, urb->dev, pipe, urb->interval)))
+        if (! (ed = ed_get (ohci, urb->ep, urb->dev, pipe, urb->interval)))
                return -ENOMEM;
        /* for the private part of the URB we need the number of TDs (size) */
@@ -171,11 +169,10 @@ static int ohci_urb_enqueue (
        }
        /* allocate the private part of the URB */
-        urb_priv = kmalloc (sizeof (urb_priv_t) + size * sizeof (struct td *),
+        urb_priv = kzalloc (sizeof (urb_priv_t) + size * sizeof (struct td *),
                        mem_flags);
        if (!urb_priv)
                return -ENOMEM;
-        memset (urb_priv, 0, sizeof (urb_priv_t) + size * sizeof (struct td *));
        INIT_LIST_HEAD (&urb_priv->pending);
        urb_priv->length = size;
        urb_priv->ed = ed;
@@ -201,22 +198,17 @@ static int ohci_urb_enqueue (
                retval = -ENODEV;
                goto fail;
        }
+        retval = usb_hcd_link_urb_to_ep(hcd, urb);
-        /* in case of unlink-during-submit */
+        if (retval)
-        spin_lock (&urb->lock);
-        if (urb->status != -EINPROGRESS) {
-                spin_unlock (&urb->lock);
-                urb->hcpriv = urb_priv;
-                finish_urb (ohci, urb);
-                retval = 0;
                goto fail;
-        }
        /* schedule the ed if needed */
        if (ed->state == ED_IDLE) {
                retval = ed_schedule (ohci, ed);
-                if (retval < 0)
+                if (retval < 0) {
-                        goto fail0;
+                        usb_hcd_unlink_urb_from_ep(hcd, urb);
+                        goto fail;
+                }
                if (ed->type == PIPE_ISOCHRONOUS) {
                        u16     frame = ohci_frame_no(ohci);
@@ -240,8 +232,6 @@ static int ohci_urb_enqueue (
        urb->hcpriv = urb_priv;
        td_submit_urb (ohci, urb);
-fail0:
-        spin_unlock (&urb->lock);
 fail:
        if (retval)
                urb_free_priv (ohci, urb_priv);
@@ -250,22 +240,26 @@ fail:
 }
 /*
- * decouple the URB from the HC queues (TDs, urb_priv); it's
+ * decouple the URB from the HC queues (TDs, urb_priv).
- * already marked using urb->status.  reporting is always done
+ * reporting is always done
 * asynchronously, and we might be dealing with an urb that's
 * partially transferred, or an ED with other urbs being unlinked.
 */
-static int ohci_urb_dequeue (struct usb_hcd *hcd, struct urb *urb)
+static int ohci_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status)
 {
        struct ohci_hcd         *ohci = hcd_to_ohci (hcd);
        unsigned long           flags;
+        int                     rc;
 #ifdef OHCI_VERBOSE_DEBUG
-        urb_print (urb, "UNLINK", 1);
+        urb_print(urb, "UNLINK", 1, status);
 #endif
        spin_lock_irqsave (&ohci->lock, flags);
-        if (HC_IS_RUNNING(hcd->state)) {
+        rc = usb_hcd_check_unlink_urb(hcd, urb, status);
+        if (rc) {
+                ;       /* Do nothing */
+        } else if (HC_IS_RUNNING(hcd->state)) {
                urb_priv_t  *urb_priv;
                /* Unless an IRQ completed the unlink while it was being
@@ -283,10 +277,10 @@ static int ohci_urb_dequeue (struct usb_hcd *hcd, struct urb *urb)
                 * any more ... just clean up every urb's memory.
                 */
                if (urb->hcpriv)
-                        finish_urb (ohci, urb);
+                        finish_urb(ohci, urb, status);
        }
        spin_unlock_irqrestore (&ohci->lock, flags);
-        return 0;
+        return rc;
 }
 /*-------------------------------------------------------------------------*/
@@ -315,6 +309,8 @@ rescan:
        if (!HC_IS_RUNNING (hcd->state)) {
 sanitize:
                ed->state = ED_IDLE;
+                if (quirk_zfmicro(ohci) && ed->type == PIPE_INTERRUPT)
+                        ohci->eds_scheduled--;
                finish_unlinks (ohci, 0);
        }
@@ -322,7 +318,12 @@ sanitize:
        case ED_UNLINK:         /* wait for hw to finish? */
                /* major IRQ delivery trouble loses INTR_SF too... */
                if (limit-- == 0) {
-                        ohci_warn (ohci, "IRQ INTR_SF lossage\n");
+                        ohci_warn(ohci, "ED unlink timeout\n");
+                        if (quirk_zfmicro(ohci)) {
+                                ohci_warn(ohci, "Attempting ZF TD recovery\n");
+                                ohci->ed_to_check = ed;
+                                ohci->zf_delay = 2;
+                        }
                        goto sanitize;
                }
                spin_unlock_irqrestore (&ohci->lock, flags);
@@ -380,6 +381,93 @@ ohci_shutdown (struct usb_hcd *hcd)
        (void) ohci_readl (ohci, &ohci->regs->control);
 }
+static int check_ed(struct ohci_hcd *ohci, struct ed *ed)
+{
+        return (hc32_to_cpu(ohci, ed->hwINFO) & ED_IN) != 0
+                && (hc32_to_cpu(ohci, ed->hwHeadP) & TD_MASK)
+                        == (hc32_to_cpu(ohci, ed->hwTailP) & TD_MASK)
+                && !list_empty(&ed->td_list);
+}
+/* ZF Micro watchdog timer callback. The ZF Micro chipset sometimes completes
+ * an interrupt TD but neglects to add it to the donelist.  On systems with
+ * this chipset, we need to periodically check the state of the queues to look
+ * for such "lost" TDs.
+ */
+static void unlink_watchdog_func(unsigned long _ohci)
+{
+        long            flags;
+        unsigned        max;
+        unsigned        seen_count = 0;
+        unsigned        i;
+        struct ed       **seen = NULL;
+        struct ohci_hcd *ohci = (struct ohci_hcd *) _ohci;
+        spin_lock_irqsave(&ohci->lock, flags);
+        max = ohci->eds_scheduled;
+        if (!max)
+                goto done;
+        if (ohci->ed_to_check)
+                goto out;
+        seen = kcalloc(max, sizeof *seen, GFP_ATOMIC);
+        if (!seen)
+                goto out;
+        for (i = 0; i < NUM_INTS; i++) {
+                struct ed       *ed = ohci->periodic[i];
+                while (ed) {
+                        unsigned        temp;
+                        /* scan this branch of the periodic schedule tree */
+                        for (temp = 0; temp < seen_count; temp++) {
+                                if (seen[temp] == ed) {
+                                        /* we've checked it and what's after */
+                                        ed = NULL;
+                                        break;
+                                }
+                        }
+                        if (!ed)
+                                break;
+                        seen[seen_count++] = ed;
+                        if (!check_ed(ohci, ed)) {
+                                ed = ed->ed_next;
+                                continue;
+                        }
+                        /* HC's TD list is empty, but HCD sees at least one
+                         * TD that's not been sent through the donelist.
+                         */
+                        ohci->ed_to_check = ed;
+                        ohci->zf_delay = 2;
+                        /* The HC may wait until the next frame to report the
+                         * TD as done through the donelist and INTR_WDH.  (We
+                         * just *assume* it's not a multi-TD interrupt URB;
+                         * those could defer the IRQ more than one frame, using
+                         * DI...)  Check again after the next INTR_SF.
+                         */
+                        ohci_writel(ohci, OHCI_INTR_SF,
+                                        &ohci->regs->intrstatus);
+                        ohci_writel(ohci, OHCI_INTR_SF,
+                                        &ohci->regs->intrenable);
+                        /* flush those writes */
+                        (void) ohci_readl(ohci, &ohci->regs->control);
+                        goto out;
+                }
+        }
+out:
+        kfree(seen);
+        if (ohci->eds_scheduled)
+                mod_timer(&ohci->unlink_watchdog, round_jiffies_relative(HZ));
+done:
+        spin_unlock_irqrestore(&ohci->lock, flags);
+}
 /*-------------------------------------------------------------------------*
 * HC functions
 *-------------------------------------------------------------------------*/
@@ -617,6 +705,15 @@ retry:
        mdelay ((temp >> 23) & 0x1fe);
        hcd->state = HC_STATE_RUNNING;
+        if (quirk_zfmicro(ohci)) {
+                /* Create timer to watch for bad queue state on ZF Micro */
+                setup_timer(&ohci->unlink_watchdog, unlink_watchdog_func,
+                                (unsigned long) ohci);
+                ohci->eds_scheduled = 0;
+                ohci->ed_to_check = NULL;
+        }
        ohci_dump (ohci, 1);
        return 0;
@@ -630,10 +727,11 @@ static irqreturn_t ohci_irq (struct usb_hcd *hcd)
 {
        struct ohci_hcd         *ohci = hcd_to_ohci (hcd);
        struct ohci_regs __iomem *regs = ohci->regs;
-        int                     ints; 
+        int                     ints;
        /* we can eliminate a (slow) ohci_readl()
-           if _only_ WDH caused this irq */
+         * if _only_ WDH caused this irq
+         */
        if ((ohci->hcca->done_head != 0)
                        && ! (hc32_to_cpup (ohci, &ohci->hcca->done_head)
                                & 0x01)) {
@@ -652,7 +750,7 @@ static irqreturn_t ohci_irq (struct usb_hcd *hcd)
        if (ints & OHCI_INTR_UE) {
                // e.g. due to PCI Master/Target Abort
-                if (ohci->flags & OHCI_QUIRK_NEC) {
+                if (quirk_nec(ohci)) {
                        /* Workaround for a silicon bug in some NEC chips used
                         * in Apple's PowerBooks. Adapted from Darwin code.
                         */
@@ -714,6 +812,31 @@ static irqreturn_t ohci_irq (struct usb_hcd *hcd)
                        ohci_writel (ohci, OHCI_INTR_WDH, &regs->intrenable);
        }
+        if (quirk_zfmicro(ohci) && (ints & OHCI_INTR_SF)) {
+                spin_lock(&ohci->lock);
+                if (ohci->ed_to_check) {
+                        struct ed *ed = ohci->ed_to_check;
+                        if (check_ed(ohci, ed)) {
+                                /* HC thinks the TD list is empty; HCD knows
+                                 * at least one TD is outstanding
+                                 */
+                                if (--ohci->zf_delay == 0) {
+                                        struct td *td = list_entry(
+                                                ed->td_list.next,
+                                                struct td, td_list);
+                                        ohci_warn(ohci,
+                                                  "Reclaiming orphan TD %p\n",
+                                                  td);
+                                        takeback_td(ohci, td);
+                                        ohci->ed_to_check = NULL;
+                                }
+                        } else
+                                ohci->ed_to_check = NULL;
+                }
+                spin_unlock(&ohci->lock);
+        }
        /* could track INTR_SO to reduce available PCI/... bandwidth */
        /* handle any pending URB/ED unlinks, leaving INTR_SF enabled
@@ -722,7 +845,9 @@ static irqreturn_t ohci_irq (struct usb_hcd *hcd)
        spin_lock (&ohci->lock);
        if (ohci->ed_rm_list)
                finish_unlinks (ohci, ohci_frame_no(ohci));
-        if ((ints & OHCI_INTR_SF) != 0 && !ohci->ed_rm_list
+        if ((ints & OHCI_INTR_SF) != 0
+                        && !ohci->ed_rm_list
+                        && !ohci->ed_to_check
                        && HC_IS_RUNNING(hcd->state))
                ohci_writel (ohci, OHCI_INTR_SF, &regs->intrdisable);
        spin_unlock (&ohci->lock);
@@ -752,6 +877,9 @@ static void ohci_stop (struct usb_hcd *hcd)
        free_irq(hcd->irq, hcd);
        hcd->irq = -1;
+        if (quirk_zfmicro(ohci))
+                del_timer(&ohci->unlink_watchdog);
        remove_debug_files (ohci);
        ohci_mem_cleanup (ohci);
        if (ohci->hcca) {
@@ -799,9 +927,8 @@ static int ohci_restart (struct ohci_hcd *ohci)
                                        ed, ed->state);
                }
-                spin_lock (&urb->lock);
+                if (!urb->unlinked)
-                urb->status = -ESHUTDOWN;
+                        urb->unlinked = -ESHUTDOWN;
-                spin_unlock (&urb->lock);
        }
        finish_unlinks (ohci, 0);
        spin_unlock_irq(&ohci->lock);
@@ -829,27 +956,6 @@ static int ohci_restart (struct ohci_hcd *ohci)
 /*-------------------------------------------------------------------------*/
-/* NEC workaround */
-static void ohci_quirk_nec_worker(struct work_struct *work)
-{
-        struct ohci_hcd *ohci = container_of(work, struct ohci_hcd, nec_work);
-        int status;
-        status = ohci_init(ohci);
-        if (status != 0) {
-                ohci_err(ohci, "Restarting NEC controller failed "
-                         "in ohci_init, %d\n", status);
-                return;
-        }
-        status = ohci_restart(ohci);
-        if (status != 0)
-                ohci_err(ohci, "Restarting NEC controller failed "
-                         "in ohci_restart, %d\n", status);
-}
-/*-------------------------------------------------------------------------*/
 #define DRIVER_INFO DRIVER_VERSION " " DRIVER_DESC
 MODULE_AUTHOR (DRIVER_AUTHOR);
@@ -927,11 +1033,17 @@ MODULE_LICENSE ("GPL");
 #define PS3_SYSTEM_BUS_DRIVER   ps3_ohci_driver
 #endif
+#ifdef CONFIG_USB_OHCI_HCD_SSB
+#include "ohci-ssb.c"
+#define SSB_OHCI_DRIVER         ssb_ohci_driver
+#endif
 #if     !defined(PCI_DRIVER) &&         \
        !defined(PLATFORM_DRIVER) &&    \
        !defined(OF_PLATFORM_DRIVER) && \
        !defined(SA1111_DRIVER) &&      \
-        !defined(PS3_SYSTEM_BUS_DRIVER)
+        !defined(PS3_SYSTEM_BUS_DRIVER) && \
+        !defined(SSB_OHCI_DRIVER)
 #error "missing bus glue for ohci-hcd"
 #endif
@@ -976,10 +1088,20 @@ static int __init ohci_hcd_mod_init(void)
                goto error_pci;
 #endif
+#ifdef SSB_OHCI_DRIVER
+        retval = ssb_driver_register(&SSB_OHCI_DRIVER);
+        if (retval)
+                goto error_ssb;
+#endif
        return retval;
        /* Error path */
+#ifdef SSB_OHCI_DRIVER
+ error_ssb:
+#endif
 #ifdef PCI_DRIVER
+        pci_unregister_driver(&PCI_DRIVER);
 error_pci:
 #endif
 #ifdef SA1111_DRIVER
@@ -1004,6 +1126,9 @@ module_init(ohci_hcd_mod_init);
 static void __exit ohci_hcd_mod_exit(void)
 {
+#ifdef SSB_OHCI_DRIVER
+        ssb_driver_unregister(&SSB_OHCI_DRIVER);
+#endif
 #ifdef PCI_DRIVER
        pci_unregister_driver(&PCI_DRIVER);
 #endif
diff --git a/drivers/usb/host/ohci-mem.c b/drivers/usb/host/ohci-mem.c
index 450c7b460c5..2f20d3dc895 100644
--- a/drivers/usb/host/ohci-mem.c
+++ b/drivers/usb/host/ohci-mem.c
@@ -28,7 +28,6 @@ static void ohci_hcd_init (struct ohci_hcd *ohci)
        ohci->next_statechange = jiffies;
        spin_lock_init (&ohci->lock);
        INIT_LIST_HEAD (&ohci->pending);
-        INIT_WORK (&ohci->nec_work, ohci_quirk_nec_worker);
 }
 /*-------------------------------------------------------------------------*/
diff --git a/drivers/usb/host/ohci-pci.c b/drivers/usb/host/ohci-pci.c
index a5e2eb85d07..d0360f65ebd 100644
--- a/drivers/usb/host/ohci-pci.c
+++ b/drivers/usb/host/ohci-pci.c
@@ -84,7 +84,7 @@ static int ohci_quirk_zfmicro(struct usb_hcd *hcd)
        struct ohci_hcd *ohci = hcd_to_ohci (hcd);
        ohci->flags |= OHCI_QUIRK_ZFMICRO;
-        ohci_dbg (ohci, "enabled Compaq ZFMicro chipset quirk\n");
+        ohci_dbg(ohci, "enabled Compaq ZFMicro chipset quirks\n");
        return 0;
 }
@@ -113,11 +113,31 @@ static int ohci_quirk_toshiba_scc(struct usb_hcd *hcd)
 /* Check for NEC chip and apply quirk for allegedly lost interrupts.
 */
+static void ohci_quirk_nec_worker(struct work_struct *work)
+{
+        struct ohci_hcd *ohci = container_of(work, struct ohci_hcd, nec_work);
+        int status;
+        status = ohci_init(ohci);
+        if (status != 0) {
+                ohci_err(ohci, "Restarting NEC controller failed in %s, %d\n",
+                         "ohci_init", status);
+                return;
+        }
+        status = ohci_restart(ohci);
+        if (status != 0)
+                ohci_err(ohci, "Restarting NEC controller failed in %s, %d\n",
+                         "ohci_restart", status);
+}
 static int ohci_quirk_nec(struct usb_hcd *hcd)
 {
        struct ohci_hcd *ohci = hcd_to_ohci (hcd);
        ohci->flags |= OHCI_QUIRK_NEC;
+        INIT_WORK(&ohci->nec_work, ohci_quirk_nec_worker);
        ohci_dbg (ohci, "enabled NEC chipset lost interrupt quirk\n");
        return 0;
diff --git a/drivers/usb/host/ohci-ppc-of.c b/drivers/usb/host/ohci-ppc-of.c
index c43b66acd4d..0a742692015 100644
--- a/drivers/usb/host/ohci-ppc-of.c
+++ b/drivers/usb/host/ohci-ppc-of.c
@@ -134,8 +134,11 @@ ohci_hcd_ppc_of_probe(struct of_device *op, const struct of_device_id *match)
        }
        ohci = hcd_to_ohci(hcd);
-        if (is_bigendian)
+        if (is_bigendian) {
                ohci->flags |= OHCI_QUIRK_BE_MMIO | OHCI_QUIRK_BE_DESC;
+                if (of_device_is_compatible(dn, "mpc5200-ohci"))
+                        ohci->flags |= OHCI_QUIRK_FRAME_NO;
+        }
        ohci_hcd_init(ohci);
diff --git a/drivers/usb/host/ohci-ppc-soc.c b/drivers/usb/host/ohci-ppc-soc.c
index 1a2e1777ca6..f95be1896b0 100644
--- a/drivers/usb/host/ohci-ppc-soc.c
+++ b/drivers/usb/host/ohci-ppc-soc.c
@@ -73,6 +73,11 @@ static int usb_hcd_ppc_soc_probe(const struct hc_driver *driver,
        ohci = hcd_to_ohci(hcd);
        ohci->flags |= OHCI_QUIRK_BE_MMIO | OHCI_QUIRK_BE_DESC;
+#ifdef CONFIG_PPC_MPC52xx
+        /* MPC52xx doesn't need frame_no shift */
+        ohci->flags |= OHCI_QUIRK_FRAME_NO;
+#endif
        ohci_hcd_init(ohci);
        retval = usb_add_hcd(hcd, irq, IRQF_DISABLED);
diff --git a/drivers/usb/host/ohci-q.c b/drivers/usb/host/ohci-q.c
index 830a3fe8615..51817322232 100644
--- a/drivers/usb/host/ohci-q.c
+++ b/drivers/usb/host/ohci-q.c
@@ -36,29 +36,15 @@ static void urb_free_priv (struct ohci_hcd *hc, urb_priv_t *urb_priv)
 * PRECONDITION:  ohci lock held, irqs blocked.
