Merge branch 'origin' into for-linus

Conflicts:
	MAINTAINERS

161 files changed, 12009 insertions, 2545 deletions

diff --git a/drivers/usb/Kconfig b/drivers/usb/Kconfig
index dcd49f1e96d0..240750881d28 100644
--- a/drivers/usb/Kconfig
+++ b/drivers/usb/Kconfig
@@ -22,7 +22,6 @@ config USB_ARCH_HAS_HCD
         default y if PCMCIA && !M32R                    # sl811_cs
         default y if ARM                                # SL-811
         default y if SUPERH                             # r8a66597-hcd
-        default y if MICROBLAZE
         default PCI
 
 # many non-PCI SOC chips embed OHCI
@@ -39,6 +38,7 @@ config USB_ARCH_HAS_OHCI
         default y if ARCH_AT91
         default y if ARCH_PNX4008 && I2C
         default y if MFD_TC6393XB
+        default y if ARCH_W90X900
         # PPC:
         default y if STB03xxx
         default y if PPC_MPC52xx
@@ -58,6 +58,8 @@ config USB_ARCH_HAS_EHCI
         default y if PPC_83xx
         default y if SOC_AU1200
         default y if ARCH_IXP4XX
+        default y if ARCH_W90X900
+        default y if ARCH_AT91SAM9G45
         default PCI
 
 # ARM SA1111 chips have a non-PCI based "OHCI-compatible" USB host interface.
diff --git a/drivers/usb/Makefile b/drivers/usb/Makefile
index 19cb7d5480d7..be3c9b80bc9f 100644
--- a/drivers/usb/Makefile
+++ b/drivers/usb/Makefile
@@ -16,6 +16,7 @@ obj-$(CONFIG_USB_UHCI_HCD)	+= host/
 obj-$(CONFIG_USB_FHCI_HCD)      += host/
 obj-$(CONFIG_USB_XHCI_HCD)      += host/
 obj-$(CONFIG_USB_SL811_HCD)     += host/
+obj-$(CONFIG_USB_ISP1362_HCD)   += host/
 obj-$(CONFIG_USB_U132_HCD)      += host/
 obj-$(CONFIG_USB_R8A66597_HCD)  += host/
 obj-$(CONFIG_USB_HWA_HCD)       += host/
@@ -39,6 +40,7 @@ obj-$(CONFIG_USB_MICROTEK)	+= image/
 obj-$(CONFIG_USB_SERIAL)        += serial/
 
 obj-$(CONFIG_USB)               += misc/
+obj-y                           += early/
 
 obj-$(CONFIG_USB_ATM)           += atm/
 obj-$(CONFIG_USB_SPEEDTOUCH)    += atm/
diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index 2bfc41ece0e1..e3861b21e776 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -59,6 +59,7 @@
 #include <linux/init.h>
 #include <linux/slab.h>
 #include <linux/tty.h>
+#include <linux/serial.h>
 #include <linux/tty_driver.h>
 #include <linux/tty_flip.h>
 #include <linux/module.h>
@@ -609,6 +610,7 @@ static int acm_tty_open(struct tty_struct *tty, struct file *filp)
         acm->throttle = 0;
 
         tasklet_schedule(&acm->urb_task);
+        set_bit(ASYNCB_INITIALIZED, &acm->port.flags);
         rv = tty_port_block_til_ready(&acm->port, tty, filp);
 done:
         mutex_unlock(&acm->mutex);
@@ -858,10 +860,7 @@ static void acm_tty_set_termios(struct tty_struct *tty,
         if (!ACM_READY(acm))
                 return;
 
-        /* FIXME: Needs to support the tty_baud interface */
-        /* FIXME: Broken on sparc */
-        newline.dwDTERate = cpu_to_le32p(acm_tty_speed +
-                (termios->c_cflag & CBAUD & ~CBAUDEX) + (termios->c_cflag & CBAUDEX ? 15 : 0));
+        newline.dwDTERate = cpu_to_le32(tty_get_baud_rate(tty));
         newline.bCharFormat = termios->c_cflag & CSTOPB ? 2 : 0;
         newline.bParityType = termios->c_cflag & PARENB ?
                                 (termios->c_cflag & PARODD ? 1 : 2) +
diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c
index ba589d4ca8bc..3e564bfe17d1 100644
--- a/drivers/usb/class/cdc-wdm.c
+++ b/drivers/usb/class/cdc-wdm.c
@@ -313,8 +313,13 @@ static ssize_t wdm_write
         r = usb_autopm_get_interface(desc->intf);
         if (r < 0)
                 goto outnp;
-        r = wait_event_interruptible(desc->wait, !test_bit(WDM_IN_USE,
-                                                           &desc->flags));
+
+        if (!file->f_flags && O_NONBLOCK)
+                r = wait_event_interruptible(desc->wait, !test_bit(WDM_IN_USE,
+                                                                &desc->flags));
+        else
+                if (test_bit(WDM_IN_USE, &desc->flags))
+                        r = -EAGAIN;
         if (r < 0)
                 goto out;
 
@@ -377,7 +382,7 @@ outnl:
 static ssize_t wdm_read
 (struct file *file, char __user *buffer, size_t count, loff_t *ppos)
 {
-        int rv, cntr;
+        int rv, cntr = 0;
         int i = 0;
         struct wdm_device *desc = file->private_data;
 
@@ -389,10 +394,23 @@ static ssize_t wdm_read
         if (desc->length == 0) {
                 desc->read = 0;
 retry:
+                if (test_bit(WDM_DISCONNECTING, &desc->flags)) {
+                        rv = -ENODEV;
+                        goto err;
+                }
                 i++;
-                rv = wait_event_interruptible(desc->wait,
-                                              test_bit(WDM_READ, &desc->flags));
+                if (file->f_flags & O_NONBLOCK) {
+                        if (!test_bit(WDM_READ, &desc->flags)) {
+                                rv = cntr ? cntr : -EAGAIN;
+                                goto err;
+                        }
+                        rv = 0;
+                } else {
+                        rv = wait_event_interruptible(desc->wait,
+                                test_bit(WDM_READ, &desc->flags));
+                }
 
+                /* may have happened while we slept */
                 if (test_bit(WDM_DISCONNECTING, &desc->flags)) {
                         rv = -ENODEV;
                         goto err;
@@ -448,7 +466,7 @@ retry:
 
 err:
         mutex_unlock(&desc->rlock);
-        if (rv < 0)
+        if (rv < 0 && rv != -EAGAIN)
                 dev_err(&desc->intf->dev, "wdm_read: exit error\n");
         return rv;
 }
@@ -506,8 +524,6 @@ static int wdm_open(struct inode *inode, struct file *file)
         desc = usb_get_intfdata(intf);
         if (test_bit(WDM_DISCONNECTING, &desc->flags))
                 goto out;
-
-        ;
         file->private_data = desc;
 
         rv = usb_autopm_get_interface(desc->intf);
diff --git a/drivers/usb/class/usblp.c b/drivers/usb/class/usblp.c
index 26c09f0257db..9bc112ee7803 100644
--- a/drivers/usb/class/usblp.c
+++ b/drivers/usb/class/usblp.c
@@ -1057,14 +1057,14 @@ static const struct file_operations usblp_fops = {
         .release =      usblp_release,
 };
 
-static char *usblp_nodename(struct device *dev)
+static char *usblp_devnode(struct device *dev, mode_t *mode)
 {
         return kasprintf(GFP_KERNEL, "usb/%s", dev_name(dev));
 }
 
 static struct usb_class_driver usblp_class = {
         .name =         "lp%d",
-        .nodename =     usblp_nodename,
+        .devnode =      usblp_devnode,
         .fops =         &usblp_fops,
         .minor_base =   USBLP_MINOR_BASE,
 };
diff --git a/drivers/usb/class/usbtmc.c b/drivers/usb/class/usbtmc.c
index b09a527f7341..333ee02e7b2b 100644
--- a/drivers/usb/class/usbtmc.c
+++ b/drivers/usb/class/usbtmc.c
@@ -57,7 +57,9 @@ MODULE_DEVICE_TABLE(usb, usbtmc_devices);
 
 /*
  * This structure is the capabilities for the device
- * See section 4.2.1.8 of the USBTMC specification for details.
+ * See section 4.2.1.8 of the USBTMC specification,
+ * and section 4.2.2 of the USBTMC usb488 subclass
+ * specification for details.
  */
 struct usbtmc_dev_capabilities {
         __u8 interface_capabilities;
@@ -86,6 +88,8 @@ struct usbtmc_device_data {
         bool TermCharEnabled;
         bool auto_abort;
 
+        bool zombie; /* fd of disconnected device */
+
         struct usbtmc_dev_capabilities  capabilities;
         struct kref kref;
         struct mutex io_mutex;  /* only one i/o function running at a time */
@@ -367,13 +371,13 @@ static ssize_t usbtmc_read(struct file *filp, char __user *buf,
 {
         struct usbtmc_device_data *data;
         struct device *dev;
-        unsigned long int n_characters;
+        u32 n_characters;
         u8 *buffer;
         int actual;
-        int done;
-        int remaining;
+        size_t done;
+        size_t remaining;
         int retval;
-        int this_part;
+        size_t this_part;
 
         /* Get pointer to private data structure */
         data = filp->private_data;
@@ -384,6 +388,10 @@ static ssize_t usbtmc_read(struct file *filp, char __user *buf,
                 return -ENOMEM;
 
         mutex_lock(&data->io_mutex);
+        if (data->zombie) {
+                retval = -ENODEV;
+                goto exit;
+        }
 
         remaining = count;
         done = 0;
@@ -401,10 +409,10 @@ static ssize_t usbtmc_read(struct file *filp, char __user *buf,
                 buffer[1] = data->bTag;
                 buffer[2] = ~(data->bTag);
                 buffer[3] = 0; /* Reserved */
-                buffer[4] = (this_part - 12 - 3) & 255;
-                buffer[5] = ((this_part - 12 - 3) >> 8) & 255;
-                buffer[6] = ((this_part - 12 - 3) >> 16) & 255;
-                buffer[7] = ((this_part - 12 - 3) >> 24) & 255;
+                buffer[4] = (this_part) & 255;
+                buffer[5] = ((this_part) >> 8) & 255;
+                buffer[6] = ((this_part) >> 16) & 255;
+                buffer[7] = ((this_part) >> 24) & 255;
                 buffer[8] = data->TermCharEnabled * 2;
                 /* Use term character? */
                 buffer[9] = data->TermChar;
@@ -455,6 +463,22 @@ static ssize_t usbtmc_read(struct file *filp, char __user *buf,
                                (buffer[6] << 16) +
                                (buffer[7] << 24);
 
+                /* Ensure the instrument doesn't lie about it */
+                if(n_characters > actual - 12) {
+                        dev_err(dev, "Device lies about message size: %u > %d\n", n_characters, actual - 12);
+                        n_characters = actual - 12;
+                }
+
+                /* Ensure the instrument doesn't send more back than requested */
+                if(n_characters > this_part) {
+                        dev_err(dev, "Device returns more than requested: %zu > %zu\n", done + n_characters, done + this_part);
+                        n_characters = this_part;
+                }
+
+                /* Bound amount of data received by amount of data requested */
+                if (n_characters > this_part)
+                        n_characters = this_part;
+
                 /* Copy buffer to user space */
                 if (copy_to_user(buf + done, &buffer[12], n_characters)) {
                         /* There must have been an addressing problem */
@@ -463,8 +487,11 @@ static ssize_t usbtmc_read(struct file *filp, char __user *buf,
                 }
 
                 done += n_characters;
-                if (n_characters < USBTMC_SIZE_IOBUFFER)
+                /* Terminate if end-of-message bit recieved from device */
+                if ((buffer[8] &  0x01) && (actual >= n_characters + 12))
                         remaining = 0;
+                else
+                        remaining -= n_characters;
         }
 
         /* Update file position value */
@@ -496,6 +523,10 @@ static ssize_t usbtmc_write(struct file *filp, const char __user *buf,
                 return -ENOMEM;
 
         mutex_lock(&data->io_mutex);
+        if (data->zombie) {
+                retval = -ENODEV;
+                goto exit;
+        }
 
         remaining = count;
         done = 0;
@@ -767,20 +798,21 @@ static int get_capabilities(struct usbtmc_device_data *data)
         }
 
         dev_dbg(dev, "GET_CAPABILITIES returned %x\n", buffer[0]);
-        dev_dbg(dev, "Interface capabilities are %x\n", buffer[4]);
-        dev_dbg(dev, "Device capabilities are %x\n", buffer[5]);
-        dev_dbg(dev, "USB488 interface capabilities are %x\n", buffer[14]);
-        dev_dbg(dev, "USB488 device capabilities are %x\n", buffer[15]);
         if (buffer[0] != USBTMC_STATUS_SUCCESS) {
                 dev_err(dev, "GET_CAPABILITIES returned %x\n", buffer[0]);
                 rv = -EPERM;
                 goto err_out;
         }
+        dev_dbg(dev, "Interface capabilities are %x\n", buffer[4]);
+        dev_dbg(dev, "Device capabilities are %x\n", buffer[5]);
+        dev_dbg(dev, "USB488 interface capabilities are %x\n", buffer[14]);
+        dev_dbg(dev, "USB488 device capabilities are %x\n", buffer[15]);
 
         data->capabilities.interface_capabilities = buffer[4];
         data->capabilities.device_capabilities = buffer[5];
         data->capabilities.usb488_interface_capabilities = buffer[14];
         data->capabilities.usb488_device_capabilities = buffer[15];
+        rv = 0;
 
 err_out:
         kfree(buffer);
@@ -925,6 +957,10 @@ static long usbtmc_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
 
         data = file->private_data;
         mutex_lock(&data->io_mutex);
+        if (data->zombie) {
+                retval = -ENODEV;
+                goto skip_io_on_zombie;
+        }
 
         switch (cmd) {
         case USBTMC_IOCTL_CLEAR_OUT_HALT:
@@ -952,6 +988,7 @@ static long usbtmc_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
                 break;
         }
 
+skip_io_on_zombie:
         mutex_unlock(&data->io_mutex);
         return retval;
 }
@@ -995,6 +1032,7 @@ static int usbtmc_probe(struct usb_interface *intf,
         usb_set_intfdata(intf, data);
         kref_init(&data->kref);
         mutex_init(&data->io_mutex);
+        data->zombie = 0;
 
         /* Initialize USBTMC bTag and other fields */
         data->bTag      = 1;
@@ -1065,14 +1103,30 @@ static void usbtmc_disconnect(struct usb_interface *intf)
         usb_deregister_dev(intf, &usbtmc_class);
         sysfs_remove_group(&intf->dev.kobj, &capability_attr_grp);
         sysfs_remove_group(&intf->dev.kobj, &data_attr_grp);
+        mutex_lock(&data->io_mutex);
+        data->zombie = 1;
+        mutex_unlock(&data->io_mutex);
         kref_put(&data->kref, usbtmc_delete);
 }
 
+static int usbtmc_suspend (struct usb_interface *intf, pm_message_t message)
+{
+        /* this driver does not have pending URBs */
+        return 0;
+}
+
+static int usbtmc_resume (struct usb_interface *intf)
+{
+        return 0;
+}
+
 static struct usb_driver usbtmc_driver = {
         .name           = "usbtmc",
         .id_table       = usbtmc_devices,
         .probe          = usbtmc_probe,
-        .disconnect     = usbtmc_disconnect
+        .disconnect     = usbtmc_disconnect,
+        .suspend        = usbtmc_suspend,
+        .resume         = usbtmc_resume,
 };
 
 static int __init usbtmc_init(void)
diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c
index a16c538d0132..0d3af6a6ee49 100644
--- a/drivers/usb/core/config.c
+++ b/drivers/usb/core/config.c
@@ -105,7 +105,7 @@ static int usb_parse_ss_endpoint_companion(struct device *ddev, int cfgno,
         ep->ss_ep_comp->extralen = i;
         buffer += i;
         size -= i;
-        retval = buffer - buffer_start + i;
+        retval = buffer - buffer_start;
         if (num_skipped > 0)
                 dev_dbg(ddev, "skipped %d descriptor%s after %s\n",
                                 num_skipped, plural(num_skipped),
diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
index 4247eccf858c..181f78c84105 100644
--- a/drivers/usb/core/devio.c
+++ b/drivers/usb/core/devio.c
@@ -52,6 +52,7 @@
 
 #include "hcd.h"        /* for usbcore internals */
 #include "usb.h"
+#include "hub.h"
 
 #define USB_MAXBUS                      64
 #define USB_DEVICE_MAX                  USB_MAXBUS * 128
@@ -73,6 +74,7 @@ struct dev_state {
         void __user *disccontext;
         unsigned long ifclaimed;
         u32 secid;
+        u32 disabled_bulk_eps;
 };
 
 struct async {
@@ -87,6 +89,8 @@ struct async {
         struct urb *urb;
         int status;
         u32 secid;
+        u8 bulk_addr;
+        u8 bulk_status;
 };
 
 static int usbfs_snoop;
@@ -99,11 +103,15 @@ MODULE_PARM_DESC(usbfs_snoop, "true to log all usbfs traffic");
                         dev_info(dev , format , ## arg);        \
         } while (0)
 
-#define USB_DEVICE_DEV          MKDEV(USB_DEVICE_MAJOR, 0)
+enum snoop_when {
+        SUBMIT, COMPLETE
+};
 
+#define USB_DEVICE_DEV          MKDEV(USB_DEVICE_MAJOR, 0)
 
 #define MAX_USBFS_BUFFER_SIZE   16384
 
+
 static int connected(struct dev_state *ps)
 {
         return (!list_empty(&ps->list) &&
@@ -300,24 +308,79 @@ static struct async *async_getpending(struct dev_state *ps,
         return NULL;
 }
 
-static void snoop_urb(struct urb *urb, void __user *userurb)
+static void snoop_urb(struct usb_device *udev,
+                void __user *userurb, int pipe, unsigned length,
+                int timeout_or_status, enum snoop_when when)
 {
-        unsigned j;
-        unsigned char *data = urb->transfer_buffer;
+        static const char *types[] = {"isoc", "int", "ctrl", "bulk"};
+        static const char *dirs[] = {"out", "in"};
+        int ep;
+        const char *t, *d;
 
         if (!usbfs_snoop)
                 return;
 