 */
 static void
-finish_urb (struct ohci_hcd *ohci, struct urb *urb)
+finish_urb(struct ohci_hcd *ohci, struct urb *urb, int status)
 __releases(ohci->lock)
 __acquires(ohci->lock)
 {
        // ASSERT (urb->hcpriv != 0);
        urb_free_priv (ohci, urb->hcpriv);
-        urb->hcpriv = NULL;
+        if (likely(status == -EINPROGRESS))
+                status = 0;
-        spin_lock (&urb->lock);
-        if (likely (urb->status == -EINPROGRESS))
-                urb->status = 0;
-        /* report short control reads right even though the data TD always
-         * has TD_R set.  (much simpler, but creates the 1-td limit.)
-         */
-        if (unlikely (urb->transfer_flags & URB_SHORT_NOT_OK)
-                        && unlikely (usb_pipecontrol (urb->pipe))
-                        && urb->actual_length < urb->transfer_buffer_length
-                        && usb_pipein (urb->pipe)
-                        && urb->status == 0) {
-                urb->status = -EREMOTEIO;
-        }
-        spin_unlock (&urb->lock);
        switch (usb_pipetype (urb->pipe)) {
        case PIPE_ISOCHRONOUS:
@@ -70,12 +56,13 @@ __acquires(ohci->lock)
        }
 #ifdef OHCI_VERBOSE_DEBUG
-        urb_print (urb, "RET", usb_pipeout (urb->pipe));
+        urb_print(urb, "RET", usb_pipeout (urb->pipe), status);
 #endif
        /* urb->complete() can reenter this HCD */
+        usb_hcd_unlink_urb_from_ep(ohci_to_hcd(ohci), urb);
        spin_unlock (&ohci->lock);
-        usb_hcd_giveback_urb (ohci_to_hcd(ohci), urb);
+        usb_hcd_giveback_urb(ohci_to_hcd(ohci), urb, status);
        spin_lock (&ohci->lock);
        /* stop periodic dma if it's not needed */
@@ -179,6 +166,10 @@ static int ed_schedule (struct ohci_hcd *ohci, struct ed *ed)
        ed->ed_prev = NULL;
        ed->ed_next = NULL;
        ed->hwNextED = 0;
+        if (quirk_zfmicro(ohci)
+                        && (ed->type == PIPE_INTERRUPT)
+                        && !(ohci->eds_scheduled++))
+                mod_timer(&ohci->unlink_watchdog, round_jiffies_relative(HZ));
        wmb ();
        /* we care about rm_list when setting CLE/BLE in case the HC was at
@@ -708,19 +699,18 @@ static void td_submit_urb (
 * Done List handling functions
 *-------------------------------------------------------------------------*/
-/* calculate transfer length/status and update the urb
+/* calculate transfer length/status and update the urb */
- * PRECONDITION:  irqsafe (only for urb->status locking)
+static int td_done(struct ohci_hcd *ohci, struct urb *urb, struct td *td)
- */
-static void td_done (struct ohci_hcd *ohci, struct urb *urb, struct td *td)
 {
        u32     tdINFO = hc32_to_cpup (ohci, &td->hwINFO);
        int     cc = 0;
+        int     status = -EINPROGRESS;
        list_del (&td->td_list);
        /* ISO ... drivers see per-TD length/status */
        if (tdINFO & TD_ISO) {
-                u16     tdPSW = ohci_hwPSW (ohci, td, 0);
+                u16     tdPSW = ohci_hwPSW(ohci, td, 0);
                int     dlen = 0;
                /* NOTE:  assumes FC in tdINFO == 0, and that
@@ -729,7 +719,7 @@ static void td_done (struct ohci_hcd *ohci, struct urb *urb, struct td *td)
                cc = (tdPSW >> 12) & 0xF;
                if (tdINFO & TD_CC)     /* hc didn't touch? */
-                        return;
+                        return status;
                if (usb_pipeout (urb->pipe))
                        dlen = urb->iso_frame_desc [td->index].length;
@@ -762,12 +752,8 @@ static void td_done (struct ohci_hcd *ohci, struct urb *urb, struct td *td)
                if (cc == TD_DATAUNDERRUN
                                && !(urb->transfer_flags & URB_SHORT_NOT_OK))
                        cc = TD_CC_NOERROR;
-                if (cc != TD_CC_NOERROR && cc < 0x0E) {
+                if (cc != TD_CC_NOERROR && cc < 0x0E)
-                        spin_lock (&urb->lock);
+                        status = cc_to_error[cc];
-                        if (urb->status == -EINPROGRESS)
-                                urb->status = cc_to_error [cc];
-                        spin_unlock (&urb->lock);
-                }
                /* count all non-empty packets except control SETUP packet */
                if ((type != PIPE_CONTROL || td->index != 0) && tdBE != 0) {
@@ -786,14 +772,15 @@ static void td_done (struct ohci_hcd *ohci, struct urb *urb, struct td *td)
                                urb->actual_length,
                                urb->transfer_buffer_length);
        }
+        return status;
 }
 /*-------------------------------------------------------------------------*/
-static inline struct td *
+static void ed_halted(struct ohci_hcd *ohci, struct td *td, int cc)
-ed_halted (struct ohci_hcd *ohci, struct td *td, int cc, struct td *rev)
 {
        struct urb              *urb = td->urb;
+        urb_priv_t              *urb_priv = urb->hcpriv;
        struct ed               *ed = td->ed;
        struct list_head        *tmp = td->td_list.next;
        __hc32                  toggle = ed->hwHeadP & cpu_to_hc32 (ohci, ED_C);
@@ -805,13 +792,12 @@ ed_halted (struct ohci_hcd *ohci, struct td *td, int cc, struct td *rev)
        wmb ();
        ed->hwHeadP &= ~cpu_to_hc32 (ohci, ED_H);
-        /* put any later tds from this urb onto the donelist, after 'td',
+        /* Get rid of all later tds from this urb.  We don't have
-         * order won't matter here: no errors, and nothing was transferred.
+         * to be careful: no errors and nothing was transferred.
-         * also patch the ed so it looks as if those tds completed normally.
+         * Also patch the ed so it looks as if those tds completed normally.
         */
        while (tmp != &ed->td_list) {
                struct td       *next;
-                __hc32          info;
                next = list_entry (tmp, struct td, td_list);
                tmp = next->td_list.next;
@@ -826,14 +812,9 @@ ed_halted (struct ohci_hcd *ohci, struct td *td, int cc, struct td *rev)
                 * then we need to leave the control STATUS packet queued
                 * and clear ED_SKIP.
                 */
-                info = next->hwINFO;
-                info |= cpu_to_hc32 (ohci, TD_DONE);
-                info &= ~cpu_to_hc32 (ohci, TD_CC);
-                next->hwINFO = info;
-                next->next_dl_td = rev;
-                rev = next;
+                list_del(&next->td_list);
+                urb_priv->td_cnt++;
                ed->hwHeadP = next->hwNextTD | toggle;
        }
@@ -859,8 +840,6 @@ ed_halted (struct ohci_hcd *ohci, struct td *td, int cc, struct td *rev)
                        hc32_to_cpu (ohci, td->hwINFO),
                        cc, cc_to_error [cc]);
        }
-        return rev;
 }
 /* replies to the request have to be on a FIFO basis so
@@ -897,7 +876,7 @@ static struct td *dl_reverse_done_list (struct ohci_hcd *ohci)
                 */
                if (cc != TD_CC_NOERROR
                                && (td->ed->hwHeadP & cpu_to_hc32 (ohci, ED_H)))
-                        td_rev = ed_halted (ohci, td, cc, td_rev);
+                        ed_halted(ohci, td, cc);
                td->next_dl_td = td_rev;
                td_rev = td;
@@ -940,8 +919,12 @@ skip_ed:
                                                                TD_MASK;
                                /* INTR_WDH may need to clean up first */
-                                if (td->td_dma != head)
+                                if (td->td_dma != head) {
-                                        goto skip_ed;
+                                        if (ed == ohci->ed_to_check)
+                                                ohci->ed_to_check = NULL;
+                                        else
+                                                goto skip_ed;
+                                }
                        }
                }
@@ -974,7 +957,7 @@ rescan_this:
                        urb = td->urb;
                        urb_priv = td->urb->hcpriv;
-                        if (urb->status == -EINPROGRESS) {
+                        if (!urb->unlinked) {
                                prev = &td->hwNextTD;
                                continue;
                        }
@@ -990,7 +973,7 @@ rescan_this:
                        /* if URB is done, clean up */
                        if (urb_priv->td_cnt == urb_priv->length) {
                                modified = completed = 1;
-                                finish_urb (ohci, urb);
+                                finish_urb(ohci, urb, 0);
                        }
                }
                if (completed && !list_empty (&ed->td_list))
@@ -998,6 +981,8 @@ rescan_this:
                /* ED's now officially unlinked, hc doesn't see */
                ed->state = ED_IDLE;
+                if (quirk_zfmicro(ohci) && ed->type == PIPE_INTERRUPT)
+                        ohci->eds_scheduled--;
                ed->hwHeadP &= ~cpu_to_hc32(ohci, ED_H);
                ed->hwNextED = 0;
                wmb ();
@@ -1021,7 +1006,7 @@ rescan_this:
                if (ohci->ed_controltail) {
                        command |= OHCI_CLF;
-                        if (ohci->flags & OHCI_QUIRK_ZFMICRO)
+                        if (quirk_zfmicro(ohci))
                                mdelay(1);
                        if (!(ohci->hc_control & OHCI_CTRL_CLE)) {
                                control |= OHCI_CTRL_CLE;
@@ -1031,7 +1016,7 @@ rescan_this:
                }
                if (ohci->ed_bulktail) {
                        command |= OHCI_BLF;
-                        if (ohci->flags & OHCI_QUIRK_ZFMICRO)
+                        if (quirk_zfmicro(ohci))
                                mdelay(1);
                        if (!(ohci->hc_control & OHCI_CTRL_BLE)) {
                                control |= OHCI_CTRL_BLE;
@@ -1043,13 +1028,13 @@ rescan_this:
                /* CLE/BLE to enable, CLF/BLF to (maybe) kickstart */
                if (control) {
                        ohci->hc_control |= control;
-                        if (ohci->flags & OHCI_QUIRK_ZFMICRO)
+                        if (quirk_zfmicro(ohci))
                                mdelay(1);
                        ohci_writel (ohci, ohci->hc_control,
                                        &ohci->regs->control);
                }
                if (command) {
-                        if (ohci->flags & OHCI_QUIRK_ZFMICRO)
+                        if (quirk_zfmicro(ohci))
                                mdelay(1);
                        ohci_writel (ohci, command, &ohci->regs->cmdstatus);
                }
@@ -1061,11 +1046,60 @@ rescan_this:
 /*-------------------------------------------------------------------------*/
 /*
+ * Used to take back a TD from the host controller. This would normally be
+ * called from within dl_done_list, however it may be called directly if the
+ * HC no longer sees the TD and it has not appeared on the donelist (after
+ * two frames).  This bug has been observed on ZF Micro systems.
+ */
+static void takeback_td(struct ohci_hcd *ohci, struct td *td)
+{
+        struct urb      *urb = td->urb;
+        urb_priv_t      *urb_priv = urb->hcpriv;
+        struct ed       *ed = td->ed;
+        int             status;
+        /* update URB's length and status from TD */
+        status = td_done(ohci, urb, td);
+        urb_priv->td_cnt++;
+        /* If all this urb's TDs are done, call complete() */
+        if (urb_priv->td_cnt == urb_priv->length)
+                finish_urb(ohci, urb, status);
+        /* clean schedule:  unlink EDs that are no longer busy */
+        if (list_empty(&ed->td_list)) {
+                if (ed->state == ED_OPER)
+                        start_ed_unlink(ohci, ed);
+        /* ... reenabling halted EDs only after fault cleanup */
+        } else if ((ed->hwINFO & cpu_to_hc32(ohci, ED_SKIP | ED_DEQUEUE))
+                        == cpu_to_hc32(ohci, ED_SKIP)) {
+                td = list_entry(ed->td_list.next, struct td, td_list);
+                if (!(td->hwINFO & cpu_to_hc32(ohci, TD_DONE))) {
+                        ed->hwINFO &= ~cpu_to_hc32(ohci, ED_SKIP);
+                        /* ... hc may need waking-up */
+                        switch (ed->type) {
+                        case PIPE_CONTROL:
+                                ohci_writel(ohci, OHCI_CLF,
+                                                &ohci->regs->cmdstatus);
+                                break;
+                        case PIPE_BULK:
+                                ohci_writel(ohci, OHCI_BLF,
+                                                &ohci->regs->cmdstatus);
+                                break;
+                        }
+                }
+        }
+}
+/*
 * Process normal completions (error or success) and clean the schedules.
 *
 * This is the main path for handing urbs back to drivers.  The only other
- * path is finish_unlinks(), which unlinks URBs using ed_rm_list, instead of
+ * normal path is finish_unlinks(), which unlinks URBs using ed_rm_list,
- * scanning the (re-reversed) donelist as this does.
+ * instead of scanning the (re-reversed) donelist as this does.  There's
+ * an abnormal path too, handling a quirk in some Compaq silicon:  URBs
+ * with TDs that appear to be orphaned are directly reclaimed.
 */
 static void
 dl_done_list (struct ohci_hcd *ohci)
@@ -1074,44 +1108,7 @@ dl_done_list (struct ohci_hcd *ohci)
        while (td) {
                struct td       *td_next = td->next_dl_td;
-                struct urb      *urb = td->urb;
+                takeback_td(ohci, td);
-                urb_priv_t      *urb_priv = urb->hcpriv;
-                struct ed       *ed = td->ed;
-                /* update URB's length and status from TD */
-                td_done (ohci, urb, td);
-                urb_priv->td_cnt++;
-                /* If all this urb's TDs are done, call complete() */
-                if (urb_priv->td_cnt == urb_priv->length)
-                        finish_urb (ohci, urb);
-                /* clean schedule:  unlink EDs that are no longer busy */
-                if (list_empty (&ed->td_list)) {
-                        if (ed->state == ED_OPER)
-                                start_ed_unlink (ohci, ed);
-                /* ... reenabling halted EDs only after fault cleanup */
-                } else if ((ed->hwINFO & cpu_to_hc32 (ohci,
-                                                ED_SKIP | ED_DEQUEUE))
-                                        == cpu_to_hc32 (ohci, ED_SKIP)) {
-                        td = list_entry (ed->td_list.next, struct td, td_list);
-                        if (!(td->hwINFO & cpu_to_hc32 (ohci, TD_DONE))) {
-                                ed->hwINFO &= ~cpu_to_hc32 (ohci, ED_SKIP);
-                                /* ... hc may need waking-up */
-                                switch (ed->type) {
-                                case PIPE_CONTROL:
-                                        ohci_writel (ohci, OHCI_CLF,
-                                                &ohci->regs->cmdstatus);
-                                        break;
-                                case PIPE_BULK:
-                                        ohci_writel (ohci, OHCI_BLF,
-                                                &ohci->regs->cmdstatus);
-                                        break;
-                                }
-                        }
-                }
                td = td_next;
        }
 }
diff --git a/drivers/usb/host/ohci-ssb.c b/drivers/usb/host/ohci-ssb.c
new file mode 100644
index 00000000000..bc3e785d8c0
--- /dev/null
+++ b/drivers/usb/host/ohci-ssb.c
@@ -0,0 +1,247 @@
+/*
+ * Sonics Silicon Backplane
+ * Broadcom USB-core OHCI driver
+ *
+ * Copyright 2007 Michael Buesch <mb@bu3sch.de>
+ *
+ * Derived from the OHCI-PCI driver
+ * Copyright 1999 Roman Weissgaerber
+ * Copyright 2000-2002 David Brownell
+ * Copyright 1999 Linus Torvalds
+ * Copyright 1999 Gregory P. Smith
+ *
+ * Derived from the USBcore related parts of Broadcom-SB
+ * Copyright 2005 Broadcom Corporation
+ *
+ * Licensed under the GNU/GPL. See COPYING for details.
+ */
+#include <linux/ssb/ssb.h>
+#define SSB_OHCI_TMSLOW_HOSTMODE        (1 << 29)
+struct ssb_ohci_device {
+        struct ohci_hcd ohci; /* _must_ be at the beginning. */
+        u32 enable_flags;
+};
+static inline
+struct ssb_ohci_device *hcd_to_ssb_ohci(struct usb_hcd *hcd)
+{
+        return (struct ssb_ohci_device *)(hcd->hcd_priv);
+}
+static int ssb_ohci_reset(struct usb_hcd *hcd)
+{
+        struct ssb_ohci_device *ohcidev = hcd_to_ssb_ohci(hcd);
+        struct ohci_hcd *ohci = &ohcidev->ohci;
+        int err;
+        ohci_hcd_init(ohci);
+        err = ohci_init(ohci);
+        return err;
+}
+static int ssb_ohci_start(struct usb_hcd *hcd)
+{
+        struct ssb_ohci_device *ohcidev = hcd_to_ssb_ohci(hcd);
+        struct ohci_hcd *ohci = &ohcidev->ohci;
+        int err;
+        err = ohci_run(ohci);
+        if (err < 0) {
+                ohci_err(ohci, "can't start\n");
+                ohci_stop(hcd);
+        }
+        return err;
+}
+#ifdef CONFIG_PM
+static int ssb_ohci_hcd_suspend(struct usb_hcd *hcd, pm_message_t message)
+{
+        struct ssb_ohci_device *ohcidev = hcd_to_ssb_ohci(hcd);
+        struct ohci_hcd *ohci = &ohcidev->ohci;
+        unsigned long flags;
+        spin_lock_irqsave(&ohci->lock, flags);
+        ohci_writel(ohci, OHCI_INTR_MIE, &ohci->regs->intrdisable);
+        ohci_readl(ohci, &ohci->regs->intrdisable); /* commit write */
+        /* make sure snapshot being resumed re-enumerates everything */
+        if (message.event == PM_EVENT_PRETHAW)
+                ohci_usb_reset(ohci);
+        clear_bit(HCD_FLAG_HW_ACCESSIBLE, &hcd->flags);
+        spin_unlock_irqrestore(&ohci->lock, flags);
+        return 0;
+}
+static int ssb_ohci_hcd_resume(struct usb_hcd *hcd)
+{
+        set_bit(HCD_FLAG_HW_ACCESSIBLE, &hcd->flags);
+        usb_hcd_resume_root_hub(hcd);
+        return 0;
+}
+#endif /* CONFIG_PM */
+static const struct hc_driver ssb_ohci_hc_driver = {
+        .description            = "ssb-usb-ohci",
+        .product_desc           = "SSB OHCI Controller",
+        .hcd_priv_size          = sizeof(struct ssb_ohci_device),
+        .irq                    = ohci_irq,
+        .flags                  = HCD_MEMORY | HCD_USB11,
+        .reset                  = ssb_ohci_reset,
+        .start                  = ssb_ohci_start,
+        .stop                   = ohci_stop,
+        .shutdown               = ohci_shutdown,
+#ifdef CONFIG_PM
+        .suspend                = ssb_ohci_hcd_suspend,
+        .resume                 = ssb_ohci_hcd_resume,
+#endif
+        .urb_enqueue            = ohci_urb_enqueue,
+        .urb_dequeue            = ohci_urb_dequeue,
+        .endpoint_disable       = ohci_endpoint_disable,
+        .get_frame_number       = ohci_get_frame,
+        .hub_status_data        = ohci_hub_status_data,
+        .hub_control            = ohci_hub_control,
+        .hub_irq_enable         = ohci_rhsc_enable,
+        .bus_suspend            = ohci_bus_suspend,
+        .bus_resume             = ohci_bus_resume,
+        .start_port_reset       = ohci_start_port_reset,
+};
+static void ssb_ohci_detach(struct ssb_device *dev)
+{
+        struct usb_hcd *hcd = ssb_get_drvdata(dev);
+        usb_remove_hcd(hcd);
+        iounmap(hcd->regs);
+        usb_put_hcd(hcd);
+        ssb_device_disable(dev, 0);
+}
+static int ssb_ohci_attach(struct ssb_device *dev)
+{
+        struct ssb_ohci_device *ohcidev;
+        struct usb_hcd *hcd;
+        int err = -ENOMEM;
+        u32 tmp, flags = 0;
+        if (dev->id.coreid == SSB_DEV_USB11_HOSTDEV)
+                flags |= SSB_OHCI_TMSLOW_HOSTMODE;
+        ssb_device_enable(dev, flags);
+        hcd = usb_create_hcd(&ssb_ohci_hc_driver, dev->dev,
+                        dev->dev->bus_id);
+        if (!hcd)
+                goto err_dev_disable;
+        ohcidev = hcd_to_ssb_ohci(hcd);
+        ohcidev->enable_flags = flags;
+        tmp = ssb_read32(dev, SSB_ADMATCH0);
+        hcd->rsrc_start = ssb_admatch_base(tmp);
+        hcd->rsrc_len = ssb_admatch_size(tmp);
+        hcd->regs = ioremap_nocache(hcd->rsrc_start, hcd->rsrc_len);
+        if (!hcd->regs)
+                goto err_put_hcd;
+        err = usb_add_hcd(hcd, dev->irq, IRQF_SHARED);
+        if (err)
+                goto err_iounmap;
+        ssb_set_drvdata(dev, hcd);
+        return err;
+err_iounmap:
+        iounmap(hcd->regs);
+err_put_hcd:
+        usb_put_hcd(hcd);
+err_dev_disable:
+        ssb_device_disable(dev, flags);
+        return err;
+}
+static int ssb_ohci_probe(struct ssb_device *dev,
+                const struct ssb_device_id *id)
+{
+        int err;
+        u16 chipid_top;
+        /* USBcores are only connected on embedded devices. */
+        chipid_top = (dev->bus->chip_id & 0xFF00);
+        if (chipid_top != 0x4700 && chipid_top != 0x5300)
+                return -ENODEV;
+        /* TODO: Probably need checks here; is the core connected? */
+        if (usb_disabled())
+                return -ENODEV;
+        /* We currently always attach SSB_DEV_USB11_HOSTDEV
+         * as HOST OHCI. If we want to attach it as Client device,
+         * we must branch here and call into the (yet to
+         * be written) Client mode driver. Same for remove(). */
+        err = ssb_ohci_attach(dev);
+        return err;
+}
+static void ssb_ohci_remove(struct ssb_device *dev)
+{
+        ssb_ohci_detach(dev);
+}
+#ifdef CONFIG_PM
+static int ssb_ohci_suspend(struct ssb_device *dev, pm_message_t state)
+{
+        ssb_device_disable(dev, 0);
+        return 0;
+}
+static int ssb_ohci_resume(struct ssb_device *dev)
+{
+        struct usb_hcd *hcd = ssb_get_drvdata(dev);
+        struct ssb_ohci_device *ohcidev = hcd_to_ssb_ohci(hcd);
+        ssb_device_enable(dev, ohcidev->enable_flags);
+        return 0;
+}
+#else /* !CONFIG_PM */
+#define ssb_ohci_suspend        NULL
+#define ssb_ohci_resume NULL
+#endif /* CONFIG_PM */
+static const struct ssb_device_id ssb_ohci_table[] = {
+        SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_USB11_HOSTDEV, SSB_ANY_REV),
+        SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_USB11_HOST, SSB_ANY_REV),
+        SSB_DEVTABLE_END
+};
+MODULE_DEVICE_TABLE(ssb, ssb_ohci_table);
+static struct ssb_driver ssb_ohci_driver = {
+        .name           = KBUILD_MODNAME,
+        .id_table       = ssb_ohci_table,
+        .probe          = ssb_ohci_probe,
+        .remove         = ssb_ohci_remove,
+        .suspend        = ssb_ohci_suspend,
+        .resume         = ssb_ohci_resume,
+};
diff --git a/drivers/usb/host/ohci.h b/drivers/usb/host/ohci.h
index 4ada43cf138..47c5c66a282 100644
--- a/drivers/usb/host/ohci.h
+++ b/drivers/usb/host/ohci.h
@@ -398,11 +398,38 @@ struct ohci_hcd {
 #define OHCI_QUIRK_BE_MMIO      0x10                    /* BE registers */
 #define OHCI_QUIRK_ZFMICRO      0x20                    /* Compaq ZFMicro chipset*/
 #define OHCI_QUIRK_NEC          0x40                    /* lost interrupts */
+#define OHCI_QUIRK_FRAME_NO     0x80                    /* no big endian frame_no shift */
        // there are also chip quirks/bugs in init logic
        struct work_struct      nec_work;       /* Worker for NEC quirk */
+        /* Needed for ZF Micro quirk */
+        struct timer_list       unlink_watchdog;
+        unsigned                eds_scheduled;
+        struct ed               *ed_to_check;
+        unsigned                zf_delay;
 };
+#ifdef CONFIG_PCI
+static inline int quirk_nec(struct ohci_hcd *ohci)
+{
+        return ohci->flags & OHCI_QUIRK_NEC;
+}
+static inline int quirk_zfmicro(struct ohci_hcd *ohci)
+{
+        return ohci->flags & OHCI_QUIRK_ZFMICRO;
+}
+#else
+static inline int quirk_nec(struct ohci_hcd *ohci)
+{
+        return 0;
+}
+static inline int quirk_zfmicro(struct ohci_hcd *ohci)
+{
+        return 0;
+}
+#endif
 /* convert between an hcd pointer and the corresponding ohci_hcd */
 static inline struct ohci_hcd *hcd_to_ohci (struct usb_hcd *hcd)
 {
@@ -607,15 +634,12 @@ static inline u32 hc32_to_cpup (const struct ohci_hcd *ohci, const __hc32 *x)
 /* HCCA frame number is 16 bits, but is accessed as 32 bits since not all
 * hardware handles 16 bit reads.  That creates a different confusion on
 * some big-endian SOC implementations.  Same thing happens with PSW access.
- *
- * FIXME: Deal with that as a runtime quirk when STB03xxx is ported over
- * to arch/powerpc
 */
-#ifdef CONFIG_STB03xxx
+#ifdef CONFIG_PPC_MPC52xx
-#define OHCI_BE_FRAME_NO_SHIFT  16
+#define big_endian_frame_no_quirk(ohci) (ohci->flags & OHCI_QUIRK_FRAME_NO)
 #else
-#define OHCI_BE_FRAME_NO_SHIFT  0
+#define big_endian_frame_no_quirk(ohci) 0
 #endif
 static inline u16 ohci_frame_no(const struct ohci_hcd *ohci)
@@ -623,7 +647,8 @@ static inline u16 ohci_frame_no(const struct ohci_hcd *ohci)
        u32 tmp;
        if (big_endian_desc(ohci)) {
                tmp = be32_to_cpup((__force __be32 *)&ohci->hcca->frame_no);
-                tmp >>= OHCI_BE_FRAME_NO_SHIFT;
+                if (!big_endian_frame_no_quirk(ohci))
+                        tmp >>= 16;
        } else
                tmp = le32_to_cpup((__force __le32 *)&ohci->hcca->frame_no);
diff --git a/drivers/usb/host/r8a66597-hcd.c b/drivers/usb/host/r8a66597-hcd.c
index a7a7070c6e2..ae8ec4474eb 100644
--- a/drivers/usb/host/r8a66597-hcd.c
+++ b/drivers/usb/host/r8a66597-hcd.c
@@ -35,10 +35,8 @@
 #include <linux/interrupt.h>
 #include <linux/usb.h>
 #include <linux/platform_device.h>
+#include <linux/io.h>
-#include <asm/io.h>
+#include <linux/irq.h>
-#include <asm/irq.h>
-#include <asm/system.h>
 #include "../core/hcd.h"
 #include "r8a66597.h"
@@ -54,16 +52,21 @@ static const char hcd_name[] = "r8a66597_hcd";
 /* module parameters */
 static unsigned short clock = XTAL12;
 module_param(clock, ushort, 0644);
-MODULE_PARM_DESC(clock, "input clock: 48MHz=32768, 24MHz=16384, 12MHz=0(default=0)");
+MODULE_PARM_DESC(clock, "input clock: 48MHz=32768, 24MHz=16384, 12MHz=0 "
+                "(default=0)");
 static unsigned short vif = LDRV;
 module_param(vif, ushort, 0644);
 MODULE_PARM_DESC(vif, "input VIF: 3.3V=32768, 1.5V=0(default=32768)");
-static unsigned short endian = 0;
+static unsigned short endian;
 module_param(endian, ushort, 0644);
-MODULE_PARM_DESC(endian, "data endian: big=256, little=0(default=0)");
+MODULE_PARM_DESC(endian, "data endian: big=256, little=0 (default=0)");
 static unsigned short irq_sense = INTL;
 module_param(irq_sense, ushort, 0644);
-MODULE_PARM_DESC(irq_sense, "IRQ sense: low level=32, falling edge=0(default=32)");
+MODULE_PARM_DESC(irq_sense, "IRQ sense: low level=32, falling edge=0 "
+                "(default=32)");
 static void packet_write(struct r8a66597 *r8a66597, u16 pipenum);
 static int r8a66597_get_frame(struct usb_hcd *hcd);
@@ -308,7 +311,7 @@ static int make_r8a66597_device(struct r8a66597 *r8a66597,
        struct r8a66597_device *dev;
        int usb_address = urb->setup_packet[2]; /* urb->pipe is address 0 */
-        dev = kzalloc(sizeof(struct r8a66597_device), GFP_KERNEL);
+        dev = kzalloc(sizeof(struct r8a66597_device), GFP_ATOMIC);
        if (dev == NULL)
                return -ENOMEM;
@@ -611,33 +614,33 @@ static u16 get_empty_pipenum(struct r8a66597 *r8a66597,
        u16 array[R8A66597_MAX_NUM_PIPE], i = 0, min;
        memset(array, 0, sizeof(array));
-        switch(ep->bmAttributes & USB_ENDPOINT_XFERTYPE_MASK) {
+        switch (ep->bmAttributes & USB_ENDPOINT_XFERTYPE_MASK) {
-        case USB_ENDPOINT_XFER_BULK:
+        case USB_ENDPOINT_XFER_BULK:
                if (ep->bEndpointAddress & USB_ENDPOINT_DIR_MASK)
                        array[i++] = 4;
                else {
                        array[i++] = 3;
                        array[i++] = 5;
                }
-                break;
+                break;
-        case USB_ENDPOINT_XFER_INT:
+        case USB_ENDPOINT_XFER_INT:
                if (ep->bEndpointAddress & USB_ENDPOINT_DIR_MASK) {
                        array[i++] = 6;
                        array[i++] = 7;
                        array[i++] = 8;
                } else
                        array[i++] = 9;
-                break;
+                break;
-        case USB_ENDPOINT_XFER_ISOC:
+        case USB_ENDPOINT_XFER_ISOC:
                if (ep->bEndpointAddress & USB_ENDPOINT_DIR_MASK)
                        array[i++] = 2;
                else
                        array[i++] = 1;
-                break;
+                break;
-        default:
+        default:
-                err("Illegal type");
+                err("Illegal type");
-                return 0;
+                return 0;
-        }
+        }
        i = 1;
        min = array[0];
@@ -654,7 +657,7 @@ static u16 get_r8a66597_type(__u8 type)
 {
        u16 r8a66597_type;
-        switch(type) {
+        switch (type) {
        case USB_ENDPOINT_XFER_BULK:
                r8a66597_type = R8A66597_BULK;
                break;
@@ -779,10 +782,12 @@ static void force_dequeue(struct r8a66597 *r8a66597, u16 pipenum, u16 address)
                kfree(td);
                if (urb) {
-                        urb->status = -ENODEV;
+                        usb_hcd_unlink_urb_from_ep(r8a66597_to_hcd(r8a66597),
-                        urb->hcpriv = NULL;
+                                        urb);
                        spin_unlock(&r8a66597->lock);
-                        usb_hcd_giveback_urb(r8a66597_to_hcd(r8a66597), urb);
+                        usb_hcd_giveback_urb(r8a66597_to_hcd(r8a66597), urb,
+                                        -ENODEV);
                        spin_lock(&r8a66597->lock);
                }
                break;
@@ -829,7 +834,7 @@ static void init_pipe_info(struct r8a66597 *r8a66597, struct urb *urb,
        info.pipenum = get_empty_pipenum(r8a66597, ep);
        info.address = get_urb_to_r8a66597_addr(r8a66597, urb);
        info.epnum = ep->bEndpointAddress & USB_ENDPOINT_NUMBER_MASK;
-        info.maxpacket = ep->wMaxPacketSize;
+        info.maxpacket = le16_to_cpu(ep->wMaxPacketSize);
        info.type = get_r8a66597_type(ep->bmAttributes
                                      & USB_ENDPOINT_XFERTYPE_MASK);
        info.bufnum = get_bufnum(info.pipenum);
@@ -874,7 +879,7 @@ static void r8a66597_usb_preconnect(struct r8a66597 *r8a66597, int port)
 {
        r8a66597->root_hub[port].port |= (1 << USB_PORT_FEAT_CONNECTION)
                                         | (1 << USB_PORT_FEAT_C_CONNECTION);
-        r8a66597_write(r8a66597, (u16)~DTCH, get_intsts_reg(port));
+        r8a66597_write(r8a66597, ~DTCH, get_intsts_reg(port));
        r8a66597_bset(r8a66597, DTCHE, get_intenb_reg(port));
 }
@@ -917,10 +922,10 @@ static void prepare_setup_packet(struct r8a66597 *r8a66597,
        r8a66597_write(r8a66597, make_devsel(td->address) | td->maxpacket,
                       DCPMAXP);
-        r8a66597_write(r8a66597, (u16)~(SIGN | SACK), INTSTS1);
+        r8a66597_write(r8a66597, ~(SIGN | SACK), INTSTS1);
        for (i = 0; i < 4; i++) {
-                r8a66597_write(r8a66597, p[i], setup_addr);
+                r8a66597_write(r8a66597, cpu_to_le16(p[i]), setup_addr);
                setup_addr += 2;
        }
        r8a66597_write(r8a66597, SUREQ, DCPCTR);
@@ -948,19 +953,18 @@ static void prepare_packet_read(struct r8a66597 *r8a66597,
                        pipe_irq_disable(r8a66597, td->pipenum);
                        pipe_setting(r8a66597, td);
                        pipe_stop(r8a66597, td->pipe);
-                        r8a66597_write(r8a66597, (u16)~(1 << td->pipenum),
+                        r8a66597_write(r8a66597, ~(1 << td->pipenum), BRDYSTS);
-                                       BRDYSTS);
                        if (td->pipe->pipetre) {
                                r8a66597_write(r8a66597, TRCLR,
-                                                td->pipe->pipetre);
+                                                td->pipe->pipetre);
                                r8a66597_write(r8a66597,
-                                               (urb->transfer_buffer_length
+                                                (urb->transfer_buffer_length
-                                               + td->maxpacket - 1)
+                                                + td->maxpacket - 1)
-                                               / td->maxpacket,
+                                                / td->maxpacket,
-                                               td->pipe->pipetrn);
+                                                td->pipe->pipetrn);
                                r8a66597_bset(r8a66597, TRENB,
-                                              td->pipe->pipetre);
+                                                td->pipe->pipetre);
                        }
                        pipe_start(r8a66597, td->pipe);
@@ -991,7 +995,7 @@ static void prepare_packet_write(struct r8a66597 *r8a66597,
                if (td->pipe->pipetre)
                        r8a66597_bclr(r8a66597, TRENB, td->pipe->pipetre);
        }
-        r8a66597_write(r8a66597, (u16)~(1 << td->pipenum), BRDYSTS);
+        r8a66597_write(r8a66597, ~(1 << td->pipenum), BRDYSTS);
        fifo_change_from_pipe(r8a66597, td->pipe);
        tmp = r8a66597_read(r8a66597, td->pipe->fifoctr);
@@ -1009,27 +1013,36 @@ static void prepare_status_packet(struct r8a66597 *r8a66597,
        struct urb *urb = td->urb;
        r8a66597_pipe_toggle(r8a66597, td->pipe, 1);
+        pipe_stop(r8a66597, td->pipe);
        if (urb->setup_packet[0] & USB_ENDPOINT_DIR_MASK) {