-        dev_info(&urb->dev->dev, "direction=%s\n",
-                        usb_urb_dir_in(urb) ? "IN" : "OUT");
-        dev_info(&urb->dev->dev, "userurb=%p\n", userurb);
-        dev_info(&urb->dev->dev, "transfer_buffer_length=%u\n",
-                 urb->transfer_buffer_length);
-        dev_info(&urb->dev->dev, "actual_length=%u\n", urb->actual_length);
-        dev_info(&urb->dev->dev, "data: ");
-        for (j = 0; j < urb->transfer_buffer_length; ++j)
-                printk("%02x ", data[j]);
-        printk("\n");
+        ep = usb_pipeendpoint(pipe);
+        t = types[usb_pipetype(pipe)];
+        d = dirs[!!usb_pipein(pipe)];
+
+        if (userurb) {          /* Async */
+                if (when == SUBMIT)
+                        dev_info(&udev->dev, "userurb %p, ep%d %s-%s, "
+                                        "length %u\n",
+                                        userurb, ep, t, d, length);
+                else
+                        dev_info(&udev->dev, "userurb %p, ep%d %s-%s, "
+                                        "actual_length %u status %d\n",
+                                        userurb, ep, t, d, length,
+                                        timeout_or_status);
+        } else {
+                if (when == SUBMIT)
+                        dev_info(&udev->dev, "ep%d %s-%s, length %u, "
+                                        "timeout %d\n",
+                                        ep, t, d, length, timeout_or_status);
+                else
+                        dev_info(&udev->dev, "ep%d %s-%s, actual_length %u, "
+                                        "status %d\n",
+                                        ep, t, d, length, timeout_or_status);
+        }
+}
+
+#define AS_CONTINUATION 1
+#define AS_UNLINK       2
+
+static void cancel_bulk_urbs(struct dev_state *ps, unsigned bulk_addr)
+__releases(ps->lock)
+__acquires(ps->lock)
+{
+        struct async *as;
+
+        /* Mark all the pending URBs that match bulk_addr, up to but not
+         * including the first one without AS_CONTINUATION.  If such an
+         * URB is encountered then a new transfer has already started so
+         * the endpoint doesn't need to be disabled; otherwise it does.
+         */
+        list_for_each_entry(as, &ps->async_pending, asynclist) {
+                if (as->bulk_addr == bulk_addr) {
+                        if (as->bulk_status != AS_CONTINUATION)
+                                goto rescan;
+                        as->bulk_status = AS_UNLINK;
+                        as->bulk_addr = 0;
+                }
+        }
+        ps->disabled_bulk_eps |= (1 << bulk_addr);
+
+        /* Now carefully unlink all the marked pending URBs */
+ rescan:
+        list_for_each_entry(as, &ps->async_pending, asynclist) {
+                if (as->bulk_status == AS_UNLINK) {
+                        as->bulk_status = 0;            /* Only once */
+                        spin_unlock(&ps->lock);         /* Allow completions */
+                        usb_unlink_urb(as->urb);
+                        spin_lock(&ps->lock);
+                        goto rescan;
+                }
+        }
 }
 
 static void async_completed(struct urb *urb)
@@ -346,7 +409,11 @@ static void async_completed(struct urb *urb)
                 secid = as->secid;
         }
         snoop(&urb->dev->dev, "urb complete\n");
-        snoop_urb(urb, as->userurb);
+        snoop_urb(urb->dev, as->userurb, urb->pipe, urb->actual_length,
+                        as->status, COMPLETE);
+        if (as->status < 0 && as->bulk_addr && as->status != -ECONNRESET &&
+                        as->status != -ENOENT)
+                cancel_bulk_urbs(ps, as->bulk_addr);
         spin_unlock(&ps->lock);
 
         if (signr)
@@ -655,6 +722,7 @@ static int usbdev_release(struct inode *inode, struct file *file)
         struct async *as;
 
         usb_lock_device(dev);
+        usb_hub_release_all_ports(dev, ps);
 
         /* Protect against simultaneous open */
         mutex_lock(&usbfs_mutex);
@@ -688,7 +756,7 @@ static int proc_control(struct dev_state *ps, void __user *arg)
         unsigned int tmo;
         unsigned char *tbuf;
         unsigned wLength;
-        int i, j, ret;
+        int i, pipe, ret;
 
         if (copy_from_user(&ctrl, arg, sizeof(ctrl)))
                 return -EFAULT;
@@ -708,24 +776,17 @@ static int proc_control(struct dev_state *ps, void __user *arg)
                         free_page((unsigned long)tbuf);
                         return -EINVAL;
                 }
-                snoop(&dev->dev, "control read: bRequest=%02x "
-                                "bRrequestType=%02x wValue=%04x "
-                                "wIndex=%04x wLength=%04x\n",
-                        ctrl.bRequest, ctrl.bRequestType, ctrl.wValue,
-                                ctrl.wIndex, ctrl.wLength);
+                pipe = usb_rcvctrlpipe(dev, 0);
+                snoop_urb(dev, NULL, pipe, ctrl.wLength, tmo, SUBMIT);
 
                 usb_unlock_device(dev);
-                i = usb_control_msg(dev, usb_rcvctrlpipe(dev, 0), ctrl.bRequest,
+                i = usb_control_msg(dev, pipe, ctrl.bRequest,
                                     ctrl.bRequestType, ctrl.wValue, ctrl.wIndex,
                                     tbuf, ctrl.wLength, tmo);
                 usb_lock_device(dev);
+                snoop_urb(dev, NULL, pipe, max(i, 0), min(i, 0), COMPLETE);
+
                 if ((i > 0) && ctrl.wLength) {
-                        if (usbfs_snoop) {
-                                dev_info(&dev->dev, "control read: data ");
-                                for (j = 0; j < i; ++j)
-                                        printk("%02x ", (u8)(tbuf)[j]);
-                                printk("\n");
-                        }
                         if (copy_to_user(ctrl.data, tbuf, i)) {
                                 free_page((unsigned long)tbuf);
                                 return -EFAULT;
@@ -738,22 +799,15 @@ static int proc_control(struct dev_state *ps, void __user *arg)
                                 return -EFAULT;
                         }
                 }
-                snoop(&dev->dev, "control write: bRequest=%02x "
-                                "bRrequestType=%02x wValue=%04x "
-                                "wIndex=%04x wLength=%04x\n",
-                        ctrl.bRequest, ctrl.bRequestType, ctrl.wValue,
-                                ctrl.wIndex, ctrl.wLength);
-                if (usbfs_snoop) {
-                        dev_info(&dev->dev, "control write: data: ");
-                        for (j = 0; j < ctrl.wLength; ++j)
-                                printk("%02x ", (unsigned char)(tbuf)[j]);
-                        printk("\n");
-                }
+                pipe = usb_sndctrlpipe(dev, 0);
+                snoop_urb(dev, NULL, pipe, ctrl.wLength, tmo, SUBMIT);
+
                 usb_unlock_device(dev);
                 i = usb_control_msg(dev, usb_sndctrlpipe(dev, 0), ctrl.bRequest,
                                     ctrl.bRequestType, ctrl.wValue, ctrl.wIndex,
                                     tbuf, ctrl.wLength, tmo);
                 usb_lock_device(dev);
+                snoop_urb(dev, NULL, pipe, max(i, 0), min(i, 0), COMPLETE);
         }
         free_page((unsigned long)tbuf);
         if (i < 0 && i != -EPIPE) {
@@ -772,7 +826,7 @@ static int proc_bulk(struct dev_state *ps, void __user *arg)
         unsigned int tmo, len1, pipe;
         int len2;
         unsigned char *tbuf;
-        int i, j, ret;
+        int i, ret;
 
         if (copy_from_user(&bulk, arg, sizeof(bulk)))
                 return -EFAULT;
@@ -799,18 +853,14 @@ static int proc_bulk(struct dev_state *ps, void __user *arg)
                         kfree(tbuf);
                         return -EINVAL;
                 }
-                snoop(&dev->dev, "bulk read: len=0x%02x timeout=%04d\n",
-                        bulk.len, bulk.timeout);
+                snoop_urb(dev, NULL, pipe, len1, tmo, SUBMIT);
+
                 usb_unlock_device(dev);
                 i = usb_bulk_msg(dev, pipe, tbuf, len1, &len2, tmo);
                 usb_lock_device(dev);
+                snoop_urb(dev, NULL, pipe, len2, i, COMPLETE);
+
                 if (!i && len2) {
-                        if (usbfs_snoop) {
-                                dev_info(&dev->dev, "bulk read: data ");
-                                for (j = 0; j < len2; ++j)
-                                        printk("%02x ", (u8)(tbuf)[j]);
-                                printk("\n");
-                        }
                         if (copy_to_user(bulk.data, tbuf, len2)) {
                                 kfree(tbuf);
                                 return -EFAULT;
@@ -823,17 +873,12 @@ static int proc_bulk(struct dev_state *ps, void __user *arg)
                                 return -EFAULT;
                         }
                 }
-                snoop(&dev->dev, "bulk write: len=0x%02x timeout=%04d\n",
-                        bulk.len, bulk.timeout);
-                if (usbfs_snoop) {
-                        dev_info(&dev->dev, "bulk write: data: ");
-                        for (j = 0; j < len1; ++j)
-                                printk("%02x ", (unsigned char)(tbuf)[j]);
-                        printk("\n");
-                }
+                snoop_urb(dev, NULL, pipe, len1, tmo, SUBMIT);
+
                 usb_unlock_device(dev);
                 i = usb_bulk_msg(dev, pipe, tbuf, len1, &len2, tmo);
                 usb_lock_device(dev);
+                snoop_urb(dev, NULL, pipe, len2, i, COMPLETE);
         }
         kfree(tbuf);
         if (i < 0)
@@ -991,6 +1036,7 @@ static int proc_do_submiturb(struct dev_state *ps, struct usbdevfs_urb *uurb,
 
         if (uurb->flags & ~(USBDEVFS_URB_ISO_ASAP |
                                 USBDEVFS_URB_SHORT_NOT_OK |
+                                USBDEVFS_URB_BULK_CONTINUATION |
                                 USBDEVFS_URB_NO_FSBR |
                                 USBDEVFS_URB_ZERO_PACKET |
                                 USBDEVFS_URB_NO_INTERRUPT))
@@ -1051,13 +1097,6 @@ static int proc_do_submiturb(struct dev_state *ps, struct usbdevfs_urb *uurb,
                         is_in = 0;
                         uurb->endpoint &= ~USB_DIR_IN;
                 }
-                snoop(&ps->dev->dev, "control urb: bRequest=%02x "
-                        "bRrequestType=%02x wValue=%04x "
-                        "wIndex=%04x wLength=%04x\n",
-                        dr->bRequest, dr->bRequestType,
-                        __le16_to_cpup(&dr->wValue),
-                        __le16_to_cpup(&dr->wIndex),
-                        __le16_to_cpup(&dr->wLength));
                 break;
 
         case USBDEVFS_URB_TYPE_BULK:
@@ -1070,7 +1109,6 @@ static int proc_do_submiturb(struct dev_state *ps, struct usbdevfs_urb *uurb,
                 uurb->number_of_packets = 0;
                 if (uurb->buffer_length > MAX_USBFS_BUFFER_SIZE)
                         return -EINVAL;
-                snoop(&ps->dev->dev, "bulk urb\n");
                 break;
 
         case USBDEVFS_URB_TYPE_ISO:
@@ -1097,12 +1135,12 @@ static int proc_do_submiturb(struct dev_state *ps, struct usbdevfs_urb *uurb,
                         }
                         totlen += isopkt[u].length;
                 }
-                if (totlen > 32768) {
+                /* 3072 * 64 microframes */
+                if (totlen > 196608) {
                         kfree(isopkt);
                         return -EINVAL;
                 }
                 uurb->buffer_length = totlen;
-                snoop(&ps->dev->dev, "iso urb\n");
                 break;
 
         case USBDEVFS_URB_TYPE_INTERRUPT:
@@ -1111,7 +1149,6 @@ static int proc_do_submiturb(struct dev_state *ps, struct usbdevfs_urb *uurb,
                         return -EINVAL;
                 if (uurb->buffer_length > MAX_USBFS_BUFFER_SIZE)
                         return -EINVAL;
-                snoop(&ps->dev->dev, "interrupt urb\n");
                 break;
 
         default:
@@ -1198,11 +1235,46 @@ static int proc_do_submiturb(struct dev_state *ps, struct usbdevfs_urb *uurb,
                         return -EFAULT;
                 }
         }
-        snoop_urb(as->urb, as->userurb);
+        snoop_urb(ps->dev, as->userurb, as->urb->pipe,
+                        as->urb->transfer_buffer_length, 0, SUBMIT);
         async_newpending(as);
-        if ((ret = usb_submit_urb(as->urb, GFP_KERNEL))) {
+
+        if (usb_endpoint_xfer_bulk(&ep->desc)) {
+                spin_lock_irq(&ps->lock);
+
+                /* Not exactly the endpoint address; the direction bit is
+                 * shifted to the 0x10 position so that the value will be
+                 * between 0 and 31.
+                 */
+                as->bulk_addr = usb_endpoint_num(&ep->desc) |
+                        ((ep->desc.bEndpointAddress & USB_ENDPOINT_DIR_MASK)
+                                >> 3);
+
+                /* If this bulk URB is the start of a new transfer, re-enable
+                 * the endpoint.  Otherwise mark it as a continuation URB.
+                 */
+                if (uurb->flags & USBDEVFS_URB_BULK_CONTINUATION)
+                        as->bulk_status = AS_CONTINUATION;
+                else
+                        ps->disabled_bulk_eps &= ~(1 << as->bulk_addr);
+
+                /* Don't accept continuation URBs if the endpoint is
+                 * disabled because of an earlier error.
+                 */
+                if (ps->disabled_bulk_eps & (1 << as->bulk_addr))
+                        ret = -EREMOTEIO;
+                else
+                        ret = usb_submit_urb(as->urb, GFP_ATOMIC);
+                spin_unlock_irq(&ps->lock);
+        } else {
+                ret = usb_submit_urb(as->urb, GFP_KERNEL);
+        }
+
+        if (ret) {
                 dev_printk(KERN_DEBUG, &ps->dev->dev,
                            "usbfs: usb_submit_urb returned %d\n", ret);
+                snoop_urb(ps->dev, as->userurb, as->urb->pipe,
+                                0, ret, COMPLETE);
                 async_removepending(as);
                 free_async(as);
                 return ret;
@@ -1548,6 +1620,29 @@ static int proc_ioctl_compat(struct dev_state *ps, compat_uptr_t arg)
 }
 #endif
 
+static int proc_claim_port(struct dev_state *ps, void __user *arg)
+{
+        unsigned portnum;
+        int rc;
+
+        if (get_user(portnum, (unsigned __user *) arg))
+                return -EFAULT;
+        rc = usb_hub_claim_port(ps->dev, portnum, ps);
+        if (rc == 0)
+                snoop(&ps->dev->dev, "port %d claimed by process %d: %s\n",
+                        portnum, task_pid_nr(current), current->comm);
+        return rc;
+}
+
+static int proc_release_port(struct dev_state *ps, void __user *arg)
+{
+        unsigned portnum;
+
+        if (get_user(portnum, (unsigned __user *) arg))
+                return -EFAULT;
+        return usb_hub_release_port(ps->dev, portnum, ps);
+}
+
 /*
  * NOTE:  All requests here that have interface numbers as parameters
  * are assuming that somehow the configuration has been prevented from
@@ -1645,7 +1740,7 @@ static int usbdev_ioctl(struct inode *inode, struct file *file,
                 break;
 
         case USBDEVFS_REAPURBNDELAY32:
-                snoop(&dev->dev, "%s: REAPURBDELAY32\n", __func__);
+                snoop(&dev->dev, "%s: REAPURBNDELAY32\n", __func__);
                 ret = proc_reapurbnonblock_compat(ps, p);
                 break;
 
@@ -1666,7 +1761,7 @@ static int usbdev_ioctl(struct inode *inode, struct file *file,
                 break;
 
         case USBDEVFS_REAPURBNDELAY:
-                snoop(&dev->dev, "%s: REAPURBDELAY\n", __func__);
+                snoop(&dev->dev, "%s: REAPURBNDELAY\n", __func__);
                 ret = proc_reapurbnonblock(ps, p);
                 break;
 
@@ -1689,6 +1784,16 @@ static int usbdev_ioctl(struct inode *inode, struct file *file,
                 snoop(&dev->dev, "%s: IOCTL\n", __func__);
                 ret = proc_ioctl_default(ps, p);
                 break;
+
+        case USBDEVFS_CLAIM_PORT:
+                snoop(&dev->dev, "%s: CLAIM_PORT\n", __func__);
+                ret = proc_claim_port(ps, p);
+                break;
+
+        case USBDEVFS_RELEASE_PORT:
+                snoop(&dev->dev, "%s: RELEASE_PORT\n", __func__);
+                ret = proc_release_port(ps, p);
+                break;
         }
         usb_unlock_device(dev);
         if (ret >= 0)
diff --git a/drivers/usb/core/driver.c b/drivers/usb/core/driver.c
index 69e5773abfce..4f864472c5c4 100644
--- a/drivers/usb/core/driver.c
+++ b/drivers/usb/core/driver.c
@@ -207,6 +207,9 @@ static int usb_probe_interface(struct device *dev)
 
         intf->needs_binding = 0;
 
+        if (usb_device_is_owned(udev))
+                return -ENODEV;
+
         if (udev->authorized == 0) {
                 dev_err(&intf->dev, "Device is not authorized for usage\n");
                 return -ENODEV;
@@ -232,28 +235,35 @@ static int usb_probe_interface(struct device *dev)
                 /* The interface should always appear to be in use
                  * unless the driver suports autosuspend.
                  */
-                intf->pm_usage_cnt = !(driver->supports_autosuspend);
+                atomic_set(&intf->pm_usage_cnt, !driver->supports_autosuspend);
 
                 /* Carry out a deferred switch to altsetting 0 */
                 if (intf->needs_altsetting0) {
-                        usb_set_interface(udev, intf->altsetting[0].
+                        error = usb_set_interface(udev, intf->altsetting[0].
                                         desc.bInterfaceNumber, 0);
+                        if (error < 0)
+                                goto err;
+
                         intf->needs_altsetting0 = 0;
                 }
 
                 error = driver->probe(intf, id);
-                if (error) {
-                        mark_quiesced(intf);
-                        intf->needs_remote_wakeup = 0;
-                        intf->condition = USB_INTERFACE_UNBOUND;
-                        usb_cancel_queued_reset(intf);
-                } else
-                        intf->condition = USB_INTERFACE_BOUND;
+                if (error)
+                        goto err;
 
+                intf->condition = USB_INTERFACE_BOUND;
                 usb_autosuspend_device(udev);
         }
 
         return error;
+
+err:
+        mark_quiesced(intf);
+        intf->needs_remote_wakeup = 0;
+        intf->condition = USB_INTERFACE_UNBOUND;
+        usb_cancel_queued_reset(intf);
+        usb_autosuspend_device(udev);
+        return error;
 }
 
 /* called from driver core with dev locked */
@@ -262,7 +272,7 @@ static int usb_unbind_interface(struct device *dev)
         struct usb_driver *driver = to_usb_driver(dev->driver);
         struct usb_interface *intf = to_usb_interface(dev);
         struct usb_device *udev;
-        int error;
+        int error, r;
 
         intf->condition = USB_INTERFACE_UNBINDING;
 
@@ -290,11 +300,14 @@ static int usb_unbind_interface(struct device *dev)
                  * Just re-enable it without affecting the endpoint toggles.
                  */
                 usb_enable_interface(udev, intf, false);
-        } else if (!error && intf->dev.power.status == DPM_ON)
-                usb_set_interface(udev, intf->altsetting[0].
+        } else if (!error && intf->dev.power.status == DPM_ON) {
+                r = usb_set_interface(udev, intf->altsetting[0].
                                 desc.bInterfaceNumber, 0);
-        else
+                if (r < 0)
+                        intf->needs_altsetting0 = 1;
+        } else {
                 intf->needs_altsetting0 = 1;
+        }
         usb_set_intfdata(intf, NULL);
 
         intf->condition = USB_INTERFACE_UNBOUND;
@@ -344,7 +357,7 @@ int usb_driver_claim_interface(struct usb_driver *driver,
         usb_pm_lock(udev);
         iface->condition = USB_INTERFACE_BOUND;
         mark_active(iface);
-        iface->pm_usage_cnt = !(driver->supports_autosuspend);
+        atomic_set(&iface->pm_usage_cnt, !driver->supports_autosuspend);
         usb_pm_unlock(udev);
 
         /* if interface was already added, bind now; else let
@@ -1065,7 +1078,7 @@ static int autosuspend_check(struct usb_device *udev, int reschedule)
                         intf = udev->actconfig->interface[i];
                         if (!is_active(intf))
                                 continue;
-                        if (intf->pm_usage_cnt > 0)
+                        if (atomic_read(&intf->pm_usage_cnt) > 0)
                                 return -EBUSY;
                         if (intf->needs_remote_wakeup &&
                                         !udev->do_remote_wakeup) {
@@ -1461,17 +1474,19 @@ static int usb_autopm_do_interface(struct usb_interface *intf,
                 status = -ENODEV;
         else {
                 udev->auto_pm = 1;
-                intf->pm_usage_cnt += inc_usage_cnt;
+                atomic_add(inc_usage_cnt, &intf->pm_usage_cnt);
                 udev->last_busy = jiffies;
-                if (inc_usage_cnt >= 0 && intf->pm_usage_cnt > 0) {
+                if (inc_usage_cnt >= 0 &&
+                                atomic_read(&intf->pm_usage_cnt) > 0) {
                         if (udev->state == USB_STATE_SUSPENDED)
                                 status = usb_resume_both(udev,
                                                 PMSG_AUTO_RESUME);
                         if (status != 0)
-                                intf->pm_usage_cnt -= inc_usage_cnt;
+                                atomic_sub(inc_usage_cnt, &intf->pm_usage_cnt);
                         else
                                 udev->last_busy = jiffies;
-                } else if (inc_usage_cnt <= 0 && intf->pm_usage_cnt <= 0) {
+                } else if (inc_usage_cnt <= 0 &&
+                                atomic_read(&intf->pm_usage_cnt) <= 0) {
                         status = usb_suspend_both(udev, PMSG_AUTO_SUSPEND);
                 }
         }
@@ -1516,7 +1531,7 @@ void usb_autopm_put_interface(struct usb_interface *intf)
 
         status = usb_autopm_do_interface(intf, -1);
         dev_vdbg(&intf->dev, "%s: status %d cnt %d\n",
-                        __func__, status, intf->pm_usage_cnt);
+                        __func__, status, atomic_read(&intf->pm_usage_cnt));
 }
 EXPORT_SYMBOL_GPL(usb_autopm_put_interface);
 
@@ -1544,10 +1559,10 @@ void usb_autopm_put_interface_async(struct usb_interface *intf)
                 status = -ENODEV;
         } else {
                 udev->last_busy = jiffies;
-                --intf->pm_usage_cnt;
+                atomic_dec(&intf->pm_usage_cnt);
                 if (udev->autosuspend_disabled || udev->autosuspend_delay < 0)
                         status = -EPERM;
-                else if (intf->pm_usage_cnt <= 0 &&
+                else if (atomic_read(&intf->pm_usage_cnt) <= 0 &&
                                 !timer_pending(&udev->autosuspend.timer)) {
                         queue_delayed_work(ksuspend_usb_wq, &udev->autosuspend,
                                         round_jiffies_up_relative(
@@ -1555,7 +1570,7 @@ void usb_autopm_put_interface_async(struct usb_interface *intf)
                 }
         }
         dev_vdbg(&intf->dev, "%s: status %d cnt %d\n",
-                        __func__, status, intf->pm_usage_cnt);
+                        __func__, status, atomic_read(&intf->pm_usage_cnt));
 }
 EXPORT_SYMBOL_GPL(usb_autopm_put_interface_async);
 
@@ -1599,7 +1614,7 @@ int usb_autopm_get_interface(struct usb_interface *intf)
 
         status = usb_autopm_do_interface(intf, 1);
         dev_vdbg(&intf->dev, "%s: status %d cnt %d\n",
-                        __func__, status, intf->pm_usage_cnt);
+                        __func__, status, atomic_read(&intf->pm_usage_cnt));
         return status;
 }
 EXPORT_SYMBOL_GPL(usb_autopm_get_interface);
@@ -1627,10 +1642,14 @@ int usb_autopm_get_interface_async(struct usb_interface *intf)
                 status = -ENODEV;
         else if (udev->autoresume_disabled)
                 status = -EPERM;
-        else if (++intf->pm_usage_cnt > 0 && udev->state == USB_STATE_SUSPENDED)
-                queue_work(ksuspend_usb_wq, &udev->autoresume);
+        else {
+                atomic_inc(&intf->pm_usage_cnt);
+                if (atomic_read(&intf->pm_usage_cnt) > 0 &&
+                                udev->state == USB_STATE_SUSPENDED)
+                        queue_work(ksuspend_usb_wq, &udev->autoresume);
+        }
         dev_vdbg(&intf->dev, "%s: status %d cnt %d\n",
-                        __func__, status, intf->pm_usage_cnt);
+                        __func__, status, atomic_read(&intf->pm_usage_cnt));
         return status;
 }
 EXPORT_SYMBOL_GPL(usb_autopm_get_interface_async);
@@ -1652,7 +1671,7 @@ int usb_autopm_set_interface(struct usb_interface *intf)
 
         status = usb_autopm_do_interface(intf, 0);
         dev_vdbg(&intf->dev, "%s: status %d cnt %d\n",
-                        __func__, status, intf->pm_usage_cnt);
+                        __func__, status, atomic_read(&intf->pm_usage_cnt));
         return status;
 }
 EXPORT_SYMBOL_GPL(usb_autopm_set_interface);
diff --git a/drivers/usb/core/file.c b/drivers/usb/core/file.c
index 5cef88929b3e..222ee07ea680 100644
--- a/drivers/usb/core/file.c
+++ b/drivers/usb/core/file.c
@@ -67,14 +67,14 @@ static struct usb_class {
         struct class *class;
 } *usb_class;
 
-static char *usb_nodename(struct device *dev)
+static char *usb_devnode(struct device *dev, mode_t *mode)
 {
         struct usb_class_driver *drv;
 
         drv = dev_get_drvdata(dev);
-        if (!drv || !drv->nodename)
+        if (!drv || !drv->devnode)
                 return NULL;
-        return drv->nodename(dev);
+        return drv->devnode(dev, mode);
 }
 
 static int init_usb_class(void)
@@ -100,7 +100,7 @@ static int init_usb_class(void)
                 kfree(usb_class);
                 usb_class = NULL;
         }
-        usb_class->class->nodename = usb_nodename;
+        usb_class->class->devnode = usb_devnode;
 
 exit:
         return result;
diff --git a/drivers/usb/core/generic.c b/drivers/usb/core/generic.c
index 30ecac3af15a..05e6d313961e 100644
--- a/drivers/usb/core/generic.c
+++ b/drivers/usb/core/generic.c
@@ -158,7 +158,9 @@ static int generic_probe(struct usb_device *udev)
         /* Choose and set the configuration.  This registers the interfaces
          * with the driver core and lets interface drivers bind to them.
          */
-        if (udev->authorized == 0)
+        if (usb_device_is_owned(udev))
+                ;               /* Don't configure if the device is owned */
+        else if (udev->authorized == 0)
                 dev_err(&udev->dev, "Device is not authorized for usage\n");
         else {
                 c = usb_choose_configuration(udev);
diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c
index 95ccfa0b9fc5..34de475f016e 100644
--- a/drivers/usb/core/hcd.c
+++ b/drivers/usb/core/hcd.c
@@ -337,72 +337,89 @@ static const u8 ss_rh_config_descriptor[] = {
 
 /*-------------------------------------------------------------------------*/
 
-/*
- * helper routine for returning string descriptors in UTF-16LE
- * input can actually be ISO-8859-1; ASCII is its 7-bit subset
+/**
+ * ascii2desc() - Helper routine for producing UTF-16LE string descriptors
+ * @s: Null-terminated ASCII (actually ISO-8859-1) string
+ * @buf: Buffer for USB string descriptor (header + UTF-16LE)
+ * @len: Length (in bytes; may be odd) of descriptor buffer.
+ *
+ * The return value is the number of bytes filled in: 2 + 2*strlen(s) or
+ * buflen, whichever is less.
+ *
+ * USB String descriptors can contain at most 126 characters; input
+ * strings longer than that are truncated.
  */
-static unsigned ascii2utf(char *s, u8 *utf, int utfmax)
+static unsigned
+ascii2desc(char const *s, u8 *buf, unsigned len)
 {
-        unsigned retval;
+        unsigned n, t = 2 + 2*strlen(s);
 
-        for (retval = 0; *s && utfmax > 1; utfmax -= 2, retval += 2) {
-                *utf++ = *s++;
-                *utf++ = 0;
-        }
-        if (utfmax > 0) {
-                *utf = *s;
-                ++retval;
+        if (t > 254)
+                t = 254;        /* Longest possible UTF string descriptor */
+        if (len > t)
+                len = t;
+
+        t += USB_DT_STRING << 8;        /* Now t is first 16 bits to store */
+
+        n = len;
+        while (n--) {
+                *buf++ = t;
+                if (!n--)
+                        break;
+                *buf++ = t >> 8;
+                t = (unsigned char)*s++;
         }
-        return retval;
+        return len;
 }
 
-/*
- * rh_string - provides manufacturer, product and serial strings for root hub
- * @id: the string ID number (1: serial number, 2: product, 3: vendor)
+/**
+ * rh_string() - provides string descriptors for root hub
+ * @id: the string ID number (0: langids, 1: serial #, 2: product, 3: vendor)
  * @hcd: the host controller for this root hub
- * @data: return packet in UTF-16 LE
- * @len: length of the return packet
+ * @data: buffer for output packet
+ * @len: length of the provided buffer
  *
  * Produces either a manufacturer, product or serial number string for the
  * virtual root hub device.
+ * Returns the number of bytes filled in: the length of the descriptor or
+ * of the provided buffer, whichever is less.
  */
-static unsigned rh_string(int id, struct usb_hcd *hcd, u8 *data, unsigned len)
+static unsigned
+rh_string(int id, struct usb_hcd const *hcd, u8 *data, unsigned len)
 {
-        char buf [100];
+        char buf[100];
+        char const *s;
+        static char const langids[4] = {4, USB_DT_STRING, 0x09, 0x04};
 
         // language ids
-        if (id == 0) {
-                buf[0] = 4;    buf[1] = 3;      /* 4 bytes string data */
-                buf[2] = 0x09; buf[3] = 0x04;   /* MSFT-speak for "en-us" */
-                len = min_t(unsigned, len, 4);
-                memcpy (data, buf, len);
+        switch (id) {
+        case 0:
+                /* Array of LANGID codes (0x0409 is MSFT-speak for "en-us") */
+                /* See http://www.usb.org/developers/docs/USB_LANGIDs.pdf */
+                if (len > 4)
+                        len = 4;
+                memcpy(data, langids, len);
                 return len;
-
-        // serial number
-        } else if (id == 1) {
-                strlcpy (buf, hcd->self.bus_name, sizeof buf);
-
-        // product description
-        } else if (id == 2) {
-                strlcpy (buf, hcd->product_desc, sizeof buf);
-
-        // id 3 == vendor description
-        } else if (id == 3) {
+        case 1:
+                /* Serial number */
+                s = hcd->self.bus_name;
+                break;
+        case 2:
+                /* Product name */
+                s = hcd->product_desc;
+                break;
+        case 3:
+                /* Manufacturer */
                 snprintf (buf, sizeof buf, "%s %s %s", init_utsname()->sysname,
                         init_utsname()->release, hcd->driver->description);
-        }
-
-        switch (len) {          /* All cases fall through */
+                s = buf;
+                break;
         default:
-                len = 2 + ascii2utf (buf, data + 2, len - 2);
-        case 2:
-                data [1] = 3;   /* type == string */
-        case 1:
-                data [0] = 2 * (strlen (buf) + 1);
-        case 0:
-                ;               /* Compiler wants a statement here */
+                /* Can't happen; caller guarantees it */
+                return 0;
         }
-        return len;
+
+        return ascii2desc(s, data, len);
 }
 
 
diff --git a/drivers/usb/core/hcd.h b/drivers/usb/core/hcd.h
index ec5c67ea07b7..79782a1c43f6 100644
--- a/drivers/usb/core/hcd.h
+++ b/drivers/usb/core/hcd.h
@@ -267,6 +267,11 @@ struct hc_driver {
         void    (*reset_bandwidth)(struct usb_hcd *, struct usb_device *);
                 /* Returns the hardware-chosen device address */
         int     (*address_device)(struct usb_hcd *, struct usb_device *udev);
+                /* Notifies the HCD after a hub descriptor is fetched.
+                 * Will block.
+                 */
+        int     (*update_hub_device)(struct usb_hcd *, struct usb_device *hdev,
+                        struct usb_tt *tt, gfp_t mem_flags);
 };
 
 extern int usb_hcd_link_urb_to_ep(struct usb_hcd *hcd, struct urb *urb);
diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index 71f86c60d83c..5ce839137ad6 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -78,6 +78,7 @@ struct usb_hub {
         u8                      indicator[USB_MAXCHILDREN];
         struct delayed_work     leds;
         struct delayed_work     init_work;
+        void                    **port_owners;
 };
 
 
@@ -162,8 +163,10 @@ static inline char *portspeed(int portstatus)
 }
 
 /* Note that hdev or one of its children must be locked! */
-static inline struct usb_hub *hdev_to_hub(struct usb_device *hdev)
+static struct usb_hub *hdev_to_hub(struct usb_device *hdev)
 {
+        if (!hdev || !hdev->actconfig)
+                return NULL;
         return usb_get_intfdata(hdev->actconfig->interface[0]);
 }
 
@@ -372,7 +375,7 @@ static void kick_khubd(struct usb_hub *hub)
         unsigned long   flags;
 
         /* Suppress autosuspend until khubd runs */
-        to_usb_interface(hub->intfdev)->pm_usage_cnt = 1;
+        atomic_set(&to_usb_interface(hub->intfdev)->pm_usage_cnt, 1);
 
         spin_lock_irqsave(&hub_event_lock, flags);
         if (!hub->disconnected && list_empty(&hub->event_list)) {
@@ -384,8 +387,10 @@ static void kick_khubd(struct usb_hub *hub)
 
 void usb_kick_khubd(struct usb_device *hdev)
 {
-        /* FIXME: What if hdev isn't bound to the hub driver? */
-        kick_khubd(hdev_to_hub(hdev));
+        struct usb_hub *hub = hdev_to_hub(hdev);
+
+        if (hub)
+                kick_khubd(hub);
 }
 
 
@@ -677,7 +682,8 @@ static void hub_activate(struct usb_hub *hub, enum hub_activation_type type)
                                         msecs_to_jiffies(delay));
 
                         /* Suppress autosuspend until init is done */
-                        to_usb_interface(hub->intfdev)->pm_usage_cnt = 1;
+                        atomic_set(&to_usb_interface(hub->intfdev)->
+                                        pm_usage_cnt, 1);
                         return;         /* Continues at init2: below */
                 } else {
                         hub_power_on(hub, true);
@@ -854,25 +860,24 @@ static int hub_post_reset(struct usb_interface *intf)
 static int hub_configure(struct usb_hub *hub,
         struct usb_endpoint_descriptor *endpoint)
 {
+        struct usb_hcd *hcd;
         struct usb_device *hdev = hub->hdev;
         struct device *hub_dev = hub->intfdev;
         u16 hubstatus, hubchange;
         u16 wHubCharacteristics;
         unsigned int pipe;
         int maxp, ret;
-        char *message;
+        char *message = "out of memory";
 
         hub->buffer = usb_buffer_alloc(hdev, sizeof(*hub->buffer), GFP_KERNEL,
                         &hub->buffer_dma);
         if (!hub->buffer) {
-                message = "can't allocate hub irq buffer";
                 ret = -ENOMEM;
                 goto fail;
         }
 
         hub->status = kmalloc(sizeof(*hub->status), GFP_KERNEL);
         if (!hub->status) {
-                message = "can't kmalloc hub status buffer";
                 ret = -ENOMEM;
                 goto fail;
         }
@@ -880,7 +885,6 @@ static int hub_configure(struct usb_hub *hub,
 
         hub->descriptor = kmalloc(sizeof(*hub->descriptor), GFP_KERNEL);
         if (!hub->descriptor) {
-                message = "can't kmalloc hub descriptor";
                 ret = -ENOMEM;
                 goto fail;
         }
@@ -904,6 +908,12 @@ static int hub_configure(struct usb_hub *hub,
         dev_info (hub_dev, "%d port%s detected\n", hdev->maxchild,
                 (hdev->maxchild == 1) ? "" : "s");
 
+        hub->port_owners = kzalloc(hdev->maxchild * sizeof(void *), GFP_KERNEL);
+        if (!hub->port_owners) {
+                ret = -ENOMEM;
+                goto fail;
+        }
+
         wHubCharacteristics = le16_to_cpu(hub->descriptor->wHubCharacteristics);
 
         if (wHubCharacteristics & HUB_CHAR_COMPOUND) {
@@ -1052,6 +1062,19 @@ static int hub_configure(struct usb_hub *hub,
                 dev_dbg(hub_dev, "%umA bus power budget for each child\n",
                                 hub->mA_per_port);
 
+        /* Update the HCD's internal representation of this hub before khubd
+         * starts getting port status changes for devices under the hub.
+         */
+        hcd = bus_to_hcd(hdev->bus);
+        if (hcd->driver->update_hub_device) {
+                ret = hcd->driver->update_hub_device(hcd, hdev,
+                                &hub->tt, GFP_KERNEL);
+                if (ret < 0) {
+                        message = "can't update HCD hub info";
+                        goto fail;
+                }
+        }
+
         ret = hub_hub_status(hub, &hubstatus, &hubchange);
         if (ret < 0) {
                 message = "can't get hub status";
@@ -1082,7 +1105,6 @@ static int hub_configure(struct usb_hub *hub,
 
         hub->urb = usb_alloc_urb(0, GFP_KERNEL);
         if (!hub->urb) {
-                message = "couldn't allocate interrupt urb";
                 ret = -ENOMEM;
                 goto fail;
         }
@@ -1131,11 +1153,13 @@ static void hub_disconnect(struct usb_interface *intf)
         hub_quiesce(hub, HUB_DISCONNECT);
 
         usb_set_intfdata (intf, NULL);
+        hub->hdev->maxchild = 0;
 
         if (hub->hdev->speed == USB_SPEED_HIGH)
                 highspeed_hubs--;
 
         usb_free_urb(hub->urb);
+        kfree(hub->port_owners);
         kfree(hub->descriptor);
         kfree(hub->status);
         usb_buffer_free(hub->hdev, sizeof(*hub->buffer), hub->buffer,
@@ -1250,6 +1274,79 @@ hub_ioctl(struct usb_interface *intf, unsigned int code, void *user_data)
         }
 }
 
+/*
+ * Allow user programs to claim ports on a hub.  When a device is attached
+ * to one of these "claimed" ports, the program will "own" the device.
+ */
+static int find_port_owner(struct usb_device *hdev, unsigned port1,
+                void ***ppowner)
+{
+        if (hdev->state == USB_STATE_NOTATTACHED)
+                return -ENODEV;
+        if (port1 == 0 || port1 > hdev->maxchild)
+                return -EINVAL;
+
+        /* This assumes that devices not managed by the hub driver
+         * will always have maxchild equal to 0.
+         */
+        *ppowner = &(hdev_to_hub(hdev)->port_owners[port1 - 1]);
+        return 0;
+}
+
+/* In the following three functions, the caller must hold hdev's lock */
+int usb_hub_claim_port(struct usb_device *hdev, unsigned port1, void *owner)
+{
+        int rc;
+        void **powner;
+
+        rc = find_port_owner(hdev, port1, &powner);
+        if (rc)
+                return rc;
+        if (*powner)
+                return -EBUSY;
+        *powner = owner;
+        return rc;
+}
+
+int usb_hub_release_port(struct usb_device *hdev, unsigned port1, void *owner)
+{
+        int rc;
+        void **powner;
+
+        rc = find_port_owner(hdev, port1, &powner);
+        if (rc)
+                return rc;
+        if (*powner != owner)
+                return -ENOENT;
+        *powner = NULL;
+        return rc;
+}
+
+void usb_hub_release_all_ports(struct usb_device *hdev, void *owner)
+{
+        int n;
+        void **powner;
+
+        n = find_port_owner(hdev, 1, &powner);
+        if (n == 0) {
+                for (; n < hdev->maxchild; (++n, ++powner)) {
+                        if (*powner == owner)
+                                *powner = NULL;
+                }
+        }
+}
+
+/* The caller must hold udev's lock */
+bool usb_device_is_owned(struct usb_device *udev)
+{
+        struct usb_hub *hub;
+
+        if (udev->state == USB_STATE_NOTATTACHED || !udev->parent)
+                return false;
+        hub = hdev_to_hub(udev->parent);
+        return !!hub->port_owners[udev->portnum - 1];
+}
+
 
 static void recursively_mark_NOTATTACHED(struct usb_device *udev)
 {
@@ -2849,14 +2946,7 @@ static void hub_port_connect_change(struct usb_hub *hub, int port1,
                         /* For a suspended device, treat this as a
                          * remote wakeup event.
                          */
-                        if (udev->do_remote_wakeup)
-                                status = remote_wakeup(udev);
-
-                        /* Otherwise leave it be; devices can't tell the
-                         * difference between suspended and disabled.
-                         */
-                        else
-                                status = 0;
+                        status = remote_wakeup(udev);
 #endif
 