                r8a66597_bset(r8a66597, R8A66597_DIR, DCPCFG);
                r8a66597_mdfy(r8a66597, ISEL, ISEL | CURPIPE, CFIFOSEL);
                r8a66597_reg_wait(r8a66597, CFIFOSEL, CURPIPE, 0);
-                r8a66597_write(r8a66597, BVAL | BCLR, CFIFOCTR);
+                r8a66597_write(r8a66597, ~BEMP0, BEMPSTS);
-                r8a66597_write(r8a66597, (u16)~BEMP0, BEMPSTS);
+                r8a66597_write(r8a66597, BCLR, CFIFOCTR);
+                r8a66597_write(r8a66597, BVAL, CFIFOCTR);
                enable_irq_empty(r8a66597, 0);
        } else {
                r8a66597_bclr(r8a66597, R8A66597_DIR, DCPCFG);
                r8a66597_mdfy(r8a66597, 0, ISEL | CURPIPE, CFIFOSEL);
                r8a66597_reg_wait(r8a66597, CFIFOSEL, CURPIPE, 0);
                r8a66597_write(r8a66597, BCLR, CFIFOCTR);
-                r8a66597_write(r8a66597, (u16)~BRDY0, BRDYSTS);
-                r8a66597_write(r8a66597, (u16)~BEMP0, BEMPSTS);
                enable_irq_ready(r8a66597, 0);
        }
        enable_irq_nrdy(r8a66597, 0);
        pipe_start(r8a66597, td->pipe);
 }
+static int is_set_address(unsigned char *setup_packet)
+{
+        if (((setup_packet[0] & USB_TYPE_MASK) == USB_TYPE_STANDARD) &&
+                        setup_packet[1] == USB_REQ_SET_ADDRESS)
+                return 1;
+        else
+                return 0;
+}
 /* this function must be called with interrupt disabled */
 static int start_transfer(struct r8a66597 *r8a66597, struct r8a66597_td *td)
 {
@@ -1037,7 +1050,7 @@ static int start_transfer(struct r8a66597 *r8a66597, struct r8a66597_td *td)
        switch (td->type) {
        case USB_PID_SETUP:
-                if (td->urb->setup_packet[1] == USB_REQ_SET_ADDRESS) {
+                if (is_set_address(td->urb->setup_packet)) {
                        td->set_address = 1;
                        td->urb->setup_packet[2] = alloc_usb_address(r8a66597,
                                                                     td->urb);
@@ -1104,8 +1117,9 @@ static void set_td_timer(struct r8a66597 *r8a66597, struct r8a66597_td *td)
 }
 /* this function must be called with interrupt disabled */
-static void done(struct r8a66597 *r8a66597, struct r8a66597_td *td,
+static void finish_request(struct r8a66597 *r8a66597, struct r8a66597_td *td,
-                 u16 pipenum, struct urb *urb)
+                u16 pipenum, struct urb *urb, int status)
+__releases(r8a66597->lock) __acquires(r8a66597->lock)
 {
        int restart = 0;
        struct usb_hcd *hcd = r8a66597_to_hcd(r8a66597);
@@ -1113,7 +1127,7 @@ static void done(struct r8a66597 *r8a66597, struct r8a66597_td *td,
        r8a66597->timeout_map &= ~(1 << pipenum);
        if (likely(td)) {
-                if (td->set_address && urb->status != 0)
+                if (td->set_address && (status != 0 || urb->unlinked))
                        r8a66597->address_map &= ~(1 << urb->setup_packet[2]);
                pipe_toggle_save(r8a66597, td->pipe, urb);
@@ -1128,9 +1142,9 @@ static void done(struct r8a66597 *r8a66597, struct r8a66597_td *td,
                if (usb_pipeisoc(urb->pipe))
                        urb->start_frame = r8a66597_get_frame(hcd);
-                urb->hcpriv = NULL;
+                usb_hcd_unlink_urb_from_ep(r8a66597_to_hcd(r8a66597), urb);
                spin_unlock(&r8a66597->lock);
-                usb_hcd_giveback_urb(hcd, urb);
+                usb_hcd_giveback_urb(hcd, urb, status);
                spin_lock(&r8a66597->lock);
        }
@@ -1144,14 +1158,6 @@ static void done(struct r8a66597 *r8a66597, struct r8a66597_td *td,
        }
 }
-/* this function must be called with interrupt disabled */
-static void finish_request(struct r8a66597 *r8a66597, struct r8a66597_td *td,
-                           u16 pipenum, struct urb *urb)
-__releases(r8a66597->lock) __acquires(r8a66597->lock)
-{
-        done(r8a66597, td, pipenum, urb);
-}
 static void packet_read(struct r8a66597 *r8a66597, u16 pipenum)
 {
        u16 tmp;
@@ -1160,6 +1166,7 @@ static void packet_read(struct r8a66597 *r8a66597, u16 pipenum)
        struct r8a66597_td *td = r8a66597_get_td(r8a66597, pipenum);
        struct urb *urb;
        int finish = 0;
+        int status = 0;
        if (unlikely(!td))
                return;
@@ -1168,17 +1175,15 @@ static void packet_read(struct r8a66597 *r8a66597, u16 pipenum)
        fifo_change_from_pipe(r8a66597, td->pipe);
        tmp = r8a66597_read(r8a66597, td->pipe->fifoctr);
        if (unlikely((tmp & FRDY) == 0)) {
-                urb->status = -EPIPE;
                pipe_stop(r8a66597, td->pipe);
                pipe_irq_disable(r8a66597, pipenum);
                err("in fifo not ready (%d)", pipenum);
-                finish_request(r8a66597, td, pipenum, td->urb);
+                finish_request(r8a66597, td, pipenum, td->urb, -EPIPE);
                return;
        }
        /* prepare parameters */
        rcv_len = tmp & DTLN;
-        bufsize = td->maxpacket;
        if (usb_pipeisoc(urb->pipe)) {
                buf = (u16 *)(urb->transfer_buffer +
                                urb->iso_frame_desc[td->iso_cnt].offset);
@@ -1187,29 +1192,31 @@ static void packet_read(struct r8a66597 *r8a66597, u16 pipenum)
                buf = (void *)urb->transfer_buffer + urb->actual_length;
                urb_len = urb->transfer_buffer_length - urb->actual_length;
        }
-        if (rcv_len < bufsize)
+        bufsize = min(urb_len, (int) td->maxpacket);
-                size = min(rcv_len, urb_len);
+        if (rcv_len <= bufsize) {
-        else
+                size = rcv_len;
-                size = min(bufsize, urb_len);
+        } else {
+                size = bufsize;
+                status = -EOVERFLOW;
+                finish = 1;
+        }
        /* update parameters */
        urb->actual_length += size;
        if (rcv_len == 0)
                td->zero_packet = 1;
-        if ((size % td->maxpacket) > 0) {
+        if (rcv_len < bufsize) {
                td->short_packet = 1;
-                if (urb->transfer_buffer_length != urb->actual_length &&
-                    urb->transfer_flags & URB_SHORT_NOT_OK)
-                        td->urb->status = -EREMOTEIO;
        }
        if (usb_pipeisoc(urb->pipe)) {
                urb->iso_frame_desc[td->iso_cnt].actual_length = size;
-                urb->iso_frame_desc[td->iso_cnt].status = 0;
+                urb->iso_frame_desc[td->iso_cnt].status = status;
                td->iso_cnt++;
+                finish = 0;
        }
        /* check transfer finish */
-        if (check_transfer_finish(td, urb)) {
+        if (finish || check_transfer_finish(td, urb)) {
                pipe_stop(r8a66597, td->pipe);
                pipe_irq_disable(r8a66597, pipenum);
                finish = 1;
@@ -1224,11 +1231,8 @@ static void packet_read(struct r8a66597 *r8a66597, u16 pipenum)
                                           buf, size);
        }
-        if (finish && pipenum != 0) {
+        if (finish && pipenum != 0)
-                if (td->urb->status == -EINPROGRESS)
+                finish_request(r8a66597, td, pipenum, urb, status);
-                        td->urb->status = 0;
-                finish_request(r8a66597, td, pipenum, urb);
-        }
 }
 static void packet_write(struct r8a66597 *r8a66597, u16 pipenum)
@@ -1246,11 +1250,10 @@ static void packet_write(struct r8a66597 *r8a66597, u16 pipenum)
        fifo_change_from_pipe(r8a66597, td->pipe);
        tmp = r8a66597_read(r8a66597, td->pipe->fifoctr);
        if (unlikely((tmp & FRDY) == 0)) {
-                urb->status = -EPIPE;
                pipe_stop(r8a66597, td->pipe);
                pipe_irq_disable(r8a66597, pipenum);
                err("out write fifo not ready. (%d)", pipenum);
-                finish_request(r8a66597, td, pipenum, td->urb);
+                finish_request(r8a66597, td, pipenum, urb, -EPIPE);
                return;
        }
@@ -1269,7 +1272,7 @@ static void packet_write(struct r8a66597 *r8a66597, u16 pipenum)
        /* write fifo */
        if (pipenum > 0)
-                r8a66597_write(r8a66597, (u16)~(1 << pipenum), BEMPSTS);
+                r8a66597_write(r8a66597, ~(1 << pipenum), BEMPSTS);
        if (urb->transfer_buffer) {
                r8a66597_write_fifo(r8a66597, td->pipe->fifoaddr, buf, size);
                if (!usb_pipebulk(urb->pipe) || td->maxpacket != size)
@@ -1295,7 +1298,7 @@ static void packet_write(struct r8a66597 *r8a66597, u16 pipenum)
 }
-static void check_next_phase(struct r8a66597 *r8a66597)
+static void check_next_phase(struct r8a66597 *r8a66597, int status)
 {
        struct r8a66597_td *td = r8a66597_get_td(r8a66597, 0);
        struct urb *urb;
@@ -1308,49 +1311,41 @@ static void check_next_phase(struct r8a66597 *r8a66597)
        switch (td->type) {
        case USB_PID_IN:
        case USB_PID_OUT:
-                if (urb->status != -EINPROGRESS) {
-                        finish = 1;
-                        break;
-                }
                if (check_transfer_finish(td, urb))
                        td->type = USB_PID_ACK;
                break;
        case USB_PID_SETUP:
-                if (urb->status != -EINPROGRESS)
+                if (urb->transfer_buffer_length == urb->actual_length)
-                        finish = 1;
-                else if (urb->transfer_buffer_length == urb->actual_length) {
                        td->type = USB_PID_ACK;
-                        urb->status = 0;
+                else if (usb_pipeout(urb->pipe))
-                } else if (usb_pipeout(urb->pipe))
                        td->type = USB_PID_OUT;
                else
                        td->type = USB_PID_IN;
                break;
        case USB_PID_ACK:
                finish = 1;
-                if (urb->status == -EINPROGRESS)
-                        urb->status = 0;
                break;
        }
-        if (finish)
+        if (finish || status != 0 || urb->unlinked)
-                finish_request(r8a66597, td, 0, urb);
+                finish_request(r8a66597, td, 0, urb, status);
        else
                start_transfer(r8a66597, td);
 }
-static void set_urb_error(struct r8a66597 *r8a66597, u16 pipenum)
+static int get_urb_error(struct r8a66597 *r8a66597, u16 pipenum)
 {
        struct r8a66597_td *td = r8a66597_get_td(r8a66597, pipenum);
-        if (td && td->urb) {
+        if (td) {
                u16 pid = r8a66597_read(r8a66597, td->pipe->pipectr) & PID;
                if (pid == PID_NAK)
-                        td->urb->status = -ECONNRESET;
+                        return -ECONNRESET;
                else
-                        td->urb->status = -EPIPE;
+                        return -EPIPE;
        }
+        return 0;
 }
 static void irq_pipe_ready(struct r8a66597 *r8a66597)
@@ -1362,14 +1357,14 @@ static void irq_pipe_ready(struct r8a66597 *r8a66597)
        mask = r8a66597_read(r8a66597, BRDYSTS)
               & r8a66597_read(r8a66597, BRDYENB);
-        r8a66597_write(r8a66597, (u16)~mask, BRDYSTS);
+        r8a66597_write(r8a66597, ~mask, BRDYSTS);
        if (mask & BRDY0) {
                td = r8a66597_get_td(r8a66597, 0);
                if (td && td->type == USB_PID_IN)
                        packet_read(r8a66597, 0);
                else
                        pipe_irq_disable(r8a66597, 0);
-                check_next_phase(r8a66597);
+                check_next_phase(r8a66597, 0);
        }
        for (pipenum = 1; pipenum < R8A66597_MAX_NUM_PIPE; pipenum++) {
@@ -1397,13 +1392,13 @@ static void irq_pipe_empty(struct r8a66597 *r8a66597)
        mask = r8a66597_read(r8a66597, BEMPSTS)
               & r8a66597_read(r8a66597, BEMPENB);
-        r8a66597_write(r8a66597, (u16)~mask, BEMPSTS);
+        r8a66597_write(r8a66597, ~mask, BEMPSTS);
        if (mask & BEMP0) {
                cfifo_change(r8a66597, 0);
                td = r8a66597_get_td(r8a66597, 0);
                if (td && td->type != USB_PID_OUT)
                        disable_irq_empty(r8a66597, 0);
-                check_next_phase(r8a66597);
+                check_next_phase(r8a66597, 0);
        }
        for (pipenum = 1; pipenum < R8A66597_MAX_NUM_PIPE; pipenum++) {
@@ -1418,9 +1413,8 @@ static void irq_pipe_empty(struct r8a66597 *r8a66597)
                        if ((tmp & INBUFM) == 0) {
                                disable_irq_empty(r8a66597, pipenum);
                                pipe_irq_disable(r8a66597, pipenum);
-                                if (td->urb->status == -EINPROGRESS)
+                                finish_request(r8a66597, td, pipenum, td->urb,
-                                        td->urb->status = 0;
+                                                0);
-                                finish_request(r8a66597, td, pipenum, td->urb);
                        }
                }
        }
@@ -1431,15 +1425,16 @@ static void irq_pipe_nrdy(struct r8a66597 *r8a66597)
        u16 check;
        u16 pipenum;
        u16 mask;
+        int status;
        mask = r8a66597_read(r8a66597, NRDYSTS)
               & r8a66597_read(r8a66597, NRDYENB);
-        r8a66597_write(r8a66597, (u16)~mask, NRDYSTS);
+        r8a66597_write(r8a66597, ~mask, NRDYSTS);
        if (mask & NRDY0) {
                cfifo_change(r8a66597, 0);
-                set_urb_error(r8a66597, 0);
+                status = get_urb_error(r8a66597, 0);
                pipe_irq_disable(r8a66597, 0);
-                check_next_phase(r8a66597);
+                check_next_phase(r8a66597, status);
        }
        for (pipenum = 1; pipenum < R8A66597_MAX_NUM_PIPE; pipenum++) {
@@ -1450,10 +1445,10 @@ static void irq_pipe_nrdy(struct r8a66597 *r8a66597)
                        if (unlikely(!td))
                                continue;
-                        set_urb_error(r8a66597, pipenum);
+                        status = get_urb_error(r8a66597, pipenum);
                        pipe_irq_disable(r8a66597, pipenum);
                        pipe_stop(r8a66597, td->pipe);
-                        finish_request(r8a66597, td, pipenum, td->urb);
+                        finish_request(r8a66597, td, pipenum, td->urb, status);
                }
        }
 }
@@ -1473,6 +1468,7 @@ static irqreturn_t r8a66597_irq(struct usb_hcd *hcd)
        u16 intsts0, intsts1, intsts2;
        u16 intenb0, intenb1, intenb2;
        u16 mask0, mask1, mask2;
+        int status;
        spin_lock(&r8a66597->lock);
@@ -1488,14 +1484,14 @@ static irqreturn_t r8a66597_irq(struct usb_hcd *hcd)
        mask0 = intsts0 & intenb0 & (BEMP | NRDY | BRDY);
        if (mask2) {
                if (mask2 & ATTCH) {
-                        r8a66597_write(r8a66597, (u16)~ATTCH, INTSTS2);
+                        r8a66597_write(r8a66597, ~ATTCH, INTSTS2);
                        r8a66597_bclr(r8a66597, ATTCHE, INTENB2);
                        /* start usb bus sampling */
                        start_root_hub_sampling(r8a66597, 1);
                }
                if (mask2 & DTCH) {
-                        r8a66597_write(r8a66597, (u16)~DTCH, INTSTS2);
+                        r8a66597_write(r8a66597, ~DTCH, INTSTS2);
                        r8a66597_bclr(r8a66597, DTCHE, INTENB2);
                        r8a66597_usb_disconnect(r8a66597, 1);
                }
@@ -1503,25 +1499,25 @@ static irqreturn_t r8a66597_irq(struct usb_hcd *hcd)
        if (mask1) {
                if (mask1 & ATTCH) {
-                        r8a66597_write(r8a66597, (u16)~ATTCH, INTSTS1);
+                        r8a66597_write(r8a66597, ~ATTCH, INTSTS1);
                        r8a66597_bclr(r8a66597, ATTCHE, INTENB1);
                        /* start usb bus sampling */
                        start_root_hub_sampling(r8a66597, 0);
                }
                if (mask1 & DTCH) {
-                        r8a66597_write(r8a66597, (u16)~DTCH, INTSTS1);
+                        r8a66597_write(r8a66597, ~DTCH, INTSTS1);
                        r8a66597_bclr(r8a66597, DTCHE, INTENB1);
                        r8a66597_usb_disconnect(r8a66597, 0);
                }
                if (mask1 & SIGN) {
-                        r8a66597_write(r8a66597, (u16)~SIGN, INTSTS1);
+                        r8a66597_write(r8a66597, ~SIGN, INTSTS1);
-                        set_urb_error(r8a66597, 0);
+                        status = get_urb_error(r8a66597, 0);
-                        check_next_phase(r8a66597);
+                        check_next_phase(r8a66597, status);
                }
                if (mask1 & SACK) {
-                        r8a66597_write(r8a66597, (u16)~SACK, INTSTS1);
+                        r8a66597_write(r8a66597, ~SACK, INTSTS1);
-                        check_next_phase(r8a66597);
+                        check_next_phase(r8a66597, 0);
                }
        }
        if (mask0) {
@@ -1663,13 +1659,9 @@ static int check_pipe_config(struct r8a66597 *r8a66597, struct urb *urb)
 static int r8a66597_start(struct usb_hcd *hcd)
 {
        struct r8a66597 *r8a66597 = hcd_to_r8a66597(hcd);
-        int ret;
        hcd->state = HC_STATE_RUNNING;
-        if ((ret = enable_controller(r8a66597)) < 0)
+        return enable_controller(r8a66597);
-                return ret;
-        return 0;
 }
 static void r8a66597_stop(struct usb_hcd *hcd)
@@ -1696,13 +1688,12 @@ static void set_address_zero(struct r8a66597 *r8a66597, struct urb *urb)
 static struct r8a66597_td *r8a66597_make_td(struct r8a66597 *r8a66597,
                                            struct urb *urb,
-                                            struct usb_host_endpoint *hep,
+                                            struct usb_host_endpoint *hep)
-                                            gfp_t mem_flags)
 {
        struct r8a66597_td *td;
        u16 pipenum;
-        td = kzalloc(sizeof(struct r8a66597_td), mem_flags);
+        td = kzalloc(sizeof(struct r8a66597_td), GFP_ATOMIC);
        if (td == NULL)
                return NULL;
@@ -1725,23 +1716,28 @@ static struct r8a66597_td *r8a66597_make_td(struct r8a66597 *r8a66597,
 }
 static int r8a66597_urb_enqueue(struct usb_hcd *hcd,
-                                struct usb_host_endpoint *hep,
                                struct urb *urb,
                                gfp_t mem_flags)
 {
+        struct usb_host_endpoint *hep = urb->ep;
        struct r8a66597 *r8a66597 = hcd_to_r8a66597(hcd);
        struct r8a66597_td *td = NULL;
-        int ret = 0, request = 0;
+        int ret, request = 0;
        unsigned long flags;
        spin_lock_irqsave(&r8a66597->lock, flags);
        if (!get_urb_to_r8a66597_dev(r8a66597, urb)) {
                ret = -ENODEV;
-                goto error;
+                goto error_not_linked;
        }
+        ret = usb_hcd_link_urb_to_ep(hcd, urb);
+        if (ret)
+                goto error_not_linked;
        if (!hep->hcpriv) {
-                hep->hcpriv = kzalloc(sizeof(struct r8a66597_pipe), mem_flags);
+                hep->hcpriv = kzalloc(sizeof(struct r8a66597_pipe),
+                                GFP_ATOMIC);
                if (!hep->hcpriv) {
                        ret = -ENOMEM;
                        goto error;
@@ -1755,7 +1751,7 @@ static int r8a66597_urb_enqueue(struct usb_hcd *hcd,
                init_pipe_config(r8a66597, urb);
        set_address_zero(r8a66597, urb);
-        td = r8a66597_make_td(r8a66597, urb, hep, mem_flags);
+        td = r8a66597_make_td(r8a66597, urb, hep);
        if (td == NULL) {
                ret = -ENOMEM;
                goto error;
@@ -1763,15 +1759,7 @@ static int r8a66597_urb_enqueue(struct usb_hcd *hcd,
        if (list_empty(&r8a66597->pipe_queue[td->pipenum]))
                request = 1;
        list_add_tail(&td->queue, &r8a66597->pipe_queue[td->pipenum]);
-        spin_lock(&urb->lock);
-        if (urb->status != -EINPROGRESS) {
-                spin_unlock(&urb->lock);
-                ret = -EPIPE;
-                goto error;
-        }
        urb->hcpriv = td;
-        spin_unlock(&urb->lock);
        if (request) {
                ret = start_transfer(r8a66597, td);
@@ -1783,26 +1771,36 @@ static int r8a66597_urb_enqueue(struct usb_hcd *hcd,
                set_td_timer(r8a66597, td);
 error:
+        if (ret)
+                usb_hcd_unlink_urb_from_ep(hcd, urb);
+error_not_linked:
        spin_unlock_irqrestore(&r8a66597->lock, flags);
        return ret;
 }
-static int r8a66597_urb_dequeue(struct usb_hcd *hcd, struct urb *urb)
+static int r8a66597_urb_dequeue(struct usb_hcd *hcd, struct urb *urb,
+                int status)
 {
        struct r8a66597 *r8a66597 = hcd_to_r8a66597(hcd);
        struct r8a66597_td *td;
        unsigned long flags;
+        int rc;
        spin_lock_irqsave(&r8a66597->lock, flags);
+        rc = usb_hcd_check_unlink_urb(hcd, urb, status);
+        if (rc)
+                goto done;
        if (urb->hcpriv) {
                td = urb->hcpriv;
                pipe_stop(r8a66597, td->pipe);
                pipe_irq_disable(r8a66597, td->pipenum);
                disable_irq_empty(r8a66597, td->pipenum);
-                done(r8a66597, td, td->pipenum, urb);
+                finish_request(r8a66597, td, td->pipenum, urb, status);
        }
+ done:
        spin_unlock_irqrestore(&r8a66597->lock, flags);
-        return 0;
+        return rc;
 }
 static void r8a66597_endpoint_disable(struct usb_hcd *hcd,
@@ -1832,7 +1830,7 @@ static void r8a66597_endpoint_disable(struct usb_hcd *hcd,
        td = r8a66597_get_td(r8a66597, pipenum);
        if (td)
                urb = td->urb;
-        done(r8a66597, td, pipenum, urb);
+        finish_request(r8a66597, td, pipenum, urb, -ESHUTDOWN);
        kfree(hep->hcpriv);
        hep->hcpriv = NULL;
        spin_unlock_irqrestore(&r8a66597->lock, flags);
@@ -2029,7 +2027,7 @@ static int r8a66597_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
        case GetPortStatus:
                if (wIndex > R8A66597_MAX_ROOT_HUB)
                        goto error;
-                *(u32 *)buf = rh->port;
+                *(u32 *)buf = cpu_to_le32(rh->port);
                break;
        case SetPortFeature:
                if (wIndex > R8A66597_MAX_ROOT_HUB)
@@ -2128,8 +2126,8 @@ static int __init_or_module r8a66597_remove(struct platform_device *pdev)
        struct usb_hcd          *hcd = r8a66597_to_hcd(r8a66597);
        del_timer_sync(&r8a66597->rh_timer);
-        iounmap((void *)r8a66597->reg);
        usb_remove_hcd(hcd);
+        iounmap((void *)r8a66597->reg);
        usb_put_hcd(hcd);
        return 0;
 }
@@ -2210,8 +2208,6 @@ static int __init r8a66597_probe(struct platform_device *pdev)
 clean_up:
        if (reg)
                iounmap(reg);
-        if (res)
-                release_mem_region(res->start, 1);
        return ret;
 }
diff --git a/drivers/usb/host/r8a66597.h b/drivers/usb/host/r8a66597.h
index 97c2a71ac7a..fe9ceb077d9 100644
--- a/drivers/usb/host/r8a66597.h
+++ b/drivers/usb/host/r8a66597.h
@@ -203,14 +203,14 @@
 #define DTLN            0x0FFF  /* b11-0: FIFO received data length */
 /* Interrupt Enable Register 0 */
-#define VBSE            0x8000  /* b15: VBUS interrupt */
+#define VBSE    0x8000  /* b15: VBUS interrupt */
-#define RSME            0x4000  /* b14: Resume interrupt */
+#define RSME    0x4000  /* b14: Resume interrupt */
-#define SOFE            0x2000  /* b13: Frame update interrupt */
+#define SOFE    0x2000  /* b13: Frame update interrupt */
-#define DVSE            0x1000  /* b12: Device state transition interrupt */
+#define DVSE    0x1000  /* b12: Device state transition interrupt */
-#define CTRE            0x0800  /* b11: Control transfer stage transition interrupt */
+#define CTRE    0x0800  /* b11: Control transfer stage transition interrupt */
-#define BEMPE           0x0400  /* b10: Buffer empty interrupt */
+#define BEMPE   0x0400  /* b10: Buffer empty interrupt */
-#define NRDYE           0x0200  /* b9: Buffer not ready interrupt */
+#define NRDYE   0x0200  /* b9: Buffer not ready interrupt */
-#define BRDYE           0x0100  /* b8: Buffer ready interrupt */
+#define BRDYE   0x0100  /* b8: Buffer ready interrupt */
 /* Interrupt Enable Register 1 */
 #define OVRCRE          0x8000  /* b15: Over-current interrupt */
@@ -268,16 +268,16 @@
 #define   SOF_DISABLE    0x0000   /* SOF OUT Disable */
 /* Interrupt Status Register 0 */
-#define VBINT           0x8000  /* b15: VBUS interrupt */
+#define VBINT   0x8000  /* b15: VBUS interrupt */
-#define RESM            0x4000  /* b14: Resume interrupt */
+#define RESM    0x4000  /* b14: Resume interrupt */
-#define SOFR            0x2000  /* b13: SOF frame update interrupt */
+#define SOFR    0x2000  /* b13: SOF frame update interrupt */
-#define DVST            0x1000  /* b12: Device state transition interrupt */
+#define DVST    0x1000  /* b12: Device state transition interrupt */
-#define CTRT            0x0800  /* b11: Control transfer stage transition interrupt */
+#define CTRT    0x0800  /* b11: Control transfer stage transition interrupt */
-#define BEMP            0x0400  /* b10: Buffer empty interrupt */
+#define BEMP    0x0400  /* b10: Buffer empty interrupt */
-#define NRDY            0x0200  /* b9: Buffer not ready interrupt */
+#define NRDY    0x0200  /* b9: Buffer not ready interrupt */
-#define BRDY            0x0100  /* b8: Buffer ready interrupt */
+#define BRDY    0x0100  /* b8: Buffer ready interrupt */
-#define VBSTS           0x0080  /* b7: VBUS input port */
+#define VBSTS   0x0080  /* b7: VBUS input port */
-#define DVSQ            0x0070  /* b6-4: Device state */
+#define DVSQ    0x0070  /* b6-4: Device state */
 #define   DS_SPD_CNFG    0x0070   /* Suspend Configured */
 #define   DS_SPD_ADDR    0x0060   /* Suspend Address */
 #define   DS_SPD_DFLT    0x0050   /* Suspend Default */
@@ -315,13 +315,10 @@
 /* Micro Frame Number Register */
 #define UFRNM           0x0007  /* b2-0: Micro frame number */
-/* USB Address / Low Power Status Recovery Register */
-//#define       USBADDR         0x007F  /* b6-0: USB address */
 /* Default Control Pipe Maxpacket Size Register */
 /* Pipe Maxpacket Size Register */
-#define DEVSEL          0xF000  /* b15-14: Device address select */
+#define DEVSEL  0xF000  /* b15-14: Device address select */
-#define MAXP            0x007F  /* b6-0: Maxpacket size of default control pipe */
+#define MAXP    0x007F  /* b6-0: Maxpacket size of default control pipe */
 /* Default Control Pipe Control Register */
 #define BSTS            0x8000  /* b15: Buffer status */
@@ -366,21 +363,21 @@
 #define MXPS            0x07FF  /* b10-0: Maxpacket size */
 /* Pipe Cycle Configuration Register */
-#define IFIS            0x1000  /* b12: Isochronous in-buffer flush mode select */
+#define IFIS    0x1000  /* b12: Isochronous in-buffer flush mode select */
-#define IITV            0x0007  /* b2-0: Isochronous interval */
+#define IITV    0x0007  /* b2-0: Isochronous interval */
 /* Pipex Control Register */
-#define BSTS            0x8000  /* b15: Buffer status */
+#define BSTS    0x8000  /* b15: Buffer status */
-#define INBUFM          0x4000  /* b14: IN buffer monitor (Only for PIPE1 to 5) */
+#define INBUFM  0x4000  /* b14: IN buffer monitor (Only for PIPE1 to 5) */
-#define CSCLR           0x2000  /* b13: complete-split status clear */
+#define CSCLR   0x2000  /* b13: complete-split status clear */
-#define CSSTS           0x1000  /* b12: complete-split status */
+#define CSSTS   0x1000  /* b12: complete-split status */
-#define ATREPM          0x0400  /* b10: Auto repeat mode */
+#define ATREPM  0x0400  /* b10: Auto repeat mode */
-#define ACLRM           0x0200  /* b9: Out buffer auto clear mode */
+#define ACLRM   0x0200  /* b9: Out buffer auto clear mode */
-#define SQCLR           0x0100  /* b8: Sequence toggle bit clear */
+#define SQCLR   0x0100  /* b8: Sequence toggle bit clear */
-#define SQSET           0x0080  /* b7: Sequence toggle bit set */
+#define SQSET   0x0080  /* b7: Sequence toggle bit set */
-#define SQMON           0x0040  /* b6: Sequence toggle bit monitor */
+#define SQMON   0x0040  /* b6: Sequence toggle bit monitor */
-#define PBUSY           0x0020  /* b5: pipe busy */
+#define PBUSY   0x0020  /* b5: pipe busy */
-#define PID             0x0003  /* b1-0: Response PID */
+#define PID     0x0003  /* b1-0: Response PID */
 /* PIPExTRE */
 #define TRENB           0x0200  /* b9: Transaction counter enable */
@@ -407,15 +404,15 @@
 #define make_devsel(addr)               (addr << 12)
 struct r8a66597_pipe_info {
-        u16 pipenum;
+        u16 pipenum;
-        u16 address;    /* R8A66597 HCD usb addres */
+        u16 address;    /* R8A66597 HCD usb addres */
-        u16 epnum;
+        u16 epnum;
-        u16 maxpacket;
+        u16 maxpacket;
-        u16 type;
+        u16 type;
-        u16 bufnum;
+        u16 bufnum;
-        u16 buf_bsize;
+        u16 buf_bsize;
-        u16 interval;
+        u16 interval;
-        u16 dir_in;
+        u16 dir_in;
 };
 struct r8a66597_pipe {
diff --git a/drivers/usb/host/sl811-hcd.c b/drivers/usb/host/sl811-hcd.c
index 4cfa3ff2c99..94d859aa73f 100644
--- a/drivers/usb/host/sl811-hcd.c
+++ b/drivers/usb/host/sl811-hcd.c
@@ -435,14 +435,9 @@ static void finish_request(
        if (usb_pipecontrol(urb->pipe))
                ep->nextpid = USB_PID_SETUP;
-        spin_lock(&urb->lock);
+        usb_hcd_unlink_urb_from_ep(sl811_to_hcd(sl811), urb);
-        if (urb->status == -EINPROGRESS)
-                urb->status = status;
-        urb->hcpriv = NULL;
-        spin_unlock(&urb->lock);
        spin_unlock(&sl811->lock);
-        usb_hcd_giveback_urb(sl811_to_hcd(sl811), urb);
+        usb_hcd_giveback_urb(sl811_to_hcd(sl811), urb, status);
        spin_lock(&sl811->lock);
        /* leave active endpoints in the schedule */
@@ -538,35 +533,21 @@ done(struct sl811 *sl811, struct sl811h_ep *ep, u8 bank)
                                                bank + SL11H_XFERCNTREG);
                        if (len > ep->length) {
                                len = ep->length;
-                                urb->status = -EOVERFLOW;
+                                urbstat = -EOVERFLOW;
                        }
                        urb->actual_length += len;
                        sl811_read_buf(sl811, SL811HS_PACKET_BUF(bank == 0),
                                        buf, len);
                        usb_dotoggle(udev, ep->epnum, 0);
-                        if (urb->actual_length == urb->transfer_buffer_length)
+                        if (urbstat == -EINPROGRESS &&
-                                urbstat = 0;
+                                        (len < ep->maxpacket ||
-                        else if (len < ep->maxpacket) {
+                                                urb->actual_length ==
-                                if (urb->transfer_flags & URB_SHORT_NOT_OK)
+                                                urb->transfer_buffer_length)) {
-                                        urbstat = -EREMOTEIO;
+                                if (usb_pipecontrol(urb->pipe))
+                                        ep->nextpid = USB_PID_ACK;
                                else
                                        urbstat = 0;
                        }
-                        if (usb_pipecontrol(urb->pipe)
-                                        && (urbstat == -EREMOTEIO
-                                                || urbstat == 0)) {
-                                /* NOTE if the status stage STALLs (why?),
-                                 * this reports the wrong urb status.
-                                 */
-                                spin_lock(&urb->lock);
-                                if (urb->status == -EINPROGRESS)
-                                        urb->status = urbstat;
-                                spin_unlock(&urb->lock);
-                                urb = NULL;
-                                ep->nextpid = USB_PID_ACK;
-                        }
                        break;
                case USB_PID_SETUP:
                        // PACKET("...ACK/setup_%02x qh%p\n", bank, ep);
@@ -605,7 +586,7 @@ done(struct sl811 *sl811, struct sl811h_ep *ep, u8 bank)
                                bank, status, ep, urbstat);
        }
-        if (urb && (urbstat != -EINPROGRESS || urb->status != -EINPROGRESS))
+        if (urbstat != -EINPROGRESS || urb->unlinked)
                finish_request(sl811, ep, urb, urbstat);
 }
@@ -807,7 +788,6 @@ static int balance(struct sl811 *sl811, u16 period, u16 load)
 static int sl811h_urb_enqueue(
        struct usb_hcd          *hcd,
-        struct usb_host_endpoint *hep,
        struct urb              *urb,
        gfp_t                   mem_flags
 ) {
@@ -820,7 +800,8 @@ static int sl811h_urb_enqueue(
        struct sl811h_ep        *ep = NULL;
        unsigned long           flags;
        int                     i;
-        int                     retval = 0;
+        int                     retval;
+        struct usb_host_endpoint        *hep = urb->ep;
 #ifdef  DISABLE_ISO
        if (type == PIPE_ISOCHRONOUS)
@@ -838,7 +819,12 @@ static int sl811h_urb_enqueue(
                        || !HC_IS_RUNNING(hcd->state)) {
                retval = -ENODEV;
                kfree(ep);
-                goto fail;
+                goto fail_not_linked;
+        }
+        retval = usb_hcd_link_urb_to_ep(hcd, urb);
+        if (retval) {
+                kfree(ep);
+                goto fail_not_linked;
        }
        if (hep->hcpriv) {
@@ -951,37 +937,31 @@ static int sl811h_urb_enqueue(
                sofirq_on(sl811);
        }
-        /* in case of unlink-during-submit */
-        spin_lock(&urb->lock);
-        if (urb->status != -EINPROGRESS) {
-                spin_unlock(&urb->lock);
-                finish_request(sl811, ep, urb, 0);
-                retval = 0;
-                goto fail;
-        }
        urb->hcpriv = hep;
-        spin_unlock(&urb->lock);
        start_transfer(sl811);
        sl811_write(sl811, SL11H_IRQ_ENABLE, sl811->irq_enable);
 fail:
+        if (retval)
+                usb_hcd_unlink_urb_from_ep(hcd, urb);
+fail_not_linked:
        spin_unlock_irqrestore(&sl811->lock, flags);
        return retval;
 }
-static int sl811h_urb_dequeue(struct usb_hcd *hcd, struct urb *urb)
+static int sl811h_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status)
 {
        struct sl811            *sl811 = hcd_to_sl811(hcd);
        struct usb_host_endpoint *hep;
        unsigned long           flags;
        struct sl811h_ep        *ep;
-        int                     retval = 0;
+        int                     retval;
        spin_lock_irqsave(&sl811->lock, flags);
-        hep = urb->hcpriv;
+        retval = usb_hcd_check_unlink_urb(hcd, urb, status);
-        if (!hep)
+        if (retval)
                goto fail;
+        hep = urb->hcpriv;
        ep = hep->hcpriv;
        if (ep) {
                /* finish right away if this urb can't be active ...