                 } else {
diff --git a/drivers/usb/core/inode.c b/drivers/usb/core/inode.c
index ffe75e83787c..97b40ce133f0 100644
--- a/drivers/usb/core/inode.c
+++ b/drivers/usb/core/inode.c
@@ -48,7 +48,6 @@
 #define USBFS_DEFAULT_BUSMODE (S_IXUGO | S_IRUGO)
 #define USBFS_DEFAULT_LISTMODE S_IRUGO
 
-static struct super_operations usbfs_ops;
 static const struct file_operations default_file_operations;
 static struct vfsmount *usbfs_mount;
 static int usbfs_mount_count;   /* = 0 */
@@ -449,7 +448,7 @@ static const struct file_operations default_file_operations = {
         .llseek =       default_file_lseek,
 };
 
-static struct super_operations usbfs_ops = {
+static const struct super_operations usbfs_ops = {
         .statfs =       simple_statfs,
         .drop_inode =   generic_delete_inode,
         .remount_fs =   remount,
diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c
index 9720e699f472..da718e84d58d 100644
--- a/drivers/usb/core/message.c
+++ b/drivers/usb/core/message.c
@@ -459,35 +459,23 @@ int usb_sg_init(struct usb_sg_request *io, struct usb_device *dev,
                         io->urbs[i]->context = io;
 
                         /*
-                         * Some systems need to revert to PIO when DMA is
-                         * temporarily unavailable.  For their sakes, both
-                         * transfer_buffer and transfer_dma are set when
-                         * possible.  However this can only work on systems
-                         * without:
+                         * Some systems need to revert to PIO when DMA is temporarily
+                         * unavailable.  For their sakes, both transfer_buffer and
+                         * transfer_dma are set when possible.
                          *
-                         *  - HIGHMEM, since DMA buffers located in high memory
-                         *    are not directly addressable by the CPU for PIO;
-                         *
-                         *  - IOMMU, since dma_map_sg() is allowed to use an
-                         *    IOMMU to make virtually discontiguous buffers be
-                         *    "dma-contiguous" so that PIO and DMA need diferent
-                         *    numbers of URBs.
-                         *
-                         * So when HIGHMEM or IOMMU are in use, transfer_buffer
-                         * is NULL to prevent stale pointers and to help spot
-                         * bugs.
+                         * Note that if IOMMU coalescing occurred, we cannot
+                         * trust sg_page anymore, so check if S/G list shrunk.
                          */
+                        if (io->nents == io->entries && !PageHighMem(sg_page(sg)))
+                                io->urbs[i]->transfer_buffer = sg_virt(sg);
+                        else
+                                io->urbs[i]->transfer_buffer = NULL;
+
                         if (dma) {
                                 io->urbs[i]->transfer_dma = sg_dma_address(sg);
                                 len = sg_dma_len(sg);
-#if defined(CONFIG_HIGHMEM) || defined(CONFIG_GART_IOMMU)
-                                io->urbs[i]->transfer_buffer = NULL;
-#else
-                                io->urbs[i]->transfer_buffer = sg_virt(sg);
-#endif
                         } else {
                                 /* hc may use _only_ transfer_buffer */
-                                io->urbs[i]->transfer_buffer = sg_virt(sg);
                                 len = sg->length;
                         }
 
diff --git a/drivers/usb/core/usb.c b/drivers/usb/core/usb.c
index a26f73880c32..b1b85abb9a2d 100644
--- a/drivers/usb/core/usb.c
+++ b/drivers/usb/core/usb.c
@@ -311,7 +311,7 @@ static struct dev_pm_ops usb_device_pm_ops = {
 #endif  /* CONFIG_PM */
 
 
-static char *usb_nodename(struct device *dev)
+static char *usb_devnode(struct device *dev, mode_t *mode)
 {
         struct usb_device *usb_dev;
 
@@ -324,7 +324,7 @@ struct device_type usb_device_type = {
         .name =         "usb_device",
         .release =      usb_release_dev,
         .uevent =       usb_dev_uevent,
-        .nodename =     usb_nodename,
+        .devnode =      usb_devnode,
         .pm =           &usb_device_pm_ops,
 };
 
@@ -413,8 +413,13 @@ struct usb_device *usb_alloc_dev(struct usb_device *parent,
                 } else {
                         snprintf(dev->devpath, sizeof dev->devpath,
                                 "%s.%d", parent->devpath, port1);
-                        dev->route = parent->route +
-                                (port1 << ((parent->level - 1)*4));
+                        /* Route string assumes hubs have less than 16 ports */
+                        if (port1 < 15)
+                                dev->route = parent->route +
+                                        (port1 << ((parent->level - 1)*4));
+                        else
+                                dev->route = parent->route +
+                                        (15 << ((parent->level - 1)*4));
                 }
 
                 dev->dev.parent = &parent->dev;
@@ -914,11 +919,11 @@ int usb_buffer_map_sg(const struct usb_device *dev, int is_in,
                         || !(bus = dev->bus)
                         || !(controller = bus->controller)
                         || !controller->dma_mask)
-                return -1;
+                return -EINVAL;
 
         /* FIXME generic api broken like pci, can't report errors */
         return dma_map_sg(controller, sg, nents,
-                        is_in ? DMA_FROM_DEVICE : DMA_TO_DEVICE);
+                        is_in ? DMA_FROM_DEVICE : DMA_TO_DEVICE) ? : -ENOMEM;
 }
 EXPORT_SYMBOL_GPL(usb_buffer_map_sg);
 
diff --git a/drivers/usb/core/usb.h b/drivers/usb/core/usb.h
index c0e0ae2bb8e7..9a8b15e6377a 100644
--- a/drivers/usb/core/usb.h
+++ b/drivers/usb/core/usb.h
@@ -37,6 +37,13 @@ extern int usb_match_device(struct usb_device *dev,
 extern void usb_forced_unbind_intf(struct usb_interface *intf);
 extern void usb_rebind_intf(struct usb_interface *intf);
 