@@ -1029,8 +1009,8 @@ static int sl811h_urb_dequeue(struct usb_hcd *hcd, struct urb *urb)
                        VDBG("dequeue, urb %p active %s; wait4irq\n", urb,
                                (sl811->active_a == ep) ? "A" : "B");
        } else
-fail:
                retval = -EINVAL;
+ fail:
        spin_unlock_irqrestore(&sl811->lock, flags);
        return retval;
 }
diff --git a/drivers/usb/host/sl811_cs.c b/drivers/usb/host/sl811_cs.c
index 2d0e73b2009..5da63f53500 100644
--- a/drivers/usb/host/sl811_cs.c
+++ b/drivers/usb/host/sl811_cs.c
@@ -278,10 +278,9 @@ static int sl811_cs_probe(struct pcmcia_device *link)
 {
        local_info_t *local;
-        local = kmalloc(sizeof(local_info_t), GFP_KERNEL);
+        local = kzalloc(sizeof(local_info_t), GFP_KERNEL);
        if (!local)
                return -ENOMEM;
-        memset(local, 0, sizeof(local_info_t));
        local->p_dev = link;
        link->priv = local;
diff --git a/drivers/usb/host/u132-hcd.c b/drivers/usb/host/u132-hcd.c
index e98df2ee990..ac283b09a63 100644
--- a/drivers/usb/host/u132-hcd.c
+++ b/drivers/usb/host/u132-hcd.c
@@ -51,7 +51,7 @@
 #include <linux/usb.h>
 #include <linux/workqueue.h>
 #include <linux/platform_device.h>
-#include <linux/pci_ids.h>
+#include <linux/mutex.h>
 #include <asm/io.h>
 #include <asm/irq.h>
 #include <asm/system.h>
@@ -83,7 +83,7 @@ static DECLARE_WAIT_QUEUE_HEAD(u132_hcd_wait);
 * u132_module_lock exists to protect access to global variables
 *
 */
-static struct semaphore u132_module_lock;
+static struct mutex u132_module_lock;
 static int u132_exiting = 0;
 static int u132_instances = 0;
 static struct list_head u132_static_list;
@@ -183,7 +183,7 @@ struct u132_ring {
 struct u132 {
        struct kref kref;
        struct list_head u132_list;
-        struct semaphore sw_lock;
+        struct mutex sw_lock;
        struct semaphore scheduler_lock;
        struct u132_platform_data *board;
        struct platform_device *platform_dev;
@@ -258,10 +258,10 @@ static void u132_hcd_delete(struct kref *kref)
        struct platform_device *pdev = u132->platform_dev;
        struct usb_hcd *hcd = u132_to_hcd(u132);
        u132->going += 1;
-        down(&u132_module_lock);
+        mutex_lock(&u132_module_lock);
        list_del_init(&u132->u132_list);
        u132_instances -= 1;
-        up(&u132_module_lock);
+        mutex_unlock(&u132_module_lock);
        dev_warn(&u132->platform_dev->dev, "FREEING the hcd=%p and thus the u13"
                "2=%p going=%d pdev=%p\n", hcd, u132, u132->going, pdev);
        usb_put_hcd(hcd);
@@ -492,20 +492,20 @@ static void u132_hcd_monitor_work(struct work_struct *work)
                return;
        } else {
                int retval;
-                down(&u132->sw_lock);
+                mutex_lock(&u132->sw_lock);
                retval = read_roothub_info(u132);
                if (retval) {
                        struct usb_hcd *hcd = u132_to_hcd(u132);
                        u132_disable(u132);
                        u132->going = 1;
-                        up(&u132->sw_lock);
+                        mutex_unlock(&u132->sw_lock);
                        usb_hc_died(hcd);
                        ftdi_elan_gone_away(u132->platform_dev);
                        u132_monitor_put_kref(u132);
                        return;
                } else {
                        u132_monitor_requeue_work(u132, 500);
-                        up(&u132->sw_lock);
+                        mutex_unlock(&u132->sw_lock);
                        return;
                }
        }
@@ -518,9 +518,8 @@ static void u132_hcd_giveback_urb(struct u132 *u132, struct u132_endp *endp,
        unsigned long irqs;
        struct usb_hcd *hcd = u132_to_hcd(u132);
        urb->error_count = 0;
-        urb->status = status;
-        urb->hcpriv = NULL;
        spin_lock_irqsave(&endp->queue_lock.slock, irqs);
+        usb_hcd_unlink_urb_from_ep(hcd, urb);
        endp->queue_next += 1;
        if (ENDP_QUEUE_SIZE > --endp->queue_size) {
                endp->active = 0;
@@ -542,7 +541,7 @@ static void u132_hcd_giveback_urb(struct u132 *u132, struct u132_endp *endp,
        u132_ring_queue_work(u132, ring, 0);
        up(&u132->scheduler_lock);
        u132_endp_put_kref(u132, endp);
-        usb_hcd_giveback_urb(hcd, urb);
+        usb_hcd_giveback_urb(hcd, urb, status);
        return;
 }
@@ -558,9 +557,8 @@ static void u132_hcd_abandon_urb(struct u132 *u132, struct u132_endp *endp,
        unsigned long irqs;
        struct usb_hcd *hcd = u132_to_hcd(u132);
        urb->error_count = 0;
-        urb->status = status;
-        urb->hcpriv = NULL;
        spin_lock_irqsave(&endp->queue_lock.slock, irqs);
+        usb_hcd_unlink_urb_from_ep(hcd, urb);
        endp->queue_next += 1;
        if (ENDP_QUEUE_SIZE > --endp->queue_size) {
                endp->active = 0;
@@ -575,7 +573,7 @@ static void u132_hcd_abandon_urb(struct u132 *u132, struct u132_endp *endp,
                endp->active = 0;
                spin_unlock_irqrestore(&endp->queue_lock.slock, irqs);
                kfree(urbq);
-        } usb_hcd_giveback_urb(hcd, urb);
+        } usb_hcd_giveback_urb(hcd, urb, status);
        return;
 }
@@ -645,12 +643,12 @@ static void u132_hcd_interrupt_recv(void *data, struct urb *urb, u8 *buf,
                u132_hcd_giveback_urb(u132, endp, urb, -EINTR);
                return;
        } else if (u132->going > 0) {
-                dev_err(&u132->platform_dev->dev, "device is being removed urb="
+                dev_err(&u132->platform_dev->dev, "device is being removed "
-                        "%p status=%d\n", urb, urb->status);
+                                "urb=%p\n", urb);
                up(&u132->scheduler_lock);
                u132_hcd_giveback_urb(u132, endp, urb, -ENODEV);
                return;
-        } else if (urb->status == -EINPROGRESS) {
+        } else if (!urb->unlinked) {
                struct u132_ring *ring = endp->ring;
                u8 *u = urb->transfer_buffer + urb->actual_length;
                u8 *b = buf;
@@ -716,10 +714,10 @@ static void u132_hcd_interrupt_recv(void *data, struct urb *urb, u8 *buf,
                        return;
                }
        } else {
-                dev_err(&u132->platform_dev->dev, "CALLBACK called urb=%p statu"
+                dev_err(&u132->platform_dev->dev, "CALLBACK called urb=%p "
-                        "s=%d\n", urb, urb->status);
+                                "unlinked=%d\n", urb, urb->unlinked);
                up(&u132->scheduler_lock);
-                u132_hcd_giveback_urb(u132, endp, urb, urb->status);
+                u132_hcd_giveback_urb(u132, endp, urb, 0);
                return;
        }
 }
@@ -744,12 +742,12 @@ static void u132_hcd_bulk_output_sent(void *data, struct urb *urb, u8 *buf,
                u132_hcd_giveback_urb(u132, endp, urb, -EINTR);
                return;
        } else if (u132->going > 0) {
-                dev_err(&u132->platform_dev->dev, "device is being removed urb="
+                dev_err(&u132->platform_dev->dev, "device is being removed "
-                        "%p status=%d\n", urb, urb->status);
+                                "urb=%p\n", urb);
                up(&u132->scheduler_lock);
                u132_hcd_giveback_urb(u132, endp, urb, -ENODEV);
                return;
-        } else if (urb->status == -EINPROGRESS) {
+        } else if (!urb->unlinked) {
                struct u132_ring *ring = endp->ring;
                urb->actual_length += len;
                endp->toggle_bits = toggle_bits;
@@ -768,10 +766,10 @@ static void u132_hcd_bulk_output_sent(void *data, struct urb *urb, u8 *buf,
                        return;
                }
        } else {
-                dev_err(&u132->platform_dev->dev, "CALLBACK called urb=%p statu"
+                dev_err(&u132->platform_dev->dev, "CALLBACK called urb=%p "
-                        "s=%d\n", urb, urb->status);
+                                "unlinked=%d\n", urb, urb->unlinked);
                up(&u132->scheduler_lock);
-                u132_hcd_giveback_urb(u132, endp, urb, urb->status);
+                u132_hcd_giveback_urb(u132, endp, urb, 0);
                return;
        }
 }
@@ -797,12 +795,12 @@ static void u132_hcd_bulk_input_recv(void *data, struct urb *urb, u8 *buf,
                u132_hcd_giveback_urb(u132, endp, urb, -EINTR);
                return;
        } else if (u132->going > 0) {
-                dev_err(&u132->platform_dev->dev, "device is being removed urb="
+                dev_err(&u132->platform_dev->dev, "device is being removed "
-                        "%p status=%d\n", urb, urb->status);
+                                "urb=%p\n", urb);
                up(&u132->scheduler_lock);
                u132_hcd_giveback_urb(u132, endp, urb, -ENODEV);
                return;
-        } else if (urb->status == -EINPROGRESS) {
+        } else if (!urb->unlinked) {
                struct u132_ring *ring = endp->ring;
                u8 *u = urb->transfer_buffer + urb->actual_length;
                u8 *b = buf;
@@ -871,10 +869,10 @@ static void u132_hcd_bulk_input_recv(void *data, struct urb *urb, u8 *buf,
                        return;
                }
        } else {
-                dev_err(&u132->platform_dev->dev, "CALLBACK called urb=%p statu"
+                dev_err(&u132->platform_dev->dev, "CALLBACK called urb=%p "
-                        "s=%d\n", urb, urb->status);
+                                "unlinked=%d\n", urb, urb->unlinked);
                up(&u132->scheduler_lock);
-                u132_hcd_giveback_urb(u132, endp, urb, urb->status);
+                u132_hcd_giveback_urb(u132, endp, urb, 0);
                return;
        }
 }
@@ -898,20 +896,20 @@ static void u132_hcd_configure_empty_sent(void *data, struct urb *urb, u8 *buf,
                u132_hcd_giveback_urb(u132, endp, urb, -EINTR);
                return;
        } else if (u132->going > 0) {
-                dev_err(&u132->platform_dev->dev, "device is being removed urb="
+                dev_err(&u132->platform_dev->dev, "device is being removed "
-                        "%p status=%d\n", urb, urb->status);
+                                "urb=%p\n", urb);
                up(&u132->scheduler_lock);
                u132_hcd_giveback_urb(u132, endp, urb, -ENODEV);
                return;
-        } else if (urb->status == -EINPROGRESS) {
+        } else if (!urb->unlinked) {
                up(&u132->scheduler_lock);
                u132_hcd_giveback_urb(u132, endp, urb, 0);
                return;
        } else {
-                dev_err(&u132->platform_dev->dev, "CALLBACK called urb=%p statu"
+                dev_err(&u132->platform_dev->dev, "CALLBACK called urb=%p "
-                        "s=%d\n", urb, urb->status);
+                                "unlinked=%d\n", urb, urb->unlinked);
                up(&u132->scheduler_lock);
-                u132_hcd_giveback_urb(u132, endp, urb, urb->status);
+                u132_hcd_giveback_urb(u132, endp, urb, 0);
                return;
        }
 }
@@ -936,12 +934,12 @@ static void u132_hcd_configure_input_recv(void *data, struct urb *urb, u8 *buf,
                u132_hcd_giveback_urb(u132, endp, urb, -EINTR);
                return;
        } else if (u132->going > 0) {
-                dev_err(&u132->platform_dev->dev, "device is being removed urb="
+                dev_err(&u132->platform_dev->dev, "device is being removed "
-                        "%p status=%d\n", urb, urb->status);
+                                "urb=%p\n", urb);
                up(&u132->scheduler_lock);
                u132_hcd_giveback_urb(u132, endp, urb, -ENODEV);
                return;
-        } else if (urb->status == -EINPROGRESS) {
+        } else if (!urb->unlinked) {
                struct u132_ring *ring = endp->ring;
                u8 *u = urb->transfer_buffer;
                u8 *b = buf;
@@ -980,10 +978,10 @@ static void u132_hcd_configure_input_recv(void *data, struct urb *urb, u8 *buf,
                        return;
                }
        } else {
-                dev_err(&u132->platform_dev->dev, "CALLBACK called urb=%p statu"
+                dev_err(&u132->platform_dev->dev, "CALLBACK called urb=%p "
-                        "s=%d\n", urb, urb->status);
+                                "unlinked=%d\n", urb, urb->unlinked);
                up(&u132->scheduler_lock);
-                u132_hcd_giveback_urb(u132, endp, urb, urb->status);
+                u132_hcd_giveback_urb(u132, endp, urb, 0);
                return;
        }
 }
@@ -1007,20 +1005,20 @@ static void u132_hcd_configure_empty_recv(void *data, struct urb *urb, u8 *buf,
                u132_hcd_giveback_urb(u132, endp, urb, -EINTR);
                return;
        } else if (u132->going > 0) {
-                dev_err(&u132->platform_dev->dev, "device is being removed urb="
+                dev_err(&u132->platform_dev->dev, "device is being removed "
-                        "%p status=%d\n", urb, urb->status);
+                                "urb=%p\n", urb);
                up(&u132->scheduler_lock);
                u132_hcd_giveback_urb(u132, endp, urb, -ENODEV);
                return;
-        } else if (urb->status == -EINPROGRESS) {
+        } else if (!urb->unlinked) {
                up(&u132->scheduler_lock);
                u132_hcd_giveback_urb(u132, endp, urb, 0);
                return;
        } else {
-                dev_err(&u132->platform_dev->dev, "CALLBACK called urb=%p statu"
+                dev_err(&u132->platform_dev->dev, "CALLBACK called urb=%p "
-                        "s=%d\n", urb, urb->status);
+                                "unlinked=%d\n", urb, urb->unlinked);
                up(&u132->scheduler_lock);
-                u132_hcd_giveback_urb(u132, endp, urb, urb->status);
+                u132_hcd_giveback_urb(u132, endp, urb, 0);
                return;
        }
 }
@@ -1045,12 +1043,12 @@ static void u132_hcd_configure_setup_sent(void *data, struct urb *urb, u8 *buf,
                u132_hcd_giveback_urb(u132, endp, urb, -EINTR);
                return;
        } else if (u132->going > 0) {
-                dev_err(&u132->platform_dev->dev, "device is being removed urb="
+                dev_err(&u132->platform_dev->dev, "device is being removed "
-                        "%p status=%d\n", urb, urb->status);
+                                "urb=%p\n", urb);
                up(&u132->scheduler_lock);
                u132_hcd_giveback_urb(u132, endp, urb, -ENODEV);
                return;
-        } else if (urb->status == -EINPROGRESS) {
+        } else if (!urb->unlinked) {
                if (usb_pipein(urb->pipe)) {
                        int retval;
                        struct u132_ring *ring = endp->ring;
@@ -1077,10 +1075,10 @@ static void u132_hcd_configure_setup_sent(void *data, struct urb *urb, u8 *buf,
                        return;
                }
        } else {
-                dev_err(&u132->platform_dev->dev, "CALLBACK called urb=%p statu"
+                dev_err(&u132->platform_dev->dev, "CALLBACK called urb=%p "
-                        "s=%d\n", urb, urb->status);
+                                "unlinked=%d\n", urb, urb->unlinked);
                up(&u132->scheduler_lock);
-                u132_hcd_giveback_urb(u132, endp, urb, urb->status);
+                u132_hcd_giveback_urb(u132, endp, urb, 0);
                return;
        }
 }
@@ -1106,22 +1104,22 @@ static void u132_hcd_enumeration_empty_recv(void *data, struct urb *urb,
                u132_hcd_giveback_urb(u132, endp, urb, -EINTR);
                return;
        } else if (u132->going > 0) {
-                dev_err(&u132->platform_dev->dev, "device is being removed urb="
+                dev_err(&u132->platform_dev->dev, "device is being removed "
-                        "%p status=%d\n", urb, urb->status);
+                                "urb=%p\n", urb);
                up(&u132->scheduler_lock);
                u132_hcd_giveback_urb(u132, endp, urb, -ENODEV);
                return;
-        } else if (urb->status == -EINPROGRESS) {
+        } else if (!urb->unlinked) {
                u132->addr[0].address = 0;
                endp->usb_addr = udev->usb_addr;
                up(&u132->scheduler_lock);
                u132_hcd_giveback_urb(u132, endp, urb, 0);
                return;
        } else {
-                dev_err(&u132->platform_dev->dev, "CALLBACK called urb=%p statu"
+                dev_err(&u132->platform_dev->dev, "CALLBACK called urb=%p "
-                        "s=%d\n", urb, urb->status);
+                                "unlinked=%d\n", urb, urb->unlinked);
                up(&u132->scheduler_lock);
-                u132_hcd_giveback_urb(u132, endp, urb, urb->status);
+                u132_hcd_giveback_urb(u132, endp, urb, 0);
                return;
        }
 }
@@ -1145,12 +1143,12 @@ static void u132_hcd_enumeration_address_sent(void *data, struct urb *urb,
                u132_hcd_giveback_urb(u132, endp, urb, -EINTR);
                return;
        } else if (u132->going > 0) {
-                dev_err(&u132->platform_dev->dev, "device is being removed urb="
+                dev_err(&u132->platform_dev->dev, "device is being removed "
-                        "%p status=%d\n", urb, urb->status);
+                                "urb=%p\n", urb);
                up(&u132->scheduler_lock);
                u132_hcd_giveback_urb(u132, endp, urb, -ENODEV);
                return;
-        } else if (urb->status == -EINPROGRESS) {
+        } else if (!urb->unlinked) {
                int retval;
                struct u132_ring *ring = endp->ring;
                up(&u132->scheduler_lock);
@@ -1162,10 +1160,10 @@ static void u132_hcd_enumeration_address_sent(void *data, struct urb *urb,
                        u132_hcd_giveback_urb(u132, endp, urb, retval);
                return;
        } else {
-                dev_err(&u132->platform_dev->dev, "CALLBACK called urb=%p statu"
+                dev_err(&u132->platform_dev->dev, "CALLBACK called urb=%p "
-                        "s=%d\n", urb, urb->status);
+                                "unlinked=%d\n", urb, urb->unlinked);
                up(&u132->scheduler_lock);
-                u132_hcd_giveback_urb(u132, endp, urb, urb->status);
+                u132_hcd_giveback_urb(u132, endp, urb, 0);
                return;
        }
 }
@@ -1189,20 +1187,20 @@ static void u132_hcd_initial_empty_sent(void *data, struct urb *urb, u8 *buf,
                u132_hcd_giveback_urb(u132, endp, urb, -EINTR);
                return;
        } else if (u132->going > 0) {
-                dev_err(&u132->platform_dev->dev, "device is being removed urb="
+                dev_err(&u132->platform_dev->dev, "device is being removed "
-                        "%p status=%d\n", urb, urb->status);
+                                "urb=%p\n", urb);
                up(&u132->scheduler_lock);
                u132_hcd_giveback_urb(u132, endp, urb, -ENODEV);
                return;
-        } else if (urb->status == -EINPROGRESS) {
+        } else if (!urb->unlinked) {
                up(&u132->scheduler_lock);
                u132_hcd_giveback_urb(u132, endp, urb, 0);
                return;
        } else {
-                dev_err(&u132->platform_dev->dev, "CALLBACK called urb=%p statu"
+                dev_err(&u132->platform_dev->dev, "CALLBACK called urb=%p "
-                        "s=%d\n", urb, urb->status);
+                                "unlinked=%d\n", urb, urb->unlinked);
                up(&u132->scheduler_lock);
-                u132_hcd_giveback_urb(u132, endp, urb, urb->status);
+                u132_hcd_giveback_urb(u132, endp, urb, 0);
                return;
        }
 }
@@ -1227,12 +1225,12 @@ static void u132_hcd_initial_input_recv(void *data, struct urb *urb, u8 *buf,
                u132_hcd_giveback_urb(u132, endp, urb, -EINTR);
                return;
        } else if (u132->going > 0) {
-                dev_err(&u132->platform_dev->dev, "device is being removed urb="
+                dev_err(&u132->platform_dev->dev, "device is being removed "
-                        "%p status=%d\n", urb, urb->status);
+                                "urb=%p\n", urb);
                up(&u132->scheduler_lock);
                u132_hcd_giveback_urb(u132, endp, urb, -ENODEV);
                return;
-        } else if (urb->status == -EINPROGRESS) {
+        } else if (!urb->unlinked) {
                int retval;
                struct u132_ring *ring = endp->ring;
                u8 *u = urb->transfer_buffer;
@@ -1251,10 +1249,10 @@ static void u132_hcd_initial_input_recv(void *data, struct urb *urb, u8 *buf,
                        u132_hcd_giveback_urb(u132, endp, urb, retval);
                return;
        } else {
-                dev_err(&u132->platform_dev->dev, "CALLBACK called urb=%p statu"
+                dev_err(&u132->platform_dev->dev, "CALLBACK called urb=%p "
-                        "s=%d\n", urb, urb->status);
+                                "unlinked=%d\n", urb, urb->unlinked);
                up(&u132->scheduler_lock);
-                u132_hcd_giveback_urb(u132, endp, urb, urb->status);
+                u132_hcd_giveback_urb(u132, endp, urb, 0);
                return;
        }
 }
@@ -1279,12 +1277,12 @@ static void u132_hcd_initial_setup_sent(void *data, struct urb *urb, u8 *buf,
                u132_hcd_giveback_urb(u132, endp, urb, -EINTR);
                return;
        } else if (u132->going > 0) {
-                dev_err(&u132->platform_dev->dev, "device is being removed urb="
+                dev_err(&u132->platform_dev->dev, "device is being removed "
-                        "%p status=%d\n", urb, urb->status);
+                                "urb=%p\n", urb);
                up(&u132->scheduler_lock);
                u132_hcd_giveback_urb(u132, endp, urb, -ENODEV);
                return;
-        } else if (urb->status == -EINPROGRESS) {
+        } else if (!urb->unlinked) {
                int retval;
                struct u132_ring *ring = endp->ring;
                up(&u132->scheduler_lock);
@@ -1296,10 +1294,10 @@ static void u132_hcd_initial_setup_sent(void *data, struct urb *urb, u8 *buf,
                        u132_hcd_giveback_urb(u132, endp, urb, retval);
                return;
        } else {
-                dev_err(&u132->platform_dev->dev, "CALLBACK called urb=%p statu"
+                dev_err(&u132->platform_dev->dev, "CALLBACK called urb=%p "
-                        "s=%d\n", urb, urb->status);
+                                "unlinked=%d\n", urb, urb->unlinked);
                up(&u132->scheduler_lock);
-                u132_hcd_giveback_urb(u132, endp, urb, urb->status);
+                u132_hcd_giveback_urb(u132, endp, urb, 0);
                return;
        }
 }
@@ -1519,12 +1517,15 @@ static void u132_hcd_endp_work_scheduler(struct work_struct *work)
                }
        }
 }
+#ifdef CONFIG_PM
 static void port_power(struct u132 *u132, int pn, int is_on)
 {
        u132->port[pn].power = is_on;
 }
+#endif
 static void u132_power(struct u132 *u132, int is_on)
 {
        struct usb_hcd *hcd = u132_to_hcd(u132)
@@ -1801,10 +1802,10 @@ static void u132_hcd_stop(struct usb_hcd *hcd)
                dev_err(&u132->platform_dev->dev, "device hcd=%p is being remov"
                        "ed\n", hcd);
        } else {
-                down(&u132->sw_lock);
+                mutex_lock(&u132->sw_lock);
                msleep(100);
                u132_power(u132, 0);
-                up(&u132->sw_lock);
+                mutex_unlock(&u132->sw_lock);
        }
 }
@@ -1826,7 +1827,7 @@ static int u132_hcd_start(struct usb_hcd *hcd)
                        (pdev->dev.platform_data))->vendor;
                u16 device = ((struct u132_platform_data *)
                        (pdev->dev.platform_data))->device;
-                down(&u132->sw_lock);
+                mutex_lock(&u132->sw_lock);
                msleep(10);
                if (vendor == PCI_VENDOR_ID_AMD && device == 0x740c) {
                        u132->flags = OHCI_QUIRK_AMD756;
@@ -1841,7 +1842,7 @@ static int u132_hcd_start(struct usb_hcd *hcd)
                        u132->going = 1;
                }
                msleep(100);
-                up(&u132->sw_lock);
+                mutex_unlock(&u132->sw_lock);
                return retval;
        } else {
                dev_err(&u132->platform_dev->dev, "platform_device missing\n");
@@ -1861,32 +1862,44 @@ static int u132_hcd_reset(struct usb_hcd *hcd)
                return -ESHUTDOWN;
        } else {
                int retval;
-                down(&u132->sw_lock);
+                mutex_lock(&u132->sw_lock);
                retval = u132_init(u132);
                if (retval) {
                        u132_disable(u132);
                        u132->going = 1;
                }
-                up(&u132->sw_lock);
+                mutex_unlock(&u132->sw_lock);
                return retval;
        }
 }
 static int create_endpoint_and_queue_int(struct u132 *u132,
-        struct u132_udev *udev, struct usb_host_endpoint *hep, struct urb *urb,
+        struct u132_udev *udev, struct urb *urb,
        struct usb_device *usb_dev, u8 usb_addr, u8 usb_endp, u8 address,
        gfp_t mem_flags)
 {
        struct u132_ring *ring;
        unsigned long irqs;
-        u8 endp_number = ++u132->num_endpoints;
+        int rc;
-        struct u132_endp *endp = hep->hcpriv = u132->endp[endp_number - 1] =
+        u8 endp_number;
-                kmalloc(sizeof(struct u132_endp), mem_flags);
+        struct u132_endp *endp = kmalloc(sizeof(struct u132_endp), mem_flags);
        if (!endp) {
                return -ENOMEM;
        }
+        spin_lock_init(&endp->queue_lock.slock);
+        spin_lock_irqsave(&endp->queue_lock.slock, irqs);
+        rc = usb_hcd_link_urb_to_ep(u132_to_hcd(u132), urb);
+        if (rc) {
+                spin_unlock_irqrestore(&endp->queue_lock.slock, irqs);
+                kfree(endp);
+                return rc;
+        }
+        endp_number = ++u132->num_endpoints;
+        urb->ep->hcpriv = u132->endp[endp_number - 1] = endp;
        INIT_DELAYED_WORK(&endp->scheduler, u132_hcd_endp_work_scheduler);
-        spin_lock_init(&endp->queue_lock.slock);
        INIT_LIST_HEAD(&endp->urb_more);
        ring = endp->ring = &u132->ring[0];
        if (ring->curr_endp) {
@@ -1902,7 +1915,7 @@ static int create_endpoint_and_queue_int(struct u132 *u132,
        endp->delayed = 0;
        endp->endp_number = endp_number;
        endp->u132 = u132;
-        endp->hep = hep;
+        endp->hep = urb->ep;
        endp->pipetype = usb_pipetype(urb->pipe);
        u132_endp_init_kref(u132, endp);
        if (usb_pipein(urb->pipe)) {
@@ -1921,7 +1934,6 @@ static int create_endpoint_and_queue_int(struct u132 *u132,
                u132_udev_get_kref(u132, udev);
        }
        urb->hcpriv = u132;
-        spin_lock_irqsave(&endp->queue_lock.slock, irqs);
        endp->delayed = 1;
        endp->jiffies = jiffies + msecs_to_jiffies(urb->interval);
        endp->udev_number = address;
@@ -1936,8 +1948,8 @@ static int create_endpoint_and_queue_int(struct u132 *u132,
        return 0;
 }
-static int queue_int_on_old_endpoint(struct u132 *u132, struct u132_udev *udev,
+static int queue_int_on_old_endpoint(struct u132 *u132,
-        struct usb_host_endpoint *hep, struct urb *urb,
+        struct u132_udev *udev, struct urb *urb,
        struct usb_device *usb_dev, struct u132_endp *endp, u8 usb_addr,
        u8 usb_endp, u8 address)
 {
@@ -1961,21 +1973,33 @@ static int queue_int_on_old_endpoint(struct u132 *u132, struct u132_udev *udev,
 }
 static int create_endpoint_and_queue_bulk(struct u132 *u132,
-        struct u132_udev *udev, struct usb_host_endpoint *hep, struct urb *urb,
+        struct u132_udev *udev, struct urb *urb,
        struct usb_device *usb_dev, u8 usb_addr, u8 usb_endp, u8 address,
        gfp_t mem_flags)
 {
        int ring_number;
        struct u132_ring *ring;
        unsigned long irqs;
-        u8 endp_number = ++u132->num_endpoints;
+        int rc;
-        struct u132_endp *endp = hep->hcpriv = u132->endp[endp_number - 1] =
+        u8 endp_number;
-                kmalloc(sizeof(struct u132_endp), mem_flags);
+        struct u132_endp *endp = kmalloc(sizeof(struct u132_endp), mem_flags);
        if (!endp) {
                return -ENOMEM;
        }
+        spin_lock_init(&endp->queue_lock.slock);
+        spin_lock_irqsave(&endp->queue_lock.slock, irqs);
+        rc = usb_hcd_link_urb_to_ep(u132_to_hcd(u132), urb);
+        if (rc) {
+                spin_unlock_irqrestore(&endp->queue_lock.slock, irqs);
+                kfree(endp);
+                return rc;
+        }
+        endp_number = ++u132->num_endpoints;
+        urb->ep->hcpriv = u132->endp[endp_number - 1] = endp;
        INIT_DELAYED_WORK(&endp->scheduler, u132_hcd_endp_work_scheduler);
-        spin_lock_init(&endp->queue_lock.slock);
        INIT_LIST_HEAD(&endp->urb_more);
        endp->dequeueing = 0;
        endp->edset_flush = 0;
@@ -1983,7 +2007,7 @@ static int create_endpoint_and_queue_bulk(struct u132 *u132,
        endp->delayed = 0;
        endp->endp_number = endp_number;
        endp->u132 = u132;
-        endp->hep = hep;
+        endp->hep = urb->ep;
        endp->pipetype = usb_pipetype(urb->pipe);
        u132_endp_init_kref(u132, endp);
        if (usb_pipein(urb->pipe)) {
@@ -2012,7 +2036,6 @@ static int create_endpoint_and_queue_bulk(struct u132 *u132,
        }
        ring->length += 1;
        urb->hcpriv = u132;
-        spin_lock_irqsave(&endp->queue_lock.slock, irqs);
        endp->udev_number = address;
        endp->usb_addr = usb_addr;
        endp->usb_endp = usb_endp;
@@ -2026,7 +2049,7 @@ static int create_endpoint_and_queue_bulk(struct u132 *u132,
 }
 static int queue_bulk_on_old_endpoint(struct u132 *u132, struct u132_udev *udev,
-         struct usb_host_endpoint *hep, struct urb *urb,
+        struct urb *urb,
        struct usb_device *usb_dev, struct u132_endp *endp, u8 usb_addr,
        u8 usb_endp, u8 address)
 {
@@ -2048,19 +2071,32 @@ static int queue_bulk_on_old_endpoint(struct u132 *u132, struct u132_udev *udev,
 }
 static int create_endpoint_and_queue_control(struct u132 *u132,
-        struct usb_host_endpoint *hep, struct urb *urb,
+        struct urb *urb,
        struct usb_device *usb_dev, u8 usb_addr, u8 usb_endp,
        gfp_t mem_flags)
 {
        struct u132_ring *ring;
-        u8 endp_number = ++u132->num_endpoints;
+        unsigned long irqs;
-        struct u132_endp *endp = hep->hcpriv = u132->endp[endp_number - 1] =
+        int rc;
-                kmalloc(sizeof(struct u132_endp), mem_flags);
+        u8 endp_number;
+        struct u132_endp *endp = kmalloc(sizeof(struct u132_endp), mem_flags);
        if (!endp) {
                return -ENOMEM;
        }
+        spin_lock_init(&endp->queue_lock.slock);
+        spin_lock_irqsave(&endp->queue_lock.slock, irqs);
+        rc = usb_hcd_link_urb_to_ep(u132_to_hcd(u132), urb);
+        if (rc) {
+                spin_unlock_irqrestore(&endp->queue_lock.slock, irqs);
+                kfree(endp);
+                return rc;
+        }
+        endp_number = ++u132->num_endpoints;
+        urb->ep->hcpriv = u132->endp[endp_number - 1] = endp;
        INIT_DELAYED_WORK(&endp->scheduler, u132_hcd_endp_work_scheduler);
-        spin_lock_init(&endp->queue_lock.slock);
        INIT_LIST_HEAD(&endp->urb_more);
        ring = endp->ring = &u132->ring[0];
        if (ring->curr_endp) {
@@ -2076,11 +2112,10 @@ static int create_endpoint_and_queue_control(struct u132 *u132,
        endp->delayed = 0;
        endp->endp_number = endp_number;
        endp->u132 = u132;
-        endp->hep = hep;
+        endp->hep = urb->ep;
        u132_endp_init_kref(u132, endp);
        u132_endp_get_kref(u132, endp);
        if (usb_addr == 0) {
-                unsigned long irqs;
                u8 address = u132->addr[usb_addr].address;
                struct u132_udev *udev = &u132->udev[address];
                endp->udev_number = address;
@@ -2094,7 +2129,6 @@ static int create_endpoint_and_queue_control(struct u132 *u132,
                udev->endp_number_in[usb_endp] = endp_number;
                udev->endp_number_out[usb_endp] = endp_number;
                urb->hcpriv = u132;
-                spin_lock_irqsave(&endp->queue_lock.slock, irqs);
                endp->queue_size = 1;
                endp->queue_last = 0;
                endp->queue_next = 0;
@@ -2103,7 +2137,6 @@ static int create_endpoint_and_queue_control(struct u132 *u132,
                u132_endp_queue_work(u132, endp, 0);
                return 0;
        } else {                /*(usb_addr > 0) */
-                unsigned long irqs;
                u8 address = u132->addr[usb_addr].address;
                struct u132_udev *udev = &u132->udev[address];
                endp->udev_number = address;
@@ -2117,7 +2150,6 @@ static int create_endpoint_and_queue_control(struct u132 *u132,
                udev->endp_number_in[usb_endp] = endp_number;
                udev->endp_number_out[usb_endp] = endp_number;
                urb->hcpriv = u132;
-                spin_lock_irqsave(&endp->queue_lock.slock, irqs);
                endp->queue_size = 1;
                endp->queue_last = 0;
                endp->queue_next = 0;
@@ -2129,7 +2161,7 @@ static int create_endpoint_and_queue_control(struct u132 *u132,
 }
 static int queue_control_on_old_endpoint(struct u132 *u132,
-        struct usb_host_endpoint *hep, struct urb *urb,
+        struct urb *urb,
        struct usb_device *usb_dev, struct u132_endp *endp, u8 usb_addr,
        u8 usb_endp)
 {
@@ -2229,8 +2261,8 @@ static int queue_control_on_old_endpoint(struct u132 *u132,
        }
 }
-static int u132_urb_enqueue(struct usb_hcd *hcd, struct usb_host_endpoint *hep,
+static int u132_urb_enqueue(struct usb_hcd *hcd, struct urb *urb,
-        struct urb *urb, gfp_t mem_flags)
+                gfp_t mem_flags)
 {
        struct u132 *u132 = hcd_to_u132(hcd);
        if (irqs_disabled()) {
@@ -2245,8 +2277,8 @@ static int u132_urb_enqueue(struct usb_hcd *hcd, struct usb_host_endpoint *hep,
                        , u132->going);
                return -ENODEV;
        } else if (u132->going > 0) {
-                dev_err(&u132->platform_dev->dev, "device is being removed urb="
+                dev_err(&u132->platform_dev->dev, "device is being removed "
-                        "%p status=%d\n", urb, urb->status);
+                                "urb=%p\n", urb);
                return -ESHUTDOWN;
        } else {
                u8 usb_addr = usb_pipedevice(urb->pipe);
@@ -2255,16 +2287,24 @@ static int u132_urb_enqueue(struct usb_hcd *hcd, struct usb_host_endpoint *hep,
                if (usb_pipetype(urb->pipe) == PIPE_INTERRUPT) {
                        u8 address = u132->addr[usb_addr].address;
                        struct u132_udev *udev = &u132->udev[address];
-                        struct u132_endp *endp = hep->hcpriv;
+                        struct u132_endp *endp = urb->ep->hcpriv;
                        urb->actual_length = 0;
                        if (endp) {
                                unsigned long irqs;
                                int retval;
                                spin_lock_irqsave(&endp->queue_lock.slock,
                                        irqs);
-                                retval = queue_int_on_old_endpoint(u132, udev,
+                                retval = usb_hcd_link_urb_to_ep(hcd, urb);
-                                        hep, urb, usb_dev, endp, usb_addr,
+                                if (retval == 0) {
-                                        usb_endp, address);
+                                        retval = queue_int_on_old_endpoint(
+                                                        u132, udev, urb,
+                                                        usb_dev, endp,
+                                                        usb_addr, usb_endp,
+                                                        address);
+                                        if (retval)
+                                                usb_hcd_unlink_urb_from_ep(
+                                                                hcd, urb);
+                                }
                                spin_unlock_irqrestore(&endp->queue_lock.slock,
                                        irqs);
                                if (retval) {
@@ -2279,8 +2319,8 @@ static int u132_urb_enqueue(struct usb_hcd *hcd, struct usb_host_endpoint *hep,
                                return -EINVAL;
                        } else {        /*(endp == NULL) */
                                return create_endpoint_and_queue_int(u132, udev,
-                                         hep, urb, usb_dev, usb_addr, usb_endp,
+                                                urb, usb_dev, usb_addr,
-                                        address, mem_flags);
+                                                usb_endp, address, mem_flags);
                        }
                } else if (usb_pipetype(urb->pipe) == PIPE_ISOCHRONOUS) {
                        dev_err(&u132->platform_dev->dev, "the hardware does no"
@@ -2289,16 +2329,24 @@ static int u132_urb_enqueue(struct usb_hcd *hcd, struct usb_host_endpoint *hep,
                } else if (usb_pipetype(urb->pipe) == PIPE_BULK) {
                        u8 address = u132->addr[usb_addr].address;
                        struct u132_udev *udev = &u132->udev[address];
-                        struct u132_endp *endp = hep->hcpriv;
+                        struct u132_endp *endp = urb->ep->hcpriv;
                        urb->actual_length = 0;
                        if (endp) {
                                unsigned long irqs;
                                int retval;
                                spin_lock_irqsave(&endp->queue_lock.slock,
                                        irqs);
-                                retval = queue_bulk_on_old_endpoint(u132, udev,
+                                retval = usb_hcd_link_urb_to_ep(hcd, urb);
-                                        hep, urb, usb_dev, endp, usb_addr,
+                                if (retval == 0) {
-                                        usb_endp, address);
+                                        retval = queue_bulk_on_old_endpoint(
+                                                        u132, udev, urb,
+                                                        usb_dev, endp,
+                                                        usb_addr, usb_endp,
+                                                        address);
+                                        if (retval)
+                                                usb_hcd_unlink_urb_from_ep(
+                                                                hcd, urb);
+                                }
                                spin_unlock_irqrestore(&endp->queue_lock.slock,
                                        irqs);
                                if (retval) {
@@ -2311,10 +2359,10 @@ static int u132_urb_enqueue(struct usb_hcd *hcd, struct usb_host_endpoint *hep,
                                return -EINVAL;
                        } else
                                return create_endpoint_and_queue_bulk(u132,
-                                        udev, hep, urb, usb_dev, usb_addr,
+                                        udev, urb, usb_dev, usb_addr,
                                        usb_endp, address, mem_flags);
                } else {
-                        struct u132_endp *endp = hep->hcpriv;
+                        struct u132_endp *endp = urb->ep->hcpriv;
                        u16 urb_size = 8;
                        u8 *b = urb->setup_packet;
                        int i = 0;
@@ -2337,9 +2385,16 @@ static int u132_urb_enqueue(struct usb_hcd *hcd, struct usb_host_endpoint *hep,
                                int retval;
                                spin_lock_irqsave(&endp->queue_lock.slock,
                                        irqs);
-                                retval = queue_control_on_old_endpoint(u132,
+                                retval = usb_hcd_link_urb_to_ep(hcd, urb);
-                                        hep, urb, usb_dev, endp, usb_addr,
+                                if (retval == 0) {
-                                        usb_endp);
+                                        retval = queue_control_on_old_endpoint(
+                                                        u132, urb, usb_dev,
+                                                        endp, usb_addr,
+                                                        usb_endp);
+                                        if (retval)
+                                                usb_hcd_unlink_urb_from_ep(
+                                                                hcd, urb);
+                                }
                                spin_unlock_irqrestore(&endp->queue_lock.slock,
                                        irqs);
                                if (retval) {
@@ -2352,7 +2407,7 @@ static int u132_urb_enqueue(struct usb_hcd *hcd, struct usb_host_endpoint *hep,
                                return -EINVAL;
                        } else
                                return create_endpoint_and_queue_control(u132,
-                                        hep, urb, usb_dev, usb_addr, usb_endp,
+                                        urb, usb_dev, usb_addr, usb_endp,
                                        mem_flags);
                }
        }
@@ -2371,8 +2426,7 @@ static int dequeue_from_overflow_chain(struct u132 *u132,
                        list_del(scan);
                        endp->queue_size -= 1;
                        urb->error_count = 0;
-                        urb->hcpriv = NULL;
+                        usb_hcd_giveback_urb(hcd, urb, 0);
-                        usb_hcd_giveback_urb(hcd, urb);
                        return 0;
                } else
                        continue;
@@ -2387,10 +2441,17 @@ static int dequeue_from_overflow_chain(struct u132 *u132,
 }
 static int u132_endp_urb_dequeue(struct u132 *u132, struct u132_endp *endp,
-        struct urb *urb)
+                struct urb *urb, int status)
 {
        unsigned long irqs;
+        int rc;
        spin_lock_irqsave(&endp->queue_lock.slock, irqs);
+        rc = usb_hcd_check_unlink_urb(u132_to_hcd(u132), urb, status);
+        if (rc) {
+                spin_unlock_irqrestore(&endp->queue_lock.slock, irqs);
+                return rc;
+        }
        if (endp->queue_size == 0) {
                dev_err(&u132->platform_dev->dev, "urb=%p not found in endp[%d]"