+extern int usb_hub_claim_port(struct usb_device *hdev, unsigned port,
+                void *owner);
+extern int usb_hub_release_port(struct usb_device *hdev, unsigned port,
+                void *owner);
+extern void usb_hub_release_all_ports(struct usb_device *hdev, void *owner);
+extern bool usb_device_is_owned(struct usb_device *udev);
+
 extern int  usb_hub_init(void);
 extern void usb_hub_cleanup(void);
 extern int usb_major_init(void);
diff --git a/drivers/usb/early/Makefile b/drivers/usb/early/Makefile
new file mode 100644
index 000000000000..dfedee8c45b6
--- /dev/null
+++ b/drivers/usb/early/Makefile
@@ -0,0 +1,5 @@
+#
+# Makefile for early USB devices
+#
+
+obj-$(CONFIG_EARLY_PRINTK_DBGP)        += ehci-dbgp.o
diff --git a/drivers/usb/early/ehci-dbgp.c b/drivers/usb/early/ehci-dbgp.c
new file mode 100644
index 000000000000..1206a26ef893
--- /dev/null
+++ b/drivers/usb/early/ehci-dbgp.c
@@ -0,0 +1,996 @@
+/*
+ * Standalone EHCI usb debug driver
+ *
+ * Originally written by:
+ *  Eric W. Biederman" <ebiederm@xmission.com> and
+ *  Yinghai Lu <yhlu.kernel@gmail.com>
+ *
+ * Changes for early/late printk and HW errata:
+ *  Jason Wessel <jason.wessel@windriver.com>
+ *  Copyright (C) 2009 Wind River Systems, Inc.
+ *
+ */
+
+#include <linux/console.h>
+#include <linux/errno.h>
+#include <linux/module.h>
+#include <linux/pci_regs.h>
+#include <linux/pci_ids.h>
+#include <linux/usb/ch9.h>
+#include <linux/usb/ehci_def.h>
+#include <linux/delay.h>
+#include <asm/io.h>
+#include <asm/pci-direct.h>
+#include <asm/fixmap.h>
+
+/* The code here is intended to talk directly to the EHCI debug port
+ * and does not require that you have any kind of USB host controller
+ * drivers or USB device drivers compiled into the kernel.
+ *
+ * If you make a change to anything in here, the following test cases
+ * need to pass where a USB debug device works in the following
+ * configurations.
+ *
+ * 1. boot args:  earlyprintk=dbgp
+ *     o kernel compiled with # CONFIG_USB_EHCI_HCD is not set
+ *     o kernel compiled with CONFIG_USB_EHCI_HCD=y
+ * 2. boot args: earlyprintk=dbgp,keep
+ *     o kernel compiled with # CONFIG_USB_EHCI_HCD is not set
+ *     o kernel compiled with CONFIG_USB_EHCI_HCD=y
+ * 3. boot args: earlyprintk=dbgp console=ttyUSB0
+ *     o kernel has CONFIG_USB_EHCI_HCD=y and
+ *       CONFIG_USB_SERIAL_DEBUG=y
+ * 4. boot args: earlyprintk=vga,dbgp
+ *     o kernel compiled with # CONFIG_USB_EHCI_HCD is not set
+ *     o kernel compiled with CONFIG_USB_EHCI_HCD=y
+ *
+ * For the 4th configuration you can turn on or off the DBGP_DEBUG
+ * such that you can debug the dbgp device's driver code.
+ */
+
+static int dbgp_phys_port = 1;
+
+static struct ehci_caps __iomem *ehci_caps;
+static struct ehci_regs __iomem *ehci_regs;
+static struct ehci_dbg_port __iomem *ehci_debug;
+static int dbgp_not_safe; /* Cannot use debug device during ehci reset */
+static unsigned int dbgp_endpoint_out;
+
+struct ehci_dev {
+        u32 bus;
+        u32 slot;
+        u32 func;
+};
+
+static struct ehci_dev ehci_dev;
+
+#define USB_DEBUG_DEVNUM 127
+
+#define DBGP_DATA_TOGGLE        0x8800
+
+#ifdef DBGP_DEBUG
+#define dbgp_printk printk
+static void dbgp_ehci_status(char *str)
+{
+        if (!ehci_debug)
+                return;
+        dbgp_printk("dbgp: %s\n", str);
+        dbgp_printk("  Debug control: %08x", readl(&ehci_debug->control));
+        dbgp_printk("  ehci cmd     : %08x", readl(&ehci_regs->command));
+        dbgp_printk("  ehci conf flg: %08x\n",
+                    readl(&ehci_regs->configured_flag));
+        dbgp_printk("  ehci status  : %08x", readl(&ehci_regs->status));
+        dbgp_printk("  ehci portsc  : %08x\n",
+                    readl(&ehci_regs->port_status[dbgp_phys_port - 1]));
+}
+#else
+static inline void dbgp_ehci_status(char *str) { }
+static inline void dbgp_printk(const char *fmt, ...) { }
+#endif
+
+static inline u32 dbgp_pid_update(u32 x, u32 tok)
+{
+        return ((x ^ DBGP_DATA_TOGGLE) & 0xffff00) | (tok & 0xff);
+}
+
+static inline u32 dbgp_len_update(u32 x, u32 len)
+{
+        return (x & ~0x0f) | (len & 0x0f);
+}
+
+/*
+ * USB Packet IDs (PIDs)
+ */
+
+/* token */
+#define USB_PID_OUT             0xe1
+#define USB_PID_IN              0x69
+#define USB_PID_SOF             0xa5
+#define USB_PID_SETUP           0x2d
+/* handshake */
+#define USB_PID_ACK             0xd2
+#define USB_PID_NAK             0x5a
+#define USB_PID_STALL           0x1e
+#define USB_PID_NYET            0x96
+/* data */
+#define USB_PID_DATA0           0xc3
+#define USB_PID_DATA1           0x4b
+#define USB_PID_DATA2           0x87
+#define USB_PID_MDATA           0x0f
+/* Special */
+#define USB_PID_PREAMBLE        0x3c
+#define USB_PID_ERR             0x3c
+#define USB_PID_SPLIT           0x78
+#define USB_PID_PING            0xb4
+#define USB_PID_UNDEF_0         0xf0
+
+#define USB_PID_DATA_TOGGLE     0x88
+#define DBGP_CLAIM (DBGP_OWNER | DBGP_ENABLED | DBGP_INUSE)
+
+#define PCI_CAP_ID_EHCI_DEBUG   0xa
+
+#define HUB_ROOT_RESET_TIME     50      /* times are in msec */
+#define HUB_SHORT_RESET_TIME    10
+#define HUB_LONG_RESET_TIME     200
+#define HUB_RESET_TIMEOUT       500
+
+#define DBGP_MAX_PACKET         8
+#define DBGP_TIMEOUT            (250 * 1000)
+
+static int dbgp_wait_until_complete(void)
+{
+        u32 ctrl;
+        int loop = DBGP_TIMEOUT;
+
+        do {
+                ctrl = readl(&ehci_debug->control);
+                /* Stop when the transaction is finished */
+                if (ctrl & DBGP_DONE)
+                        break;
+                udelay(1);
+        } while (--loop > 0);
+
+        if (!loop)
+                return -DBGP_TIMEOUT;
+
+        /*
+         * Now that we have observed the completed transaction,
+         * clear the done bit.
+         */
+        writel(ctrl | DBGP_DONE, &ehci_debug->control);
+        return (ctrl & DBGP_ERROR) ? -DBGP_ERRCODE(ctrl) : DBGP_LEN(ctrl);
+}
+
+static inline void dbgp_mdelay(int ms)
+{
+        int i;
+
+        while (ms--) {
+                for (i = 0; i < 1000; i++)
+                        outb(0x1, 0x80);
+        }
+}
+
+static void dbgp_breath(void)
+{
+        /* Sleep to give the debug port a chance to breathe */
+}
+
+static int dbgp_wait_until_done(unsigned ctrl)
+{
+        u32 pids, lpid;
+        int ret;
+        int loop = 3;
+
+retry:
+        writel(ctrl | DBGP_GO, &ehci_debug->control);
+        ret = dbgp_wait_until_complete();
+        pids = readl(&ehci_debug->pids);
+        lpid = DBGP_PID_GET(pids);
+
+        if (ret < 0) {
+                /* A -DBGP_TIMEOUT failure here means the device has
+                 * failed, perhaps because it was unplugged, in which
+                 * case we do not want to hang the system so the dbgp
+                 * will be marked as unsafe to use.  EHCI reset is the
+                 * only way to recover if you unplug the dbgp device.
+                 */
+                if (ret == -DBGP_TIMEOUT && !dbgp_not_safe)
+                        dbgp_not_safe = 1;
+                return ret;
+        }
+
+        /*
+         * If the port is getting full or it has dropped data
+         * start pacing ourselves, not necessary but it's friendly.
+         */
+        if ((lpid == USB_PID_NAK) || (lpid == USB_PID_NYET))
+                dbgp_breath();
+
+        /* If I get a NACK reissue the transmission */
+        if (lpid == USB_PID_NAK) {
+                if (--loop > 0)
+                        goto retry;
+        }
+
+        return ret;
+}
+
+static inline void dbgp_set_data(const void *buf, int size)
+{
+        const unsigned char *bytes = buf;
+        u32 lo, hi;
+        int i;
+
+        lo = hi = 0;
+        for (i = 0; i < 4 && i < size; i++)
+                lo |= bytes[i] << (8*i);
+        for (; i < 8 && i < size; i++)
+                hi |= bytes[i] << (8*(i - 4));
+        writel(lo, &ehci_debug->data03);
+        writel(hi, &ehci_debug->data47);
+}
+
+static inline void dbgp_get_data(void *buf, int size)
+{
+        unsigned char *bytes = buf;
+        u32 lo, hi;
+        int i;
+
+        lo = readl(&ehci_debug->data03);
+        hi = readl(&ehci_debug->data47);
+        for (i = 0; i < 4 && i < size; i++)
+                bytes[i] = (lo >> (8*i)) & 0xff;
+        for (; i < 8 && i < size; i++)
+                bytes[i] = (hi >> (8*(i - 4))) & 0xff;
+}
+
+static int dbgp_out(u32 addr, const char *bytes, int size)
+{
+        u32 pids, ctrl;
+
+        pids = readl(&ehci_debug->pids);
+        pids = dbgp_pid_update(pids, USB_PID_OUT);
+
+        ctrl = readl(&ehci_debug->control);
+        ctrl = dbgp_len_update(ctrl, size);
+        ctrl |= DBGP_OUT;
+        ctrl |= DBGP_GO;
+
+        dbgp_set_data(bytes, size);
+        writel(addr, &ehci_debug->address);
+        writel(pids, &ehci_debug->pids);
+        return dbgp_wait_until_done(ctrl);
+}
+
+static int dbgp_bulk_write(unsigned devnum, unsigned endpoint,
+                         const char *bytes, int size)
+{
+        int ret;
+        int loops = 5;
+        u32 addr;
+        if (size > DBGP_MAX_PACKET)
+                return -1;
+
+        addr = DBGP_EPADDR(devnum, endpoint);
+try_again:
+        if (loops--) {
+                ret = dbgp_out(addr, bytes, size);
+                if (ret == -DBGP_ERR_BAD) {
+                        int try_loops = 3;
+                        do {
+                                /* Emit a dummy packet to re-sync communication
+                                 * with the debug device */
+                                if (dbgp_out(addr, "12345678", 8) >= 0) {
+                                        udelay(2);
+                                        goto try_again;
+                                }
+                        } while (try_loops--);
+                }
+        }
+
+        return ret;
+}
+
+static int dbgp_bulk_read(unsigned devnum, unsigned endpoint, void *data,
+                                 int size)
+{
+        u32 pids, addr, ctrl;
+        int ret;
+
+        if (size > DBGP_MAX_PACKET)
+                return -1;
+
+        addr = DBGP_EPADDR(devnum, endpoint);
+
+        pids = readl(&ehci_debug->pids);
+        pids = dbgp_pid_update(pids, USB_PID_IN);
+
+        ctrl = readl(&ehci_debug->control);
+        ctrl = dbgp_len_update(ctrl, size);
+        ctrl &= ~DBGP_OUT;
+        ctrl |= DBGP_GO;
+
+        writel(addr, &ehci_debug->address);
+        writel(pids, &ehci_debug->pids);
+        ret = dbgp_wait_until_done(ctrl);
+        if (ret < 0)
+                return ret;
+
+        if (size > ret)
+                size = ret;
+        dbgp_get_data(data, size);
+        return ret;
+}
+
+static int dbgp_control_msg(unsigned devnum, int requesttype,
+        int request, int value, int index, void *data, int size)
+{
+        u32 pids, addr, ctrl;
+        struct usb_ctrlrequest req;
+        int read;
+        int ret;
+
+        read = (requesttype & USB_DIR_IN) != 0;
+        if (size > (read ? DBGP_MAX_PACKET:0))
+                return -1;
+
+        /* Compute the control message */
+        req.bRequestType = requesttype;
+        req.bRequest = request;
+        req.wValue = cpu_to_le16(value);
+        req.wIndex = cpu_to_le16(index);
+        req.wLength = cpu_to_le16(size);
+
+        pids = DBGP_PID_SET(USB_PID_DATA0, USB_PID_SETUP);
+        addr = DBGP_EPADDR(devnum, 0);
+
+        ctrl = readl(&ehci_debug->control);
+        ctrl = dbgp_len_update(ctrl, sizeof(req));
+        ctrl |= DBGP_OUT;
+        ctrl |= DBGP_GO;
+
+        /* Send the setup message */
+        dbgp_set_data(&req, sizeof(req));
+        writel(addr, &ehci_debug->address);
+        writel(pids, &ehci_debug->pids);
+        ret = dbgp_wait_until_done(ctrl);
+        if (ret < 0)
+                return ret;
+
+        /* Read the result */
+        return dbgp_bulk_read(devnum, 0, data, size);
+}
+
+
+/* Find a PCI capability */
+static u32 __init find_cap(u32 num, u32 slot, u32 func, int cap)
+{
+        u8 pos;
+        int bytes;
+
+        if (!(read_pci_config_16(num, slot, func, PCI_STATUS) &
+                PCI_STATUS_CAP_LIST))
+                return 0;
+
+        pos = read_pci_config_byte(num, slot, func, PCI_CAPABILITY_LIST);
+        for (bytes = 0; bytes < 48 && pos >= 0x40; bytes++) {
+                u8 id;
+
+                pos &= ~3;
+                id = read_pci_config_byte(num, slot, func, pos+PCI_CAP_LIST_ID);
+                if (id == 0xff)
+                        break;
+                if (id == cap)
+                        return pos;
+
+                pos = read_pci_config_byte(num, slot, func,
+                                                 pos+PCI_CAP_LIST_NEXT);
+        }
+        return 0;
+}
+
+static u32 __init __find_dbgp(u32 bus, u32 slot, u32 func)
+{
+        u32 class;
+
+        class = read_pci_config(bus, slot, func, PCI_CLASS_REVISION);
+        if ((class >> 8) != PCI_CLASS_SERIAL_USB_EHCI)
+                return 0;
+
+        return find_cap(bus, slot, func, PCI_CAP_ID_EHCI_DEBUG);
+}
+
+static u32 __init find_dbgp(int ehci_num, u32 *rbus, u32 *rslot, u32 *rfunc)
+{
+        u32 bus, slot, func;
+
+        for (bus = 0; bus < 256; bus++) {
+                for (slot = 0; slot < 32; slot++) {
+                        for (func = 0; func < 8; func++) {
+                                unsigned cap;
+
+                                cap = __find_dbgp(bus, slot, func);
+
+                                if (!cap)
+                                        continue;
+                                if (ehci_num-- != 0)
+                                        continue;
+                                *rbus = bus;
+                                *rslot = slot;
+                                *rfunc = func;
+                                return cap;
+                        }
+                }
+        }
+        return 0;
+}
+
+static int dbgp_ehci_startup(void)
+{
+        u32 ctrl, cmd, status;
+        int loop;
+
+        /* Claim ownership, but do not enable yet */
+        ctrl = readl(&ehci_debug->control);
+        ctrl |= DBGP_OWNER;
+        ctrl &= ~(DBGP_ENABLED | DBGP_INUSE);
+        writel(ctrl, &ehci_debug->control);
+        udelay(1);
+
+        dbgp_ehci_status("EHCI startup");
+        /* Start the ehci running */
+        cmd = readl(&ehci_regs->command);
+        cmd &= ~(CMD_LRESET | CMD_IAAD | CMD_PSE | CMD_ASE | CMD_RESET);
+        cmd |= CMD_RUN;
+        writel(cmd, &ehci_regs->command);
+
+        /* Ensure everything is routed to the EHCI */
+        writel(FLAG_CF, &ehci_regs->configured_flag);
+
+        /* Wait until the controller is no longer halted */
+        loop = 10;
+        do {
+                status = readl(&ehci_regs->status);
+                if (!(status & STS_HALT))
+                        break;
+                udelay(1);
+        } while (--loop > 0);
+
+        if (!loop) {
+                dbgp_printk("ehci can not be started\n");
+                return -ENODEV;
+        }
+        dbgp_printk("ehci started\n");
+        return 0;
+}
+
+static int dbgp_ehci_controller_reset(void)
+{
+        int loop = 250 * 1000;
+        u32 cmd;
+
+        /* Reset the EHCI controller */
+        cmd = readl(&ehci_regs->command);
+        cmd |= CMD_RESET;
+        writel(cmd, &ehci_regs->command);
+        do {
+                cmd = readl(&ehci_regs->command);
+        } while ((cmd & CMD_RESET) && (--loop > 0));
+
+        if (!loop) {
+                dbgp_printk("can not reset ehci\n");
+                return -1;
+        }
+        dbgp_ehci_status("ehci reset done");
+        return 0;
+}
+static int ehci_wait_for_port(int port);
+/* Return 0 on success
+ * Return -ENODEV for any general failure
+ * Return -EIO if wait for port fails
+ */
+int dbgp_external_startup(void)
+{
+        int devnum;
+        struct usb_debug_descriptor dbgp_desc;
+        int ret;
+        u32 ctrl, portsc, cmd;
+        int dbg_port = dbgp_phys_port;
+        int tries = 3;
+        int reset_port_tries = 1;
+        int try_hard_once = 1;
+
+try_port_reset_again:
+        ret = dbgp_ehci_startup();
+        if (ret)
+                return ret;
+
+        /* Wait for a device to show up in the debug port */
+        ret = ehci_wait_for_port(dbg_port);
+        if (ret < 0) {
+                portsc = readl(&ehci_regs->port_status[dbg_port - 1]);
+                if (!(portsc & PORT_CONNECT) && try_hard_once) {
+                        /* Last ditch effort to try to force enable
+                         * the debug device by using the packet test
+                         * ehci command to try and wake it up. */
+                        try_hard_once = 0;
+                        cmd = readl(&ehci_regs->command);
+                        cmd &= ~CMD_RUN;
+                        writel(cmd, &ehci_regs->command);
+                        portsc = readl(&ehci_regs->port_status[dbg_port - 1]);
+                        portsc |= PORT_TEST_PKT;
+                        writel(portsc, &ehci_regs->port_status[dbg_port - 1]);
+                        dbgp_ehci_status("Trying to force debug port online");
+                        mdelay(50);
+                        dbgp_ehci_controller_reset();
+                        goto try_port_reset_again;
+                } else if (reset_port_tries--) {
+                        goto try_port_reset_again;
+                }
+                dbgp_printk("No device found in debug port\n");
+                return -EIO;
+        }
+        dbgp_ehci_status("wait for port done");
+
+        /* Enable the debug port */
+        ctrl = readl(&ehci_debug->control);
+        ctrl |= DBGP_CLAIM;
+        writel(ctrl, &ehci_debug->control);
+        ctrl = readl(&ehci_debug->control);
+        if ((ctrl & DBGP_CLAIM) != DBGP_CLAIM) {
+                dbgp_printk("No device in debug port\n");
+                writel(ctrl & ~DBGP_CLAIM, &ehci_debug->control);
+                return -ENODEV;
+        }
+        dbgp_ehci_status("debug ported enabled");
+
+        /* Completely transfer the debug device to the debug controller */
+        portsc = readl(&ehci_regs->port_status[dbg_port - 1]);
+        portsc &= ~PORT_PE;
+        writel(portsc, &ehci_regs->port_status[dbg_port - 1]);
+
+        dbgp_mdelay(100);
+
+try_again:
+        /* Find the debug device and make it device number 127 */
+        for (devnum = 0; devnum <= 127; devnum++) {
+                ret = dbgp_control_msg(devnum,
+                        USB_DIR_IN | USB_TYPE_STANDARD | USB_RECIP_DEVICE,
+                        USB_REQ_GET_DESCRIPTOR, (USB_DT_DEBUG << 8), 0,
+                        &dbgp_desc, sizeof(dbgp_desc));
+                if (ret > 0)
+                        break;
+        }
+        if (devnum > 127) {
+                dbgp_printk("Could not find attached debug device\n");
+                goto err;
+        }
+        if (ret < 0) {
+                dbgp_printk("Attached device is not a debug device\n");
+                goto err;
+        }
+        dbgp_endpoint_out = dbgp_desc.bDebugOutEndpoint;
+
+        /* Move the device to 127 if it isn't already there */
+        if (devnum != USB_DEBUG_DEVNUM) {
+                ret = dbgp_control_msg(devnum,
+                        USB_DIR_OUT | USB_TYPE_STANDARD | USB_RECIP_DEVICE,
+                        USB_REQ_SET_ADDRESS, USB_DEBUG_DEVNUM, 0, NULL, 0);
+                if (ret < 0) {
+                        dbgp_printk("Could not move attached device to %d\n",
+                                USB_DEBUG_DEVNUM);
+                        goto err;
+                }
+                devnum = USB_DEBUG_DEVNUM;
+                dbgp_printk("debug device renamed to 127\n");
+        }
+
+        /* Enable the debug interface */
+        ret = dbgp_control_msg(USB_DEBUG_DEVNUM,
+                USB_DIR_OUT | USB_TYPE_STANDARD | USB_RECIP_DEVICE,
+                USB_REQ_SET_FEATURE, USB_DEVICE_DEBUG_MODE, 0, NULL, 0);
+        if (ret < 0) {
+                dbgp_printk(" Could not enable the debug device\n");
+                goto err;
+        }
+        dbgp_printk("debug interface enabled\n");
+        /* Perform a small write to get the even/odd data state in sync
+         */
+        ret = dbgp_bulk_write(USB_DEBUG_DEVNUM, dbgp_endpoint_out, " ", 1);
+        if (ret < 0) {
+                dbgp_printk("dbgp_bulk_write failed: %d\n", ret);
+                goto err;
+        }
+        dbgp_printk("small write doned\n");
+        dbgp_not_safe = 0;
+
+        return 0;
+err:
+        if (tries--)
+                goto try_again;
+        return -ENODEV;
+}
+EXPORT_SYMBOL_GPL(dbgp_external_startup);
+
+static int __init ehci_reset_port(int port)
+{
+        u32 portsc;
+        u32 delay_time, delay;
+        int loop;
+
+        dbgp_ehci_status("reset port");
+        /* Reset the usb debug port */
+        portsc = readl(&ehci_regs->port_status[port - 1]);
+        portsc &= ~PORT_PE;
+        portsc |= PORT_RESET;
+        writel(portsc, &ehci_regs->port_status[port - 1]);
+
+        delay = HUB_ROOT_RESET_TIME;
+        for (delay_time = 0; delay_time < HUB_RESET_TIMEOUT;
+             delay_time += delay) {
+                dbgp_mdelay(delay);
+                portsc = readl(&ehci_regs->port_status[port - 1]);
+                if (!(portsc & PORT_RESET))
+                        break;
+        }
+                if (portsc & PORT_RESET) {
+                        /* force reset to complete */
+                        loop = 100 * 1000;
+                        writel(portsc & ~(PORT_RWC_BITS | PORT_RESET),
+                                &ehci_regs->port_status[port - 1]);
+                        do {
+                                udelay(1);
+                                portsc = readl(&ehci_regs->port_status[port-1]);
+                        } while ((portsc & PORT_RESET) && (--loop > 0));
+                }
+
+                /* Device went away? */
+                if (!(portsc & PORT_CONNECT))
+                        return -ENOTCONN;
+
+                /* bomb out completely if something weird happend */
+                if ((portsc & PORT_CSC))
+                        return -EINVAL;
+
+                /* If we've finished resetting, then break out of the loop */
+                if (!(portsc & PORT_RESET) && (portsc & PORT_PE))
+                        return 0;
+        return -EBUSY;
+}
+
+static int ehci_wait_for_port(int port)
+{
+        u32 status;
+        int ret, reps;
+
+        for (reps = 0; reps < 300; reps++) {
+                status = readl(&ehci_regs->status);
+                if (status & STS_PCD)
+                        break;
+                dbgp_mdelay(1);
+        }
+        ret = ehci_reset_port(port);
+        if (ret == 0)
+                return 0;
+        return -ENOTCONN;
+}
+
+typedef void (*set_debug_port_t)(int port);
+
+static void __init default_set_debug_port(int port)
+{
+}
+
+static set_debug_port_t __initdata set_debug_port = default_set_debug_port;
+
+static void __init nvidia_set_debug_port(int port)
+{
+        u32 dword;
+        dword = read_pci_config(ehci_dev.bus, ehci_dev.slot, ehci_dev.func,
+                                 0x74);
+        dword &= ~(0x0f<<12);
+        dword |= ((port & 0x0f)<<12);
+        write_pci_config(ehci_dev.bus, ehci_dev.slot, ehci_dev.func, 0x74,
+                                 dword);
+        dbgp_printk("set debug port to %d\n", port);
+}
+
+static void __init detect_set_debug_port(void)
+{
+        u32 vendorid;
+
+        vendorid = read_pci_config(ehci_dev.bus, ehci_dev.slot, ehci_dev.func,
+                 0x00);
+
+        if ((vendorid & 0xffff) == 0x10de) {
+                dbgp_printk("using nvidia set_debug_port\n");
+                set_debug_port = nvidia_set_debug_port;
+        }
+}
+
+/* The code in early_ehci_bios_handoff() is derived from the usb pci
+ * quirk initialization, but altered so as to use the early PCI
+ * routines. */
+#define EHCI_USBLEGSUP_BIOS     (1 << 16)       /* BIOS semaphore */
+#define EHCI_USBLEGCTLSTS       4               /* legacy control/status */
+static void __init early_ehci_bios_handoff(void)
+{
+        u32 hcc_params = readl(&ehci_caps->hcc_params);
+        int offset = (hcc_params >> 8) & 0xff;
+        u32 cap;
+        int msec;
+
+        if (!offset)
+                return;
+
+        cap = read_pci_config(ehci_dev.bus, ehci_dev.slot,
+                              ehci_dev.func, offset);
+        dbgp_printk("dbgp: ehci BIOS state %08x\n", cap);
+
+        if ((cap & 0xff) == 1 && (cap & EHCI_USBLEGSUP_BIOS)) {
+                dbgp_printk("dbgp: BIOS handoff\n");
+                write_pci_config_byte(ehci_dev.bus, ehci_dev.slot,
+                                      ehci_dev.func, offset + 3, 1);
+        }
+
+        /* if boot firmware now owns EHCI, spin till it hands it over. */
+        msec = 1000;
+        while ((cap & EHCI_USBLEGSUP_BIOS) && (msec > 0)) {
+                mdelay(10);
+                msec -= 10;
+                cap = read_pci_config(ehci_dev.bus, ehci_dev.slot,
+                                      ehci_dev.func, offset);
+        }
+
+        if (cap & EHCI_USBLEGSUP_BIOS) {
+                /* well, possibly buggy BIOS... try to shut it down,
+                 * and hope nothing goes too wrong */
+                dbgp_printk("dbgp: BIOS handoff failed: %08x\n", cap);
+                write_pci_config_byte(ehci_dev.bus, ehci_dev.slot,
+                                      ehci_dev.func, offset + 2, 0);
+        }
+
+        /* just in case, always disable EHCI SMIs */
+        write_pci_config_byte(ehci_dev.bus, ehci_dev.slot, ehci_dev.func,
+                              offset + EHCI_USBLEGCTLSTS, 0);
+}
+
+static int __init ehci_setup(void)
+{
+        u32 ctrl, portsc, hcs_params;
+        u32 debug_port, new_debug_port = 0, n_ports;
+        int ret, i;
+        int port_map_tried;
+        int playtimes = 3;
+
+        early_ehci_bios_handoff();
+
+try_next_time:
+        port_map_tried = 0;
+
+try_next_port:
+
+        hcs_params = readl(&ehci_caps->hcs_params);
+        debug_port = HCS_DEBUG_PORT(hcs_params);
+        dbgp_phys_port = debug_port;
+        n_ports    = HCS_N_PORTS(hcs_params);
+
+        dbgp_printk("debug_port: %d\n", debug_port);
+        dbgp_printk("n_ports:    %d\n", n_ports);
+        dbgp_ehci_status("");
+
+        for (i = 1; i <= n_ports; i++) {
+                portsc = readl(&ehci_regs->port_status[i-1]);
+                dbgp_printk("portstatus%d: %08x\n", i, portsc);
+        }
+
+        if (port_map_tried && (new_debug_port != debug_port)) {
+                if (--playtimes) {
+                        set_debug_port(new_debug_port);
+                        goto try_next_time;
+                }
+                return -1;
+        }
+
+        /* Only reset the controller if it is not already in the
+         * configured state */
+        if (!(readl(&ehci_regs->configured_flag) & FLAG_CF)) {
+                if (dbgp_ehci_controller_reset() != 0)
+                        return -1;
+        } else {
+                dbgp_ehci_status("ehci skip - already configured");
+        }
+
+        ret = dbgp_external_startup();
+        if (ret == -EIO)
+                goto next_debug_port;
+
+        if (ret < 0) {
+                /* Things didn't work so remove my claim */
+                ctrl = readl(&ehci_debug->control);
+                ctrl &= ~(DBGP_CLAIM | DBGP_OUT);
+                writel(ctrl, &ehci_debug->control);
+                return -1;
+        }
+        return 0;
+
+next_debug_port:
+        port_map_tried |= (1<<(debug_port - 1));
+        new_debug_port = ((debug_port-1+1)%n_ports) + 1;
+        if (port_map_tried != ((1<<n_ports) - 1)) {
+                set_debug_port(new_debug_port);
+                goto try_next_port;
+        }
+        if (--playtimes) {
+                set_debug_port(new_debug_port);
+                goto try_next_time;
+        }
+
+        return -1;
+}
+
+int __init early_dbgp_init(char *s)
+{
+        u32 debug_port, bar, offset;
+        u32 bus, slot, func, cap;
+        void __iomem *ehci_bar;
+        u32 dbgp_num;
+        u32 bar_val;
+        char *e;
+        int ret;
+        u8 byte;
+
+        if (!early_pci_allowed())
+                return -1;
+
+        dbgp_num = 0;
+        if (*s)
+                dbgp_num = simple_strtoul(s, &e, 10);
+        dbgp_printk("dbgp_num: %d\n", dbgp_num);
+
+        cap = find_dbgp(dbgp_num, &bus, &slot, &func);
+        if (!cap)
+                return -1;
+
+        dbgp_printk("Found EHCI debug port on %02x:%02x.%1x\n", bus, slot,
+                         func);
+
+        debug_port = read_pci_config(bus, slot, func, cap);
+        bar = (debug_port >> 29) & 0x7;
+        bar = (bar * 4) + 0xc;
+        offset = (debug_port >> 16) & 0xfff;
+        dbgp_printk("bar: %02x offset: %03x\n", bar, offset);
+        if (bar != PCI_BASE_ADDRESS_0) {
+                dbgp_printk("only debug ports on bar 1 handled.\n");
+
+                return -1;
+        }
+
+        bar_val = read_pci_config(bus, slot, func, PCI_BASE_ADDRESS_0);
+        dbgp_printk("bar_val: %02x offset: %03x\n", bar_val, offset);
+        if (bar_val & ~PCI_BASE_ADDRESS_MEM_MASK) {
+                dbgp_printk("only simple 32bit mmio bars supported\n");
+
+                return -1;
+        }
+
+        /* double check if the mem space is enabled */
+        byte = read_pci_config_byte(bus, slot, func, 0x04);
+        if (!(byte & 0x2)) {
+                byte  |= 0x02;
+                write_pci_config_byte(bus, slot, func, 0x04, byte);
+                dbgp_printk("mmio for ehci enabled\n");
+        }
+
+        /*
+         * FIXME I don't have the bar size so just guess PAGE_SIZE is more
+         * than enough.  1K is the biggest I have seen.
+         */
+        set_fixmap_nocache(FIX_DBGP_BASE, bar_val & PAGE_MASK);
+        ehci_bar = (void __iomem *)__fix_to_virt(FIX_DBGP_BASE);
+        ehci_bar += bar_val & ~PAGE_MASK;
+        dbgp_printk("ehci_bar: %p\n", ehci_bar);
+
+        ehci_caps  = ehci_bar;
+        ehci_regs  = ehci_bar + HC_LENGTH(readl(&ehci_caps->hc_capbase));
+        ehci_debug = ehci_bar + offset;
+        ehci_dev.bus = bus;
+        ehci_dev.slot = slot;
+        ehci_dev.func = func;
+
+        detect_set_debug_port();
+
+        ret = ehci_setup();
+        if (ret < 0) {
+                dbgp_printk("ehci_setup failed\n");
+                ehci_debug = NULL;
+
+                return -1;
+        }
+        dbgp_ehci_status("early_init_complete");
+
+        return 0;
+}
+
+static void early_dbgp_write(struct console *con, const char *str, u32 n)
+{
+        int chunk, ret;
+        char buf[DBGP_MAX_PACKET];
+        int use_cr = 0;
+        u32 cmd, ctrl;
+        int reset_run = 0;
+
+        if (!ehci_debug || dbgp_not_safe)
+                return;
+
+        cmd = readl(&ehci_regs->command);
+        if (unlikely(!(cmd & CMD_RUN))) {
+                /* If the ehci controller is not in the run state do extended
+                 * checks to see if the acpi or some other initialization also
+                 * reset the ehci debug port */
+                ctrl = readl(&ehci_debug->control);
+                if (!(ctrl & DBGP_ENABLED)) {
+                        dbgp_not_safe = 1;
+                        dbgp_external_startup();
+                } else {
+                        cmd |= CMD_RUN;
+                        writel(cmd, &ehci_regs->command);
+                        reset_run = 1;
+                }
+        }
+        while (n > 0) {
+                for (chunk = 0; chunk < DBGP_MAX_PACKET && n > 0;
+                     str++, chunk++, n--) {
+                        if (!use_cr && *str == '\n') {
+                                use_cr = 1;
+                                buf[chunk] = '\r';
+                                str--;
+                                n++;
+                                continue;
+                        }
+                        if (use_cr)
+                                use_cr = 0;
+                        buf[chunk] = *str;
+                }
+                if (chunk > 0) {
+                        ret = dbgp_bulk_write(USB_DEBUG_DEVNUM,
+                                      dbgp_endpoint_out, buf, chunk);
+                }
+        }
+        if (unlikely(reset_run)) {
+                cmd = readl(&ehci_regs->command);
+                cmd &= ~CMD_RUN;
+                writel(cmd, &ehci_regs->command);
+        }
+}
+
+struct console early_dbgp_console = {
+        .name =         "earlydbg",
+        .write =        early_dbgp_write,
+        .flags =        CON_PRINTBUFFER,
+        .index =        -1,
+};
+
+int dbgp_reset_prep(void)
+{
+        u32 ctrl;
+
+        dbgp_not_safe = 1;
+        if (!ehci_debug)
+                return 0;
+
+        if (early_dbgp_console.index != -1 &&
+                !(early_dbgp_console.flags & CON_BOOT))
+                return 1;
+        /* This means the console is not initialized, or should get
+         * shutdown so as to allow for reuse of the usb device, which
+         * means it is time to shutdown the usb debug port. */
+        ctrl = readl(&ehci_debug->control);
+        if (ctrl & DBGP_ENABLED) {
+                ctrl &= ~(DBGP_CLAIM);
+                writel(ctrl, &ehci_debug->control);
+        }
+        return 0;
+}
+EXPORT_SYMBOL_GPL(dbgp_reset_prep);
diff --git a/drivers/usb/gadget/Kconfig b/drivers/usb/gadget/Kconfig
index 7f8e83a954ac..33351312327f 100644
--- a/drivers/usb/gadget/Kconfig
+++ b/drivers/usb/gadget/Kconfig
@@ -124,7 +124,7 @@ choice
 