                        "=%p ring[%d] %c%c usb_endp=%d usb_addr=%d\n", urb,
@@ -2406,11 +2467,10 @@ static int u132_endp_urb_dequeue(struct u132 *u132, struct u132_endp *endp,
                        endp->edset_flush = 1;
                        u132_endp_queue_work(u132, endp, 0);
                        spin_unlock_irqrestore(&endp->queue_lock.slock, irqs);
-                        urb->hcpriv = NULL;
                        return 0;
                } else {
                        spin_unlock_irqrestore(&endp->queue_lock.slock, irqs);
-                        u132_hcd_abandon_urb(u132, endp, urb, urb->status);
+                        u132_hcd_abandon_urb(u132, endp, urb, status);
                        return 0;
                }
        } else {
@@ -2435,6 +2495,8 @@ static int u132_endp_urb_dequeue(struct u132 *u132, struct u132_endp *endp,
                }
                if (urb_slot) {
                        struct usb_hcd *hcd = u132_to_hcd(u132);
+                        usb_hcd_unlink_urb_from_ep(hcd, urb);
                        endp->queue_size -= 1;
                        if (list_empty(&endp->urb_more)) {
                                spin_unlock_irqrestore(&endp->queue_lock.slock,
@@ -2449,8 +2511,7 @@ static int u132_endp_urb_dequeue(struct u132 *u132, struct u132_endp *endp,
                                        irqs);
                                kfree(urbq);
                        } urb->error_count = 0;
-                        urb->hcpriv = NULL;
+                        usb_hcd_giveback_urb(hcd, urb, status);
-                        usb_hcd_giveback_urb(hcd, urb);
                        return 0;
                } else if (list_empty(&endp->urb_more)) {
                        dev_err(&u132->platform_dev->dev, "urb=%p not found in "
@@ -2464,7 +2525,10 @@ static int u132_endp_urb_dequeue(struct u132 *u132, struct u132_endp *endp,
                        spin_unlock_irqrestore(&endp->queue_lock.slock, irqs);
                        return -EINVAL;
                } else {
-                        int retval = dequeue_from_overflow_chain(u132, endp,
+                        int retval;
+                        usb_hcd_unlink_urb_from_ep(u132_to_hcd(u132), urb);
+                        retval = dequeue_from_overflow_chain(u132, endp,
                                urb);
                        spin_unlock_irqrestore(&endp->queue_lock.slock, irqs);
                        return retval;
@@ -2472,7 +2536,7 @@ static int u132_endp_urb_dequeue(struct u132 *u132, struct u132_endp *endp,
        }
 }
-static int u132_urb_dequeue(struct usb_hcd *hcd, struct urb *urb)
+static int u132_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status)
 {
        struct u132 *u132 = hcd_to_u132(hcd);
        if (u132->going > 2) {
@@ -2487,11 +2551,11 @@ static int u132_urb_dequeue(struct usb_hcd *hcd, struct urb *urb)
                if (usb_pipein(urb->pipe)) {
                        u8 endp_number = udev->endp_number_in[usb_endp];
                        struct u132_endp *endp = u132->endp[endp_number - 1];
-                        return u132_endp_urb_dequeue(u132, endp, urb);
+                        return u132_endp_urb_dequeue(u132, endp, urb, status);
                } else {
                        u8 endp_number = udev->endp_number_out[usb_endp];
                        struct u132_endp *endp = u132->endp[endp_number - 1];
-                        return u132_endp_urb_dequeue(u132, endp, urb);
+                        return u132_endp_urb_dequeue(u132, endp, urb, status);
                }
        }
 }
@@ -2801,7 +2865,7 @@ static int u132_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
                return -ESHUTDOWN;
        } else {
                int retval = 0;
-                down(&u132->sw_lock);
+                mutex_lock(&u132->sw_lock);
                switch (typeReq) {
                case ClearHubFeature:
                        switch (wValue) {
@@ -2864,7 +2928,7 @@ static int u132_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
                      stall:retval = -EPIPE;
                        break;
                }
-                up(&u132->sw_lock);
+                mutex_unlock(&u132->sw_lock);
                return retval;
        }
 }
@@ -3000,7 +3064,7 @@ static int __devexit u132_remove(struct platform_device *pdev)
                        dev_err(&u132->platform_dev->dev, "removing device u132"
                                ".%d\n", u132->sequence_num);
                        msleep(100);
-                        down(&u132->sw_lock);
+                        mutex_lock(&u132->sw_lock);
                        u132_monitor_cancel_work(u132);
                        while (rings-- > 0) {
                                struct u132_ring *ring = &u132->ring[rings];
@@ -3013,7 +3077,7 @@ static int __devexit u132_remove(struct platform_device *pdev)
                        u132->going += 1;
                        printk(KERN_INFO "removing device u132.%d\n",
                                u132->sequence_num);
-                        up(&u132->sw_lock);
+                        mutex_unlock(&u132->sw_lock);
                        usb_remove_hcd(hcd);
                        u132_u132_put_kref(u132);
                        return 0;
@@ -3033,7 +3097,7 @@ static void u132_initialise(struct u132 *u132, struct platform_device *pdev)
        u132->platform_dev = pdev;
        u132->power = 0;
        u132->reset = 0;
-        init_MUTEX(&u132->sw_lock);
+        mutex_init(&u132->sw_lock);
        init_MUTEX(&u132->scheduler_lock);
        while (rings-- > 0) {
                struct u132_ring *ring = &u132->ring[rings];
@@ -3043,7 +3107,7 @@ static void u132_initialise(struct u132 *u132, struct platform_device *pdev)
                ring->curr_endp = NULL;
                INIT_DELAYED_WORK(&ring->scheduler,
                                  u132_hcd_ring_work_scheduler);
-        } down(&u132->sw_lock);
+        } mutex_lock(&u132->sw_lock);
        INIT_DELAYED_WORK(&u132->monitor, u132_hcd_monitor_work);
        while (ports-- > 0) {
                struct u132_port *port = &u132->port[ports];
@@ -3073,7 +3137,7 @@ static void u132_initialise(struct u132 *u132, struct platform_device *pdev)
        while (endps-- > 0) {
                u132->endp[endps] = NULL;
        }
-        up(&u132->sw_lock);
+        mutex_unlock(&u132->sw_lock);
        return;
 }
@@ -3111,10 +3175,10 @@ static int __devinit u132_probe(struct platform_device *pdev)
                int retval = 0;
                struct u132 *u132 = hcd_to_u132(hcd);
                hcd->rsrc_start = 0;
-                down(&u132_module_lock);
+                mutex_lock(&u132_module_lock);
                list_add_tail(&u132->u132_list, &u132_static_list);
                u132->sequence_num = ++u132_instances;
-                up(&u132_module_lock);
+                mutex_unlock(&u132_module_lock);
                u132_u132_init_kref(u132);
                u132_initialise(u132, pdev);
                hcd->product_desc = "ELAN U132 Host Controller";
@@ -3216,7 +3280,7 @@ static int __init u132_hcd_init(void)
        INIT_LIST_HEAD(&u132_static_list);
        u132_instances = 0;
        u132_exiting = 0;
-        init_MUTEX(&u132_module_lock);
+        mutex_init(&u132_module_lock);
        if (usb_disabled())
                return -ENODEV;
        printk(KERN_INFO "driver %s built at %s on %s\n", hcd_name, __TIME__,
@@ -3232,9 +3296,9 @@ static void __exit u132_hcd_exit(void)
 {
        struct u132 *u132;
        struct u132 *temp;
-        down(&u132_module_lock);
+        mutex_lock(&u132_module_lock);
        u132_exiting += 1;
-        up(&u132_module_lock);
+        mutex_unlock(&u132_module_lock);
        list_for_each_entry_safe(u132, temp, &u132_static_list, u132_list) {
                platform_device_unregister(u132->platform_dev);
        } platform_driver_unregister(&u132_platform_driver);
diff --git a/drivers/usb/host/uhci-debug.c b/drivers/usb/host/uhci-debug.c
index 1497371583b..20cc58b9780 100644
--- a/drivers/usb/host/uhci-debug.c
+++ b/drivers/usb/host/uhci-debug.c
@@ -120,8 +120,8 @@ static int uhci_show_urbp(struct urb_priv *urbp, char *buf, int len, int space)
        out += sprintf(out, "%s%s", ptype, (urbp->fsbr ? " FSBR" : ""));
        out += sprintf(out, " Actlen=%d", urbp->urb->actual_length);
-        if (urbp->urb->status != -EINPROGRESS)
+        if (urbp->urb->unlinked)
-                out += sprintf(out, " Status=%d", urbp->urb->status);
+                out += sprintf(out, " Unlinked=%d", urbp->urb->unlinked);
        out += sprintf(out, "\n");
        i = nactive = ninactive = 0;
diff --git a/drivers/usb/host/uhci-hcd.c b/drivers/usb/host/uhci-hcd.c
index 76c555a67da..4db17f75f4f 100644
--- a/drivers/usb/host/uhci-hcd.c
+++ b/drivers/usb/host/uhci-hcd.c
@@ -237,7 +237,7 @@ static int resume_detect_interrupts_are_broken(struct uhci_hcd *uhci)
 static int remote_wakeup_is_broken(struct uhci_hcd *uhci)
 {
        int port;
-        char *sys_info;
+        const char *sys_info;
        static char bad_Asus_board[] = "A7V8X";
        /* One of Asus's motherboards has a bug which causes it to
@@ -933,7 +933,7 @@ static int __init uhci_hcd_init(void)
        }
        uhci_up_cachep = kmem_cache_create("uhci_urb_priv",
-                sizeof(struct urb_priv), 0, 0, NULL, NULL);
+                sizeof(struct urb_priv), 0, 0, NULL);
        if (!uhci_up_cachep)
                goto up_failed;
diff --git a/drivers/usb/host/uhci-hcd.h b/drivers/usb/host/uhci-hcd.h
index 1b3d23406ac..340d6ed3e6e 100644
--- a/drivers/usb/host/uhci-hcd.h
+++ b/drivers/usb/host/uhci-hcd.h
@@ -146,7 +146,6 @@ struct uhci_qh {
        short phase;                    /* Between 0 and period-1 */
        short load;                     /* Periodic time requirement, in us */
        unsigned int iso_frame;         /* Frame # for iso_packet_desc */
-        int iso_status;                 /* Status for Isochronous URBs */
        int state;                      /* QH_STATE_xxx; see above */
        int type;                       /* Queue type (control, bulk, etc) */
@@ -457,21 +456,6 @@ struct urb_priv {
 };
-/*
- * Locking in uhci.c
- *
- * Almost everything relating to the hardware schedule and processing
- * of URBs is protected by uhci->lock.  urb->status is protected by
- * urb->lock; that's the one exception.
- *
- * To prevent deadlocks, never lock uhci->lock while holding urb->lock.
- * The safe order of locking is:
- *
- * #1 uhci->lock
- * #2 urb->lock
- */
 /* Some special IDs */
 #define PCI_VENDOR_ID_GENESYS           0x17a0
diff --git a/drivers/usb/host/uhci-q.c b/drivers/usb/host/uhci-q.c
index 4aed305982e..e5d60d5b105 100644
--- a/drivers/usb/host/uhci-q.c
+++ b/drivers/usb/host/uhci-q.c
@@ -757,7 +757,6 @@ static void uhci_free_urb_priv(struct uhci_hcd *uhci,
                uhci_free_td(uhci, td);
        }
-        urbp->urb->hcpriv = NULL;
        kmem_cache_free(uhci_up_cachep, urbp);
 }
@@ -827,8 +826,10 @@ static int uhci_submit_control(struct uhci_hcd *uhci, struct urb *urb,
         * If direction is "send", change the packet ID from SETUP (0x2D)
         * to OUT (0xE1).  Else change it from SETUP to IN (0x69) and
         * set Short Packet Detect (SPD) for all data packets.
+         *
+         * 0-length transfers always get treated as "send".
         */
-        if (usb_pipeout(urb->pipe))
+        if (usb_pipeout(urb->pipe) || len == 0)
                destination ^= (USB_PID_SETUP ^ USB_PID_OUT);
        else {
                destination ^= (USB_PID_SETUP ^ USB_PID_IN);
@@ -839,7 +840,12 @@ static int uhci_submit_control(struct uhci_hcd *uhci, struct urb *urb,
         * Build the DATA TDs
         */
        while (len > 0) {
-                int pktsze = min(len, maxsze);
+                int pktsze = maxsze;
+                if (len <= pktsze) {            /* The last data packet */
+                        pktsze = len;
+                        status &= ~TD_CTRL_SPD;
+                }
                td = uhci_alloc_td(uhci);
                if (!td)
@@ -866,20 +872,10 @@ static int uhci_submit_control(struct uhci_hcd *uhci, struct urb *urb,
                goto nomem;
        *plink = LINK_TO_TD(td);
-        /*
+        /* Change direction for the status transaction */
-         * It's IN if the pipe is an output pipe or we're not expecting
+        destination ^= (USB_PID_IN ^ USB_PID_OUT);
-         * data back.
-         */
-        destination &= ~TD_TOKEN_PID_MASK;
-        if (usb_pipeout(urb->pipe) || !urb->transfer_buffer_length)
-                destination |= USB_PID_IN;
-        else
-                destination |= USB_PID_OUT;
        destination |= TD_TOKEN_TOGGLE;         /* End in Data1 */
-        status &= ~TD_CTRL_SPD;
        uhci_add_td_to_urbp(td, urbp);
        uhci_fill_td(td, status | TD_CTRL_IOC,
                        destination | uhci_explen(0), 0);
@@ -1185,10 +1181,18 @@ static int uhci_result_common(struct uhci_hcd *uhci, struct urb *urb)
                                }
                        }
+                /* Did we receive a short packet? */
                } else if (len < uhci_expected_length(td_token(td))) {
-                        /* We received a short packet */
+                        /* For control transfers, go to the status TD if
-                        if (urb->transfer_flags & URB_SHORT_NOT_OK)
+                         * this isn't already the last data TD */
+                        if (qh->type == USB_ENDPOINT_XFER_CONTROL) {
+                                if (td->list.next != urbp->td_list.prev)
+                                        ret = 1;
+                        }
+                        /* For bulk and interrupt, this may be an error */
+                        else if (urb->transfer_flags & URB_SHORT_NOT_OK)
                                ret = -EREMOTEIO;
                        /* Fixup needed only if this isn't the URB's last TD */
@@ -1208,10 +1212,6 @@ static int uhci_result_common(struct uhci_hcd *uhci, struct urb *urb)
 err:
        if (ret < 0) {
-                /* In case a control transfer gets an error
-                 * during the setup stage */
-                urb->actual_length = max(urb->actual_length, 0);
                /* Note that the queue has stopped and save
                 * the next toggle value */
                qh->element = UHCI_PTR_TERM;
@@ -1323,7 +1323,6 @@ static int uhci_submit_isochronous(struct uhci_hcd *uhci, struct urb *urb,
        if (list_empty(&qh->queue)) {
                qh->iso_packet_desc = &urb->iso_frame_desc[0];
                qh->iso_frame = urb->start_frame;
-                qh->iso_status = 0;
        }
        qh->skel = SKEL_ISO;
@@ -1360,22 +1359,18 @@ static int uhci_result_isochronous(struct uhci_hcd *uhci, struct urb *urb)
                        qh->iso_packet_desc->actual_length = actlength;
                        qh->iso_packet_desc->status = status;
                }
+                if (status)
-                if (status) {
                        urb->error_count++;
-                        qh->iso_status = status;
-                }
                uhci_remove_td_from_urbp(td);
                uhci_free_td(uhci, td);
                qh->iso_frame += qh->period;
                ++qh->iso_packet_desc;
        }
-        return qh->iso_status;
+        return 0;
 }
 static int uhci_urb_enqueue(struct usb_hcd *hcd,
-                struct usb_host_endpoint *hep,
                struct urb *urb, gfp_t mem_flags)
 {
        int ret;
@@ -1386,19 +1381,19 @@ static int uhci_urb_enqueue(struct usb_hcd *hcd,
        spin_lock_irqsave(&uhci->lock, flags);
-        ret = urb->status;
+        ret = usb_hcd_link_urb_to_ep(hcd, urb);
-        if (ret != -EINPROGRESS)                /* URB already unlinked! */
+        if (ret)
-                goto done;
+                goto done_not_linked;
        ret = -ENOMEM;
        urbp = uhci_alloc_urb_priv(uhci, urb);
        if (!urbp)
                goto done;
-        if (hep->hcpriv)
+        if (urb->ep->hcpriv)
-                qh = (struct uhci_qh *) hep->hcpriv;
+                qh = urb->ep->hcpriv;
        else {
-                qh = uhci_alloc_qh(uhci, urb->dev, hep);
+                qh = uhci_alloc_qh(uhci, urb->dev, urb->ep);
                if (!qh)
                        goto err_no_qh;
        }
@@ -1439,27 +1434,29 @@ static int uhci_urb_enqueue(struct usb_hcd *hcd,
 err_submit_failed:
        if (qh->state == QH_STATE_IDLE)
                uhci_make_qh_idle(uhci, qh);    /* Reclaim unused QH */
 err_no_qh:
        uhci_free_urb_priv(uhci, urbp);
 done:
+        if (ret)
+                usb_hcd_unlink_urb_from_ep(hcd, urb);
+done_not_linked:
        spin_unlock_irqrestore(&uhci->lock, flags);
        return ret;
 }
-static int uhci_urb_dequeue(struct usb_hcd *hcd, struct urb *urb)
+static int uhci_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status)
 {
        struct uhci_hcd *uhci = hcd_to_uhci(hcd);
        unsigned long flags;
-        struct urb_priv *urbp;
        struct uhci_qh *qh;
+        int rc;
        spin_lock_irqsave(&uhci->lock, flags);
-        urbp = urb->hcpriv;
+        rc = usb_hcd_check_unlink_urb(hcd, urb, status);
-        if (!urbp)                      /* URB was never linked! */
+        if (rc)
                goto done;
-        qh = urbp->qh;
+        qh = ((struct urb_priv *) urb->hcpriv)->qh;
        /* Remove Isochronous TDs from the frame list ASAP */
        if (qh->type == USB_ENDPOINT_XFER_ISOC) {
@@ -1476,22 +1473,31 @@ static int uhci_urb_dequeue(struct usb_hcd *hcd, struct urb *urb)
 done:
        spin_unlock_irqrestore(&uhci->lock, flags);
-        return 0;
+        return rc;
 }
 /*
 * Finish unlinking an URB and give it back
 */
 static void uhci_giveback_urb(struct uhci_hcd *uhci, struct uhci_qh *qh,
-                struct urb *urb)
+                struct urb *urb, int status)
 __releases(uhci->lock)
 __acquires(uhci->lock)
 {
        struct urb_priv *urbp = (struct urb_priv *) urb->hcpriv;
+        if (qh->type == USB_ENDPOINT_XFER_CONTROL) {
+                /* urb->actual_length < 0 means the setup transaction didn't
+                 * complete successfully.  Either it failed or the URB was
+                 * unlinked first.  Regardless, don't confuse people with a
+                 * negative length. */
+                urb->actual_length = max(urb->actual_length, 0);
+        }
        /* When giving back the first URB in an Isochronous queue,
         * reinitialize the QH's iso-related members for the next URB. */
-        if (qh->type == USB_ENDPOINT_XFER_ISOC &&
+        else if (qh->type == USB_ENDPOINT_XFER_ISOC &&
                        urbp->node.prev == &qh->queue &&
                        urbp->node.next != &qh->queue) {
                struct urb *nurb = list_entry(urbp->node.next,
@@ -1499,7 +1505,6 @@ __acquires(uhci->lock)
                qh->iso_packet_desc = &nurb->iso_frame_desc[0];
                qh->iso_frame = nurb->start_frame;
-                qh->iso_status = 0;
        }
        /* Take the URB off the QH's queue.  If the queue is now empty,
@@ -1512,9 +1517,10 @@ __acquires(uhci->lock)
        }
        uhci_free_urb_priv(uhci, urbp);
+        usb_hcd_unlink_urb_from_ep(uhci_to_hcd(uhci), urb);
        spin_unlock(&uhci->lock);
-        usb_hcd_giveback_urb(uhci_to_hcd(uhci), urb);
+        usb_hcd_giveback_urb(uhci_to_hcd(uhci), urb, status);
        spin_lock(&uhci->lock);
        /* If the queue is now empty, we can unlink the QH and give up its
@@ -1550,24 +1556,17 @@ static void uhci_scan_qh(struct uhci_hcd *uhci, struct uhci_qh *qh)
                if (status == -EINPROGRESS)
                        break;
-                spin_lock(&urb->lock);
-                if (urb->status == -EINPROGRESS)        /* Not dequeued */
-                        urb->status = status;
-                else
-                        status = ECONNRESET;            /* Not -ECONNRESET */
-                spin_unlock(&urb->lock);
                /* Dequeued but completed URBs can't be given back unless
                 * the QH is stopped or has finished unlinking. */
-                if (status == ECONNRESET) {
+                if (urb->unlinked) {
                        if (QH_FINISHED_UNLINKING(qh))
                                qh->is_stopped = 1;
                        else if (!qh->is_stopped)
                                return;
                }
-                uhci_giveback_urb(uhci, qh, urb);
+                uhci_giveback_urb(uhci, qh, urb, status);
-                if (status < 0 && qh->type != USB_ENDPOINT_XFER_ISOC)
+                if (status < 0)
                        break;
        }
@@ -1582,7 +1581,7 @@ static void uhci_scan_qh(struct uhci_hcd *uhci, struct uhci_qh *qh)
 restart:
        list_for_each_entry(urbp, &qh->queue, node) {
                urb = urbp->urb;
-                if (urb->status != -EINPROGRESS) {
+                if (urb->unlinked) {
                        /* Fix up the TD links and save the toggles for
                         * non-Isochronous queues.  For Isochronous queues,
@@ -1591,7 +1590,7 @@ restart:
                                qh->is_stopped = 0;
                                return;
                        }
-                        uhci_giveback_urb(uhci, qh, urb);
+                        uhci_giveback_urb(uhci, qh, urb, 0);
                        goto restart;
                }
        }