 config USB_GADGET_AT91
         boolean "Atmel AT91 USB Device Port"
-        depends on ARCH_AT91 && !ARCH_AT91SAM9RL && !ARCH_AT91CAP9
+        depends on ARCH_AT91 && !ARCH_AT91SAM9RL && !ARCH_AT91CAP9 && !ARCH_AT91SAM9G45
         select USB_GADGET_SELECTED
         help
            Many Atmel AT91 processors (such as the AT91RM2000) have a
@@ -143,7 +143,7 @@ config USB_AT91
 config USB_GADGET_ATMEL_USBA
         boolean "Atmel USBA"
         select USB_GADGET_DUALSPEED
-        depends on AVR32 || ARCH_AT91CAP9 || ARCH_AT91SAM9RL
+        depends on AVR32 || ARCH_AT91CAP9 || ARCH_AT91SAM9RL || ARCH_AT91SAM9G45
         help
           USBA is the integrated high-speed USB Device controller on
           the AT32AP700x, some AT91SAM9 and AT91CAP9 processors from Atmel.
@@ -251,6 +251,24 @@ config USB_PXA25X_SMALL
         default y if USB_ETH
         default y if USB_G_SERIAL
 
+config USB_GADGET_R8A66597
+        boolean "Renesas R8A66597 USB Peripheral Controller"
+        select USB_GADGET_DUALSPEED
+        help
+           R8A66597 is a discrete USB host and peripheral controller chip that
+           supports both full and high speed USB 2.0 data transfers.
+           It has nine configurable endpoints, and endpoint zero.
+
+           Say "y" to link the driver statically, or "m" to build a
+           dynamically linked module called "r8a66597_udc" and force all
+           gadget drivers to also be dynamically linked.
+
+config USB_R8A66597
+        tristate
+        depends on USB_GADGET_R8A66597
+        default USB_GADGET
+        select USB_GADGET_SELECTED
+
 config USB_GADGET_PXA27X
         boolean "PXA 27x"
         depends on ARCH_PXA && (PXA27x || PXA3xx)
@@ -360,16 +378,6 @@ config USB_M66592
         default USB_GADGET
         select USB_GADGET_SELECTED
 
-config SUPERH_BUILT_IN_M66592
-        boolean "Enable SuperH built-in USB like the M66592"
-        depends on USB_GADGET_M66592 && CPU_SUBTYPE_SH7722
-        help
-           SH7722 has USB like the M66592.
-
-           The transfer rate is very slow when use "Ethernet Gadget".
-           However, this problem is improved if change a value of
-           NET_IP_ALIGN to 4.
-
 #
 # Controllers available only in discrete form (and all PCI controllers)
 #
@@ -619,9 +627,10 @@ config USB_AUDIO
 config USB_ETH
         tristate "Ethernet Gadget (with CDC Ethernet support)"
         depends on NET
+        select CRC32
         help
-          This driver implements Ethernet style communication, in either
-          of two ways:
+          This driver implements Ethernet style communication, in one of
+          several ways:
           
            - The "Communication Device Class" (CDC) Ethernet Control Model.
              That protocol is often avoided with pure Ethernet adapters, in
@@ -631,7 +640,11 @@ config USB_ETH
            - On hardware can't implement that protocol, a simple CDC subset
              is used, placing fewer demands on USB.
 
-          RNDIS support is a third option, more demanding than that subset.
+           - CDC Ethernet Emulation Model (EEM) is a newer standard that has
+             a simpler interface that can be used by more USB hardware.
+
+          RNDIS support is an additional option, more demanding than than
+          subset.
 
           Within the USB device, this gadget driver exposes a network device
           "usbX", where X depends on what other networking devices you have.
@@ -664,6 +677,22 @@ config USB_ETH_RNDIS
            XP, you'll need to download drivers from Microsoft's website; a URL
            is given in comments found in that info file.
 
+config USB_ETH_EEM
+       bool "Ethernet Emulation Model (EEM) support"
+       depends on USB_ETH
+       default n
+       help
+         CDC EEM is a newer USB standard that is somewhat simpler than CDC ECM
+         and therefore can be supported by more hardware.  Technically ECM and
+         EEM are designed for different applications.  The ECM model extends
+         the network interface to the target (e.g. a USB cable modem), and the
+         EEM model is for mobile devices to communicate with hosts using
+         ethernet over USB.  For Linux gadgets, however, the interface with
+         the host is the same (a usbX device), so the differences are minimal.
+
+         If you say "y" here, the Ethernet gadget driver will use the EEM
+         protocol rather than ECM.  If unsure, say "n".
+
 config USB_GADGETFS
         tristate "Gadget Filesystem (EXPERIMENTAL)"
         depends on EXPERIMENTAL
diff --git a/drivers/usb/gadget/Makefile b/drivers/usb/gadget/Makefile
index e6017e6bf6da..9d7b87c52e9f 100644
--- a/drivers/usb/gadget/Makefile
+++ b/drivers/usb/gadget/Makefile
@@ -23,6 +23,7 @@ ifeq ($(CONFIG_ARCH_MXC),y)
 fsl_usb2_udc-objs               += fsl_mx3_udc.o
 endif
 obj-$(CONFIG_USB_M66592)        += m66592-udc.o
+obj-$(CONFIG_USB_R8A66597)      += r8a66597-udc.o
 obj-$(CONFIG_USB_FSL_QE)        += fsl_qe_udc.o
 obj-$(CONFIG_USB_CI13XXX)       += ci13xxx_udc.o
 obj-$(CONFIG_USB_S3C_HSOTG)     += s3c-hsotg.o
diff --git a/drivers/usb/gadget/amd5536udc.c b/drivers/usb/gadget/amd5536udc.c
index 77352ccc245e..d5b65962dd36 100644
--- a/drivers/usb/gadget/amd5536udc.c
+++ b/drivers/usb/gadget/amd5536udc.c
@@ -2378,40 +2378,34 @@ static irqreturn_t udc_data_in_isr(struct udc *dev, int ep_ix)
                 if (!ep->cancel_transfer && !list_empty(&ep->queue)) {
                         req = list_entry(ep->queue.next,
                                         struct udc_request, queue);
-                        if (req) {
-                                /*
-                                 * length bytes transfered
-                                 * check dma done of last desc. in PPBDU mode
-                                 */
-                                if (use_dma_ppb_du) {
-                                        td = udc_get_last_dma_desc(req);
-                                        if (td) {
-                                                dma_done =
-                                                        AMD_GETBITS(td->status,
-                                                        UDC_DMA_IN_STS_BS);
-                                                /* don't care DMA done */
-                                                req->req.actual =
-                                                        req->req.length;
-                                        }
-                                } else {
-                                        /* assume all bytes transferred */
+                        /*
+                         * length bytes transfered
+                         * check dma done of last desc. in PPBDU mode
+                         */
+                        if (use_dma_ppb_du) {
+                                td = udc_get_last_dma_desc(req);
+                                if (td) {
+                                        dma_done =
+                                                AMD_GETBITS(td->status,
+                                                UDC_DMA_IN_STS_BS);
+                                        /* don't care DMA done */
                                         req->req.actual = req->req.length;
                                 }
+                        } else {
+                                /* assume all bytes transferred */
+                                req->req.actual = req->req.length;
+                        }
 
-                                if (req->req.actual == req->req.length) {
-                                        /* complete req */
-                                        complete_req(ep, req, 0);
-                                        req->dma_going = 0;
-                                        /* further request available ? */
-                                        if (list_empty(&ep->queue)) {
-                                                /* disable interrupt */
-                                                tmp = readl(
-                                                        &dev->regs->ep_irqmsk);
-                                                tmp |= AMD_BIT(ep->num);
-                                                writel(tmp,
-                                                        &dev->regs->ep_irqmsk);
-                                        }
-
+                        if (req->req.actual == req->req.length) {
+                                /* complete req */
+                                complete_req(ep, req, 0);
+                                req->dma_going = 0;
+                                /* further request available ? */
+                                if (list_empty(&ep->queue)) {
+                                        /* disable interrupt */
+                                        tmp = readl(&dev->regs->ep_irqmsk);
+                                        tmp |= AMD_BIT(ep->num);
+                                        writel(tmp, &dev->regs->ep_irqmsk);
                                 }
                         }
                 }
diff --git a/drivers/usb/gadget/at91_udc.c b/drivers/usb/gadget/at91_udc.c
index 72bae8f39d81..66450a1abc22 100644
--- a/drivers/usb/gadget/at91_udc.c
+++ b/drivers/usb/gadget/at91_udc.c
@@ -1754,7 +1754,6 @@ static int __init at91udc_probe(struct platform_device *pdev)
                                 IRQF_DISABLED, driver_name, udc)) {
                         DBG("request vbus irq %d failed\n",
                                         udc->board.vbus_pin);
-                        free_irq(udc->udp_irq, udc);
                         retval = -EBUSY;
                         goto fail3;
                 }
diff --git a/drivers/usb/gadget/audio.c b/drivers/usb/gadget/audio.c
index 9f80f4e970bd..a3a0f4a27ef0 100644
--- a/drivers/usb/gadget/audio.c
+++ b/drivers/usb/gadget/audio.c
@@ -106,20 +106,20 @@ static int audio_set_endpoint_req(struct usb_configuration *c,
                         ctrl->bRequest, w_value, len, ep);
 
         switch (ctrl->bRequest) {
-        case SET_CUR:
+        case UAC_SET_CUR:
                 value = 0;
                 break;
 
-        case SET_MIN:
+        case UAC_SET_MIN:
                 break;
 
-        case SET_MAX:
+        case UAC_SET_MAX:
                 break;
 
-        case SET_RES:
+        case UAC_SET_RES:
                 break;
 
-        case SET_MEM:
+        case UAC_SET_MEM:
                 break;
 
         default:
@@ -142,13 +142,13 @@ static int audio_get_endpoint_req(struct usb_configuration *c,
                         ctrl->bRequest, w_value, len, ep);
 
         switch (ctrl->bRequest) {
-        case GET_CUR:
-        case GET_MIN:
-        case GET_MAX:
-        case GET_RES:
+        case UAC_GET_CUR:
+        case UAC_GET_MIN:
+        case UAC_GET_MAX:
+        case UAC_GET_RES:
                 value = 3;
                 break;
-        case GET_MEM:
+        case UAC_GET_MEM:
                 break;
         default:
                 break;
@@ -171,11 +171,11 @@ audio_setup(struct usb_configuration *c, const struct usb_ctrlrequest *ctrl)
          * Audio class messages; interface activation uses set_alt().
          */
         switch (ctrl->bRequestType) {
-        case USB_AUDIO_SET_ENDPOINT:
+        case USB_DIR_OUT | USB_TYPE_CLASS | USB_RECIP_ENDPOINT:
                 value = audio_set_endpoint_req(c, ctrl);
                 break;
 
-        case USB_AUDIO_GET_ENDPOINT:
+        case USB_DIR_IN | USB_TYPE_CLASS | USB_RECIP_ENDPOINT:
                 value = audio_get_endpoint_req(c, ctrl);
                 break;
 
diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c
index 59e85234fa0a..d05397ec8a18 100644
--- a/drivers/usb/gadget/composite.c
+++ b/drivers/usb/gadget/composite.c
@@ -602,7 +602,7 @@ static int get_string(struct usb_composite_dev *cdev,
                         }
                 }
 
-                for (len = 0; s->wData[len] && len <= 126; len++)
+                for (len = 0; len <= 126 && s->wData[len]; len++)
                         continue;
                 if (!len)
                         return -EINVAL;
diff --git a/drivers/usb/gadget/dummy_hcd.c b/drivers/usb/gadget/dummy_hcd.c
index a56b24d305f8..5e0966485188 100644
--- a/drivers/usb/gadget/dummy_hcd.c
+++ b/drivers/usb/gadget/dummy_hcd.c
@@ -1306,11 +1306,6 @@ restart:
                         setup = *(struct usb_ctrlrequest*) urb->setup_packet;
                         w_index = le16_to_cpu(setup.wIndex);
                         w_value = le16_to_cpu(setup.wValue);
-                        if (le16_to_cpu(setup.wLength) !=
-                                        urb->transfer_buffer_length) {
-                                status = -EOVERFLOW;
-                                goto return_urb;
-                        }
 
                         /* paranoia, in case of stale queued data */
                         list_for_each_entry (req, &ep->queue, queue) {
diff --git a/drivers/usb/gadget/ether.c b/drivers/usb/gadget/ether.c
index bd102f5052ba..f37de283d0ab 100644
--- a/drivers/usb/gadget/ether.c
+++ b/drivers/usb/gadget/ether.c
@@ -61,6 +61,11 @@
  * simpler, Microsoft pushes their own approach: RNDIS.  The published
  * RNDIS specs are ambiguous and appear to be incomplete, and are also
  * needlessly complex.  They borrow more from CDC ACM than CDC ECM.
+ *
+ * While CDC ECM, CDC Subset, and RNDIS are designed to extend the ethernet
+ * interface to the target, CDC EEM was designed to use ethernet over the USB
+ * link between the host and target.  CDC EEM is implemented as an alternative
+ * to those other protocols when that communication model is more appropriate
  */
 
 #define DRIVER_DESC             "Ethernet Gadget"
@@ -114,6 +119,7 @@ static inline bool has_rndis(void)
 #include "f_rndis.c"
 #include "rndis.c"
 #endif
+#include "f_eem.c"
 #include "u_ether.c"
 
 /*-------------------------------------------------------------------------*/
@@ -150,6 +156,10 @@ static inline bool has_rndis(void)
 #define RNDIS_VENDOR_NUM        0x0525  /* NetChip */
 #define RNDIS_PRODUCT_NUM       0xa4a2  /* Ethernet/RNDIS Gadget */
 
+/* For EEM gadgets */
+#define EEM_VENDOR_NUM  0x0525  /* INVALID - NEEDS TO BE ALLOCATED */
+#define EEM_PRODUCT_NUM 0xa4a1  /* INVALID - NEEDS TO BE ALLOCATED */
+
 /*-------------------------------------------------------------------------*/
 
 static struct usb_device_descriptor device_desc = {
@@ -246,8 +256,16 @@ static struct usb_configuration rndis_config_driver = {
 
 /*-------------------------------------------------------------------------*/
 
+#ifdef CONFIG_USB_ETH_EEM
+static int use_eem = 1;
+#else
+static int use_eem;
+#endif
+module_param(use_eem, bool, 0);
+MODULE_PARM_DESC(use_eem, "use CDC EEM mode");
+
 /*
- * We _always_ have an ECM or CDC Subset configuration.
+ * We _always_ have an ECM, CDC Subset, or EEM configuration.
  */
 static int __init eth_do_config(struct usb_configuration *c)
 {
@@ -258,7 +276,9 @@ static int __init eth_do_config(struct usb_configuration *c)
                 c->bmAttributes |= USB_CONFIG_ATT_WAKEUP;
         }
 
-        if (can_support_ecm(c->cdev->gadget))
+        if (use_eem)
+                return eem_bind_config(c);
+        else if (can_support_ecm(c->cdev->gadget))
                 return ecm_bind_config(c, hostaddr);
         else
                 return geth_bind_config(c, hostaddr);
@@ -286,7 +306,12 @@ static int __init eth_bind(struct usb_composite_dev *cdev)
                 return status;
 
         /* set up main config label and device descriptor */
-        if (can_support_ecm(cdev->gadget)) {
+        if (use_eem) {
+                /* EEM */
+                eth_config_driver.label = "CDC Ethernet (EEM)";
+                device_desc.idVendor = cpu_to_le16(EEM_VENDOR_NUM);
+                device_desc.idProduct = cpu_to_le16(EEM_PRODUCT_NUM);
+        } else if (can_support_ecm(cdev->gadget)) {
                 /* ECM */
                 eth_config_driver.label = "CDC Ethernet (ECM)";
         } else {
diff --git a/drivers/usb/gadget/f_audio.c b/drivers/usb/gadget/f_audio.c
index 66527ba2d2ea..98e9bb977291 100644
--- a/drivers/usb/gadget/f_audio.c
+++ b/drivers/usb/gadget/f_audio.c
@@ -28,6 +28,9 @@ static int audio_buf_size = 48000;
 module_param(audio_buf_size, int, S_IRUGO);
 MODULE_PARM_DESC(audio_buf_size, "Audio buffer size");
 
+static int generic_set_cmd(struct usb_audio_control *con, u8 cmd, int value);
+static int generic_get_cmd(struct usb_audio_control *con, u8 cmd);
+
 /*
  * DESCRIPTORS ... most are static, but strings and full
  * configuration descriptors are built on demand.
@@ -50,16 +53,16 @@ static struct usb_interface_descriptor ac_interface_desc __initdata = {
         .bInterfaceSubClass =   USB_SUBCLASS_AUDIOCONTROL,
 };
 
-DECLARE_USB_AC_HEADER_DESCRIPTOR(2);
+DECLARE_UAC_AC_HEADER_DESCRIPTOR(2);
 
-#define USB_DT_AC_HEADER_LENGH  USB_DT_AC_HEADER_SIZE(F_AUDIO_NUM_INTERFACES)
+#define UAC_DT_AC_HEADER_LENGTH UAC_DT_AC_HEADER_SIZE(F_AUDIO_NUM_INTERFACES)
 /* B.3.2  Class-Specific AC Interface Descriptor */
-static struct usb_ac_header_descriptor_2 ac_header_desc = {
-        .bLength =              USB_DT_AC_HEADER_LENGH,
+static struct uac_ac_header_descriptor_2 ac_header_desc = {
+        .bLength =              UAC_DT_AC_HEADER_LENGTH,
         .bDescriptorType =      USB_DT_CS_INTERFACE,
-        .bDescriptorSubtype =   HEADER,
+        .bDescriptorSubtype =   UAC_HEADER,
         .bcdADC =               __constant_cpu_to_le16(0x0100),
-        .wTotalLength =         __constant_cpu_to_le16(USB_DT_AC_HEADER_LENGH),
+        .wTotalLength =         __constant_cpu_to_le16(UAC_DT_AC_HEADER_LENGTH),
         .bInCollection =        F_AUDIO_NUM_INTERFACES,
         .baInterfaceNr = {
                 [0] =           F_AUDIO_AC_INTERFACE,
@@ -68,33 +71,33 @@ static struct usb_ac_header_descriptor_2 ac_header_desc = {
 };
 
 #define INPUT_TERMINAL_ID       1
-static struct usb_input_terminal_descriptor input_terminal_desc = {
-        .bLength =              USB_DT_AC_INPUT_TERMINAL_SIZE,
+static struct uac_input_terminal_descriptor input_terminal_desc = {
+        .bLength =              UAC_DT_INPUT_TERMINAL_SIZE,
         .bDescriptorType =      USB_DT_CS_INTERFACE,
-        .bDescriptorSubtype =   INPUT_TERMINAL,
+        .bDescriptorSubtype =   UAC_INPUT_TERMINAL,
         .bTerminalID =          INPUT_TERMINAL_ID,
-        .wTerminalType =        USB_AC_TERMINAL_STREAMING,
+        .wTerminalType =        UAC_TERMINAL_STREAMING,
         .bAssocTerminal =       0,
         .wChannelConfig =       0x3,
 };
 
-DECLARE_USB_AC_FEATURE_UNIT_DESCRIPTOR(0);
+DECLARE_UAC_FEATURE_UNIT_DESCRIPTOR(0);
 
 #define FEATURE_UNIT_ID         2
-static struct usb_ac_feature_unit_descriptor_0 feature_unit_desc = {
-        .bLength                = USB_DT_AC_FEATURE_UNIT_SIZE(0),
+static struct uac_feature_unit_descriptor_0 feature_unit_desc = {
+        .bLength                = UAC_DT_FEATURE_UNIT_SIZE(0),
         .bDescriptorType        = USB_DT_CS_INTERFACE,
-        .bDescriptorSubtype     = FEATURE_UNIT,
+        .bDescriptorSubtype     = UAC_FEATURE_UNIT,
         .bUnitID                = FEATURE_UNIT_ID,
         .bSourceID              = INPUT_TERMINAL_ID,
         .bControlSize           = 2,
-        .bmaControls[0]         = (FU_MUTE | FU_VOLUME),
+        .bmaControls[0]         = (UAC_FU_MUTE | UAC_FU_VOLUME),
 };
 
 static struct usb_audio_control mute_control = {
         .list = LIST_HEAD_INIT(mute_control.list),
         .name = "Mute Control",
-        .type = MUTE_CONTROL,
+        .type = UAC_MUTE_CONTROL,
         /* Todo: add real Mute control code */
         .set = generic_set_cmd,
         .get = generic_get_cmd,
@@ -103,7 +106,7 @@ static struct usb_audio_control mute_control = {
 static struct usb_audio_control volume_control = {
         .list = LIST_HEAD_INIT(volume_control.list),
         .name = "Volume Control",
-        .type = VOLUME_CONTROL,
+        .type = UAC_VOLUME_CONTROL,
         /* Todo: add real Volume control code */
         .set = generic_set_cmd,
         .get = generic_get_cmd,
@@ -113,17 +116,17 @@ static struct usb_audio_control_selector feature_unit = {
         .list = LIST_HEAD_INIT(feature_unit.list),
         .id = FEATURE_UNIT_ID,
         .name = "Mute & Volume Control",
-        .type = FEATURE_UNIT,
+        .type = UAC_FEATURE_UNIT,
         .desc = (struct usb_descriptor_header *)&feature_unit_desc,
 };
 
 #define OUTPUT_TERMINAL_ID      3
-static struct usb_output_terminal_descriptor output_terminal_desc = {
-        .bLength                = USB_DT_AC_OUTPUT_TERMINAL_SIZE,
+static struct uac_output_terminal_descriptor output_terminal_desc = {
+        .bLength                = UAC_DT_OUTPUT_TERMINAL_SIZE,
         .bDescriptorType        = USB_DT_CS_INTERFACE,
-        .bDescriptorSubtype     = OUTPUT_TERMINAL,
+        .bDescriptorSubtype     = UAC_OUTPUT_TERMINAL,
         .bTerminalID            = OUTPUT_TERMINAL_ID,
-        .wTerminalType          = USB_AC_OUTPUT_TERMINAL_SPEAKER,
+        .wTerminalType          = UAC_OUTPUT_TERMINAL_SPEAKER,
         .bAssocTerminal         = FEATURE_UNIT_ID,
         .bSourceID              = FEATURE_UNIT_ID,
 };
@@ -148,22 +151,22 @@ static struct usb_interface_descriptor as_interface_alt_1_desc = {
 };
 
 /* B.4.2  Class-Specific AS Interface Descriptor */
-static struct usb_as_header_descriptor as_header_desc = {
-        .bLength =              USB_DT_AS_HEADER_SIZE,
+static struct uac_as_header_descriptor as_header_desc = {
+        .bLength =              UAC_DT_AS_HEADER_SIZE,
         .bDescriptorType =      USB_DT_CS_INTERFACE,
-        .bDescriptorSubtype =   AS_GENERAL,
+        .bDescriptorSubtype =   UAC_AS_GENERAL,
         .bTerminalLink =        INPUT_TERMINAL_ID,
         .bDelay =               1,
-        .wFormatTag =           USB_AS_AUDIO_FORMAT_TYPE_I_PCM,
+        .wFormatTag =           UAC_FORMAT_TYPE_I_PCM,
 };
 
-DECLARE_USB_AS_FORMAT_TYPE_I_DISCRETE_DESC(1);
+DECLARE_UAC_FORMAT_TYPE_I_DISCRETE_DESC(1);
 
-static struct usb_as_formate_type_i_discrete_descriptor_1 as_type_i_desc = {
-        .bLength =              USB_AS_FORMAT_TYPE_I_DISCRETE_DESC_SIZE(1),
+static struct uac_format_type_i_discrete_descriptor_1 as_type_i_desc = {
+        .bLength =              UAC_FORMAT_TYPE_I_DISCRETE_DESC_SIZE(1),
         .bDescriptorType =      USB_DT_CS_INTERFACE,
-        .bDescriptorSubtype =   FORMAT_TYPE,
-        .bFormatType =          USB_AS_FORMAT_TYPE_I,
+        .bDescriptorSubtype =   UAC_FORMAT_TYPE,
+        .bFormatType =          UAC_FORMAT_TYPE_I,
         .bSubframeSize =        2,
         .bBitResolution =       16,
         .bSamFreqType =         1,
@@ -174,17 +177,17 @@ static struct usb_endpoint_descriptor as_out_ep_desc __initdata = {
         .bLength =              USB_DT_ENDPOINT_AUDIO_SIZE,
         .bDescriptorType =      USB_DT_ENDPOINT,
         .bEndpointAddress =     USB_DIR_OUT,
-        .bmAttributes =         USB_AS_ENDPOINT_ADAPTIVE
+        .bmAttributes =         USB_ENDPOINT_SYNC_ADAPTIVE
                                 | USB_ENDPOINT_XFER_ISOC,
         .wMaxPacketSize =       __constant_cpu_to_le16(OUT_EP_MAX_PACKET_SIZE),
         .bInterval =            4,
 };
 
 /* Class-specific AS ISO OUT Endpoint Descriptor */
-static struct usb_as_iso_endpoint_descriptor as_iso_out_desc __initdata = {
-        .bLength =              USB_AS_ISO_ENDPOINT_DESC_SIZE,
+static struct uac_iso_endpoint_descriptor as_iso_out_desc __initdata = {
+        .bLength =              UAC_ISO_ENDPOINT_DESC_SIZE,
         .bDescriptorType =      USB_DT_CS_ENDPOINT,
-        .bDescriptorSubtype =   EP_GENERAL,
+        .bDescriptorSubtype =   UAC_EP_GENERAL,
         .bmAttributes =         1,
         .bLockDelayUnits =      1,
         .wLockDelay =           __constant_cpu_to_le16(1),
@@ -456,11 +459,11 @@ f_audio_setup(struct usb_function *f, const struct usb_ctrlrequest *ctrl)
          * Audio class messages; interface activation uses set_alt().
          */
         switch (ctrl->bRequestType) {
-        case USB_AUDIO_SET_INTF:
+        case USB_DIR_OUT | USB_TYPE_CLASS | USB_RECIP_INTERFACE:
                 value = audio_set_intf_req(f, ctrl);
                 break;
 
-        case USB_AUDIO_GET_INTF:
+        case USB_DIR_IN | USB_TYPE_CLASS | USB_RECIP_INTERFACE:
                 value = audio_get_intf_req(f, ctrl);
                 break;
 
@@ -632,6 +635,18 @@ f_audio_unbind(struct usb_configuration *c, struct usb_function *f)
 
 /*-------------------------------------------------------------------------*/
 
+static int generic_set_cmd(struct usb_audio_control *con, u8 cmd, int value)
+{
+        con->data[cmd] = value;
+
+        return 0;
+}
+
+static int generic_get_cmd(struct usb_audio_control *con, u8 cmd)
+{
+        return con->data[cmd];
+}
+
 /* Todo: add more control selecotor dynamically */
 int __init control_selector_init(struct f_audio *audio)
 {
@@ -642,10 +657,10 @@ int __init control_selector_init(struct f_audio *audio)
         list_add(&mute_control.list, &feature_unit.control);
         list_add(&volume_control.list, &feature_unit.control);
 
-        volume_control.data[_CUR] = 0xffc0;
-        volume_control.data[_MIN] = 0xe3a0;
-        volume_control.data[_MAX] = 0xfff0;
-        volume_control.data[_RES] = 0x0030;
+        volume_control.data[UAC__CUR] = 0xffc0;
+        volume_control.data[UAC__MIN] = 0xe3a0;
+        volume_control.data[UAC__MAX] = 0xfff0;
+        volume_control.data[UAC__RES] = 0x0030;
 
         return 0;
 }
diff --git a/drivers/usb/gadget/f_eem.c b/drivers/usb/gadget/f_eem.c
new file mode 100644
index 000000000000..0a577d5694fd
--- /dev/null
+++ b/drivers/usb/gadget/f_eem.c
@@ -0,0 +1,562 @@
+/*
+ * f_eem.c -- USB CDC Ethernet (EEM) link function driver
+ *
+ * Copyright (C) 2003-2005,2008 David Brownell
+ * Copyright (C) 2008 Nokia Corporation
+ * Copyright (C) 2009 EF Johnson Technologies
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ */
+
+#include <linux/kernel.h>
+#include <linux/device.h>
+#include <linux/etherdevice.h>
+#include <linux/crc32.h>
+
+#include "u_ether.h"
+
+#define EEM_HLEN 2
+
+/*
+ * This function is a "CDC Ethernet Emulation Model" (CDC EEM)
+ * Ethernet link.
+ */
+
+struct eem_ep_descs {
+        struct usb_endpoint_descriptor  *in;
+        struct usb_endpoint_descriptor  *out;
+};
+
+struct f_eem {
+        struct gether                   port;
+        u8                              ctrl_id;
+
+        struct eem_ep_descs             fs;
+        struct eem_ep_descs             hs;
+};
+
+static inline struct f_eem *func_to_eem(struct usb_function *f)
+{
+        return container_of(f, struct f_eem, port.func);
+}
+
+/*-------------------------------------------------------------------------*/
+
+/* interface descriptor: */
+
+static struct usb_interface_descriptor eem_intf __initdata = {
+        .bLength =              sizeof eem_intf,
+        .bDescriptorType =      USB_DT_INTERFACE,
+
+        /* .bInterfaceNumber = DYNAMIC */
+        .bNumEndpoints =        2,
+        .bInterfaceClass =      USB_CLASS_COMM,
+        .bInterfaceSubClass =   USB_CDC_SUBCLASS_EEM,
+        .bInterfaceProtocol =   USB_CDC_PROTO_EEM,
+        /* .iInterface = DYNAMIC */
+};
+
+/* full speed support: */
+
+static struct usb_endpoint_descriptor eem_fs_in_desc __initdata = {
+        .bLength =              USB_DT_ENDPOINT_SIZE,
+        .bDescriptorType =      USB_DT_ENDPOINT,
+
+        .bEndpointAddress =     USB_DIR_IN,
+        .bmAttributes =         USB_ENDPOINT_XFER_BULK,
+};
+
+static struct usb_endpoint_descriptor eem_fs_out_desc __initdata = {
+        .bLength =              USB_DT_ENDPOINT_SIZE,
+        .bDescriptorType =      USB_DT_ENDPOINT,
+
+        .bEndpointAddress =     USB_DIR_OUT,
+        .bmAttributes =         USB_ENDPOINT_XFER_BULK,
+};
+
+static struct usb_descriptor_header *eem_fs_function[] __initdata = {
+        /* CDC EEM control descriptors */
+        (struct usb_descriptor_header *) &eem_intf,
+        (struct usb_descriptor_header *) &eem_fs_in_desc,
+        (struct usb_descriptor_header *) &eem_fs_out_desc,
+        NULL,
+};
+
+/* high speed support: */
+
+static struct usb_endpoint_descriptor eem_hs_in_desc __initdata = {
+        .bLength =              USB_DT_ENDPOINT_SIZE,
+        .bDescriptorType =      USB_DT_ENDPOINT,
+
+        .bEndpointAddress =     USB_DIR_IN,
+        .bmAttributes =         USB_ENDPOINT_XFER_BULK,
+        .wMaxPacketSize =       cpu_to_le16(512),
+};
+
+static struct usb_endpoint_descriptor eem_hs_out_desc __initdata = {
+        .bLength =              USB_DT_ENDPOINT_SIZE,
+        .bDescriptorType =      USB_DT_ENDPOINT,
+
+        .bEndpointAddress =     USB_DIR_OUT,
+        .bmAttributes =         USB_ENDPOINT_XFER_BULK,
+        .wMaxPacketSize =       cpu_to_le16(512),
+};
+
+static struct usb_descriptor_header *eem_hs_function[] __initdata = {
+        /* CDC EEM control descriptors */
+        (struct usb_descriptor_header *) &eem_intf,
+        (struct usb_descriptor_header *) &eem_hs_in_desc,
+        (struct usb_descriptor_header *) &eem_hs_out_desc,
+        NULL,
+};
+
+/* string descriptors: */
+
+static struct usb_string eem_string_defs[] = {
+        [0].s = "CDC Ethernet Emulation Model (EEM)",
+        {  } /* end of list */
+};
+
+static struct usb_gadget_strings eem_string_table = {
+        .language =             0x0409, /* en-us */
+        .strings =              eem_string_defs,
+};
+
+static struct usb_gadget_strings *eem_strings[] = {
+        &eem_string_table,
+        NULL,
+};
+
+/*-------------------------------------------------------------------------*/
+
+static int eem_setup(struct usb_function *f, const struct usb_ctrlrequest *ctrl)
+{
+        struct usb_composite_dev *cdev = f->config->cdev;
+        int                     value = -EOPNOTSUPP;
+        u16                     w_index = le16_to_cpu(ctrl->wIndex);
+        u16                     w_value = le16_to_cpu(ctrl->wValue);
+        u16                     w_length = le16_to_cpu(ctrl->wLength);
+
+        DBG(cdev, "invalid control req%02x.%02x v%04x i%04x l%d\n",
+                ctrl->bRequestType, ctrl->bRequest,
+                w_value, w_index, w_length);
+
+        /* device either stalls (value < 0) or reports success */
+        return value;
+}
+
+
+static int eem_set_alt(struct usb_function *f, unsigned intf, unsigned alt)
+{
+        struct f_eem            *eem = func_to_eem(f);
+        struct usb_composite_dev *cdev = f->config->cdev;
+        struct net_device       *net;
+
+        /* we know alt == 0, so this is an activation or a reset */
+        if (alt != 0)
+                goto fail;
+
+        if (intf == eem->ctrl_id) {
+
+                if (eem->port.in_ep->driver_data) {
+                        DBG(cdev, "reset eem\n");
+                        gether_disconnect(&eem->port);
+                }
+
+                if (!eem->port.in) {
+                        DBG(cdev, "init eem\n");
+                        eem->port.in = ep_choose(cdev->gadget,
+                                        eem->hs.in, eem->fs.in);
+                        eem->port.out = ep_choose(cdev->gadget,
+                                        eem->hs.out, eem->fs.out);
+                }
+
+                /* zlps should not occur because zero-length EEM packets
+                 * will be inserted in those cases where they would occur
+                 */
+                eem->port.is_zlp_ok = 1;
+                eem->port.cdc_filter = DEFAULT_FILTER;
+                DBG(cdev, "activate eem\n");
+                net = gether_connect(&eem->port);
+                if (IS_ERR(net))
+                        return PTR_ERR(net);
+        } else
+                goto fail;
+
+        return 0;
+fail:
+        return -EINVAL;
+}
+
+static void eem_disable(struct usb_function *f)
+{
+        struct f_eem            *eem = func_to_eem(f);
+        struct usb_composite_dev *cdev = f->config->cdev;
+
+        DBG(cdev, "eem deactivated\n");
+
+        if (eem->port.in_ep->driver_data)
+                gether_disconnect(&eem->port);
+}
+
+/*-------------------------------------------------------------------------*/
+
+/* EEM function driver setup/binding */
+
+static int __init
+eem_bind(struct usb_configuration *c, struct usb_function *f)
+{
+        struct usb_composite_dev *cdev = c->cdev;
+        struct f_eem            *eem = func_to_eem(f);
+        int                     status;
+        struct usb_ep           *ep;
+
+        /* allocate instance-specific interface IDs */
+        status = usb_interface_id(c, f);
+        if (status < 0)
+                goto fail;
+        eem->ctrl_id = status;
+        eem_intf.bInterfaceNumber = status;
+
+        status = -ENODEV;
+
+        /* allocate instance-specific endpoints */
+        ep = usb_ep_autoconfig(cdev->gadget, &eem_fs_in_desc);
+        if (!ep)
+                goto fail;
+        eem->port.in_ep = ep;
+        ep->driver_data = cdev; /* claim */
+
+        ep = usb_ep_autoconfig(cdev->gadget, &eem_fs_out_desc);
+        if (!ep)
+                goto fail;
+        eem->port.out_ep = ep;
+        ep->driver_data = cdev; /* claim */
+
+        status = -ENOMEM;
+
+        /* copy descriptors, and track endpoint copies */
+        f->descriptors = usb_copy_descriptors(eem_fs_function);
+        if (!f->descriptors)
+                goto fail;
+
+        eem->fs.in = usb_find_endpoint(eem_fs_function,
+                        f->descriptors, &eem_fs_in_desc);
+        eem->fs.out = usb_find_endpoint(eem_fs_function,
+                        f->descriptors, &eem_fs_out_desc);
+
+        /* support all relevant hardware speeds... we expect that when
+         * hardware is dual speed, all bulk-capable endpoints work at
+         * both speeds
+         */
+        if (gadget_is_dualspeed(c->cdev->gadget)) {
+                eem_hs_in_desc.bEndpointAddress =
+                                eem_fs_in_desc.bEndpointAddress;
+                eem_hs_out_desc.bEndpointAddress =
+                                eem_fs_out_desc.bEndpointAddress;
+
+                /* copy descriptors, and track endpoint copies */
+                f->hs_descriptors = usb_copy_descriptors(eem_hs_function);
+                if (!f->hs_descriptors)
+                        goto fail;
+
+                eem->hs.in = usb_find_endpoint(eem_hs_function,
+                                f->hs_descriptors, &eem_hs_in_desc);
+                eem->hs.out = usb_find_endpoint(eem_hs_function,
+                                f->hs_descriptors, &eem_hs_out_desc);
+        }
+
+        DBG(cdev, "CDC Ethernet (EEM): %s speed IN/%s OUT/%s\n",
+                        gadget_is_dualspeed(c->cdev->gadget) ? "dual" : "full",
+                        eem->port.in_ep->name, eem->port.out_ep->name);
+        return 0;
+
+fail:
+        if (f->descriptors)
+                usb_free_descriptors(f->descriptors);
+
+        /* we might as well release our claims on endpoints */
+        if (eem->port.out)
+                eem->port.out_ep->driver_data = NULL;
+        if (eem->port.in)
+                eem->port.in_ep->driver_data = NULL;
+
+        ERROR(cdev, "%s: can't bind, err %d\n", f->name, status);
+
+        return status;
+}
+
+static void
+eem_unbind(struct usb_configuration *c, struct usb_function *f)
+{
+        struct f_eem    *eem = func_to_eem(f);
+
+        DBG(c->cdev, "eem unbind\n");
+
+        if (gadget_is_dualspeed(c->cdev->gadget))
+                usb_free_descriptors(f->hs_descriptors);
+        usb_free_descriptors(f->descriptors);
+        kfree(eem);
+}
+
+static void eem_cmd_complete(struct usb_ep *ep, struct usb_request *req)
+{
+}
+
+/*
+ * Add the EEM header and ethernet checksum.
+ * We currently do not attempt to put multiple ethernet frames
+ * into a single USB transfer
+ */
+static struct sk_buff *eem_wrap(struct gether *port, struct sk_buff *skb)
+{
+        struct sk_buff  *skb2 = NULL;
+        struct usb_ep   *in = port->in_ep;
+        int             padlen = 0;
+        u16             len = skb->len;
+
+        if (!skb_cloned(skb)) {
+                int headroom = skb_headroom(skb);
+                int tailroom = skb_tailroom(skb);
+
+                /* When (len + EEM_HLEN + ETH_FCS_LEN) % in->maxpacket) is 0,
+                 * stick two bytes of zero-length EEM packet on the end.
+                 */
+                if (((len + EEM_HLEN + ETH_FCS_LEN) % in->maxpacket) == 0)
+                        padlen += 2;
+
+                if ((tailroom >= (ETH_FCS_LEN + padlen)) &&
+                                (headroom >= EEM_HLEN))
+                        goto done;
+        }
+
+        skb2 = skb_copy_expand(skb, EEM_HLEN, ETH_FCS_LEN + padlen, GFP_ATOMIC);
+        dev_kfree_skb_any(skb);
+        skb = skb2;
+        if (!skb)
+                return skb;
+
+done:
+        /* use the "no CRC" option */
+        put_unaligned_be32(0xdeadbeef, skb_put(skb, 4));
+
+        /* EEM packet header format:
+         * b0..13:      length of ethernet frame
+         * b14:         bmCRC (0 == sentinel CRC)
+         * b15:         bmType (0 == data)
+         */
+        len = skb->len;
+        put_unaligned_le16((len & 0x3FFF) | BIT(14), skb_push(skb, 2));
+
+        /* add a zero-length EEM packet, if needed */
+        if (padlen)
+                put_unaligned_le16(0, skb_put(skb, 2));
+
+        return skb;
+}
+
+/*
+ * Remove the EEM header.  Note that there can be many EEM packets in a single
+ * USB transfer, so we need to break them out and handle them independently.
+ */
+static int eem_unwrap(struct gether *port,
+                        struct sk_buff *skb,
+                        struct sk_buff_head *list)
+{
+        struct usb_composite_dev        *cdev = port->func.config->cdev;
+        int                             status = 0;
+
+        do {
+                struct sk_buff  *skb2;
+                u16             header;
+                u16             len = 0;
+
+                if (skb->len < EEM_HLEN) {
+                        status = -EINVAL;
+                        DBG(cdev, "invalid EEM header\n");
+                        goto error;
+                }
+
+                /* remove the EEM header */
+                header = get_unaligned_le16(skb->data);
+                skb_pull(skb, EEM_HLEN);
+
+                /* EEM packet header format:
+                 * b0..14:      EEM type dependent (data or command)
+                 * b15:         bmType (0 == data, 1 == command)
+                 */
+                if (header & BIT(15)) {
+                        struct usb_request      *req = cdev->req;
+                        u16                     bmEEMCmd;
+
+                        /* EEM command packet format:
+                         * b0..10:      bmEEMCmdParam
+                         * b11..13:     bmEEMCmd
+                         * b14:         reserved (must be zero)
+                         * b15:         bmType (1 == command)
+                         */
+                        if (header & BIT(14))
+                                continue;
+
+                        bmEEMCmd = (header >> 11) & 0x7;
+                        switch (bmEEMCmd) {
+                        case 0: /* echo */
+                                len = header & 0x7FF;
+                                if (skb->len < len) {
+                                        status = -EOVERFLOW;
+                                        goto error;
+                                }
+
+                                skb2 = skb_clone(skb, GFP_ATOMIC);
+                                if (unlikely(!skb2)) {
+                                        DBG(cdev, "EEM echo response error\n");
+                                        goto next;
+                                }
+                                skb_trim(skb2, len);
+                                put_unaligned_le16(BIT(15) | BIT(11) | len,
+                                                        skb_push(skb2, 2));
+                                skb_copy_bits(skb, 0, req->buf, skb->len);
+                                req->length = skb->len;
+                                req->complete = eem_cmd_complete;
+                                req->zero = 1;
+                                if (usb_ep_queue(port->in_ep, req, GFP_ATOMIC))
+                                        DBG(cdev, "echo response queue fail\n");
+                                break;
+
+                        case 1:  /* echo response */
+                        case 2:  /* suspend hint */
+                        case 3:  /* response hint */
+                        case 4:  /* response complete hint */
+                        case 5:  /* tickle */
+                        default: /* reserved */
+                                continue;
+                        }
+                } else {
+                        u32             crc, crc2;
+                        struct sk_buff  *skb3;
+
+                        /* check for zero-length EEM packet */
+                        if (header == 0)
+                                continue;
+
+                        /* EEM data packet format:
+                         * b0..13:      length of ethernet frame
+                         * b14:         bmCRC (0 == sentinel, 1 == calculated)
+                         * b15:         bmType (0 == data)
+                         */
+                        len = header & 0x3FFF;
+                        if ((skb->len < len)
+                                        || (len < (ETH_HLEN + ETH_FCS_LEN))) {
+                                status = -EINVAL;
+                                goto error;
+                        }
+
+                        /* validate CRC */
+                        crc = get_unaligned_le32(skb->data + len - ETH_FCS_LEN);
+                        if (header & BIT(14)) {
+                                crc = get_unaligned_le32(skb->data + len
+                                                        - ETH_FCS_LEN);
+                                crc2 = ~crc32_le(~0,
+                                                skb->data,
+                                                skb->len - ETH_FCS_LEN);
+                        } else {
+                                crc = get_unaligned_be32(skb->data + len
+                                                        - ETH_FCS_LEN);
+                                crc2 = 0xdeadbeef;
+                        }
+                        if (crc != crc2) {
+                                DBG(cdev, "invalid EEM CRC\n");
+                                goto next;
+                        }
+
+                        skb2 = skb_clone(skb, GFP_ATOMIC);
+                        if (unlikely(!skb2)) {
+                                DBG(cdev, "unable to unframe EEM packet\n");
+                                continue;
+                        }
+                        skb_trim(skb2, len - ETH_FCS_LEN);
+
+                        skb3 = skb_copy_expand(skb2,
+                                                NET_IP_ALIGN,
+                                                0,
+                                                GFP_ATOMIC);
+                        if (unlikely(!skb3)) {
+                                DBG(cdev, "unable to realign EEM packet\n");
+                                dev_kfree_skb_any(skb2);
+                                continue;
+                        }
+                        dev_kfree_skb_any(skb2);
+                        skb_queue_tail(list, skb3);
+                }
+next:
+                skb_pull(skb, len);
+        } while (skb->len);
+
+error:
+        dev_kfree_skb_any(skb);
+        return status;
+}
+
+/**
+ * eem_bind_config - add CDC Ethernet (EEM) network link to a configuration
+ * @c: the configuration to support the network link
+ * Context: single threaded during gadget setup
+ *
+ * Returns zero on success, else negative errno.
+ *
+ * Caller must have called @gether_setup().  Caller is also responsible
+ * for calling @gether_cleanup() before module unload.
+ */
+int __init eem_bind_config(struct usb_configuration *c)
+{
+        struct f_eem    *eem;
+        int             status;
+
+        /* maybe allocate device-global string IDs */
+        if (eem_string_defs[0].id == 0) {
+
+                /* control interface label */
+                status = usb_string_id(c->cdev);
+                if (status < 0)
+                        return status;
+                eem_string_defs[0].id = status;
+                eem_intf.iInterface = status;
+        }
+
+        /* allocate and initialize one new instance */
+        eem = kzalloc(sizeof *eem, GFP_KERNEL);
+        if (!eem)
+                return -ENOMEM;
+
+        eem->port.cdc_filter = DEFAULT_FILTER;
+
+        eem->port.func.name = "cdc_eem";
+        eem->port.func.strings = eem_strings;
+        /* descriptors are per-instance copies */
+        eem->port.func.bind = eem_bind;
+        eem->port.func.unbind = eem_unbind;
+        eem->port.func.set_alt = eem_set_alt;
+        eem->port.func.setup = eem_setup;
+        eem->port.func.disable = eem_disable;
+        eem->port.wrap = eem_wrap;
+        eem->port.unwrap = eem_unwrap;
+        eem->port.header_len = EEM_HLEN;
+
+        status = usb_add_function(c, &eem->port.func);
+        if (status)
+                kfree(eem);
+        return status;
+}
+
diff --git a/drivers/usb/gadget/f_loopback.c b/drivers/usb/gadget/f_loopback.c
index eb6ddfc20857..6cb29d3df575 100644
--- a/drivers/usb/gadget/f_loopback.c
+++ b/drivers/usb/gadget/f_loopback.c
@@ -22,7 +22,6 @@
 /* #define VERBOSE_DEBUG */
 
 #include <linux/kernel.h>
-#include <linux/utsname.h>
 #include <linux/device.h>
 
 #include "g_zero.h"
diff --git a/drivers/usb/gadget/f_obex.c b/drivers/usb/gadget/f_obex.c
index 46d6266f30ec..b4a3ba654ea5 100644
--- a/drivers/usb/gadget/f_obex.c
+++ b/drivers/usb/gadget/f_obex.c
@@ -24,7 +24,6 @@
 /* #define VERBOSE_DEBUG */
 
 #include <linux/kernel.h>
-#include <linux/utsname.h>
 #include <linux/device.h>
 
 #include "u_serial.h"
diff --git a/drivers/usb/gadget/f_rndis.c b/drivers/usb/gadget/f_rndis.c
index 424a37c5773f..c9966cc07d3a 100644
--- a/drivers/usb/gadget/f_rndis.c
+++ b/drivers/usb/gadget/f_rndis.c
@@ -286,12 +286,17 @@ static struct usb_gadget_strings *rndis_strings[] = {
 
 /*-------------------------------------------------------------------------*/
 
-static struct sk_buff *rndis_add_header(struct sk_buff *skb)
+static struct sk_buff *rndis_add_header(struct gether *port,
+                                        struct sk_buff *skb)
 {
-        skb = skb_realloc_headroom(skb, sizeof(struct rndis_packet_msg_type));
-        if (skb)
-                rndis_add_hdr(skb);
-        return skb;
+        struct sk_buff *skb2;
+
+        skb2 = skb_realloc_headroom(skb, sizeof(struct rndis_packet_msg_type));
+        if (skb2)
+                rndis_add_hdr(skb2);
+
+        dev_kfree_skb_any(skb);
+        return skb2;
 }
 
 static void rndis_response_available(void *_rndis)
diff --git a/drivers/usb/gadget/f_sourcesink.c b/drivers/usb/gadget/f_sourcesink.c
index bffe91d525f9..09cba273d2db 100644
--- a/drivers/usb/gadget/f_sourcesink.c
+++ b/drivers/usb/gadget/f_sourcesink.c
@@ -22,7 +22,6 @@
 /* #define VERBOSE_DEBUG */
 
 #include <linux/kernel.h>
-#include <linux/utsname.h>
 #include <linux/device.h>
 
 #include "g_zero.h"
diff --git a/drivers/usb/gadget/fsl_qe_udc.c b/drivers/usb/gadget/fsl_qe_udc.c
index d701bf4698d2..7881f12413c4 100644
--- a/drivers/usb/gadget/fsl_qe_udc.c
+++ b/drivers/usb/gadget/fsl_qe_udc.c
@@ -2751,6 +2751,10 @@ static int __devexit qe_udc_remove(struct of_device *ofdev)
 /*-------------------------------------------------------------------------*/
 static struct of_device_id __devinitdata qe_udc_match[] = {
         {
+                .compatible = "fsl,mpc8323-qe-usb",
+                .data = (void *)PORT_QE,
+        },
+        {
                 .compatible = "fsl,mpc8360-qe-usb",
                 .data = (void *)PORT_QE,
         },
diff --git a/drivers/usb/gadget/gadget_chips.h b/drivers/usb/gadget/gadget_chips.h
index 8e0e9a0b7364..f2d270b202f2 100644
--- a/drivers/usb/gadget/gadget_chips.h
+++ b/drivers/usb/gadget/gadget_chips.h
@@ -173,6 +173,12 @@
 // CONFIG_USB_GADGET_AU1X00
 // ...
 
+#ifdef CONFIG_USB_GADGET_R8A66597
+#define gadget_is_r8a66597(g)   !strcmp("r8a66597_udc", (g)->name)
+#else
+#define gadget_is_r8a66597(g)   0
+#endif
+
 
 /**
  * usb_gadget_controller_number - support bcdDevice id convention
@@ -239,6 +245,8 @@ static inline int usb_gadget_controller_number(struct usb_gadget *gadget)
                 return 0x23;
         else if (gadget_is_langwell(gadget))
                 return 0x24;
+        else if (gadget_is_r8a66597(gadget))
+                return 0x25;
         return -ENOENT;
 }
 
diff --git a/drivers/usb/gadget/gmidi.c b/drivers/usb/gadget/gmidi.c
index b9312dc6e041..d0b1e836f0e0 100644
--- a/drivers/usb/gadget/gmidi.c
+++ b/drivers/usb/gadget/gmidi.c
@@ -191,7 +191,7 @@ module_param(qlen, uint, S_IRUGO);
 #define GMIDI_MS_INTERFACE      1
 #define GMIDI_NUM_INTERFACES    2
 
-DECLARE_USB_AC_HEADER_DESCRIPTOR(1);
+DECLARE_UAC_AC_HEADER_DESCRIPTOR(1);
 DECLARE_USB_MIDI_OUT_JACK_DESCRIPTOR(1);
 DECLARE_USB_MS_ENDPOINT_DESCRIPTOR(1);
 
@@ -237,12 +237,12 @@ static const struct usb_interface_descriptor ac_interface_desc = {
 };
 
 /* B.3.2  Class-Specific AC Interface Descriptor */
-static const struct usb_ac_header_descriptor_1 ac_header_desc = {
-        .bLength =              USB_DT_AC_HEADER_SIZE(1),
+static const struct uac_ac_header_descriptor_1 ac_header_desc = {
+        .bLength =              UAC_DT_AC_HEADER_SIZE(1),
         .bDescriptorType =      USB_DT_CS_INTERFACE,
         .bDescriptorSubtype =   USB_MS_HEADER,
         .bcdADC =               cpu_to_le16(0x0100),
-        .wTotalLength =         cpu_to_le16(USB_DT_AC_HEADER_SIZE(1)),
+        .wTotalLength =         cpu_to_le16(UAC_DT_AC_HEADER_SIZE(1)),
         .bInCollection =        1,
         .baInterfaceNr = {
                 [0] =           GMIDI_MS_INTERFACE,
diff --git a/drivers/usb/gadget/inode.c b/drivers/usb/gadget/inode.c
index 7d33f50b5874..c44367fea185 100644
--- a/drivers/usb/gadget/inode.c
+++ b/drivers/usb/gadget/inode.c
@@ -2033,7 +2033,7 @@ gadgetfs_create_file (struct super_block *sb, char const *name,
         return inode;
 }
 
-static struct super_operations gadget_fs_operations = {
+static const struct super_operations gadget_fs_operations = {
         .statfs =       simple_statfs,
         .drop_inode =   generic_delete_inode,
 };
diff --git a/drivers/usb/gadget/m66592-udc.c b/drivers/usb/gadget/m66592-udc.c
index 43dcf9e1af6b..a8c8543d1b08 100644
--- a/drivers/usb/gadget/m66592-udc.c
+++ b/drivers/usb/gadget/m66592-udc.c
@@ -25,44 +25,18 @@
 #include <linux/delay.h>
 #include <linux/io.h>
 #include <linux/platform_device.h>
-
+#include <linux/err.h>
 #include <linux/usb/ch9.h>
 #include <linux/usb/gadget.h>
 
 #include "m66592-udc.h"
 
-
 MODULE_DESCRIPTION("M66592 USB gadget driver");
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Yoshihiro Shimoda");
 MODULE_ALIAS("platform:m66592_udc");
 
-#define DRIVER_VERSION  "18 Oct 2007"
-
-/* module parameters */
-#if defined(CONFIG_SUPERH_BUILT_IN_M66592)
-static unsigned short endian = M66592_LITTLE;
-module_param(endian, ushort, 0644);
-MODULE_PARM_DESC(endian, "data endian: big=0, little=0 (default=0)");
-#else
-static unsigned short clock = M66592_XTAL24;
-module_param(clock, ushort, 0644);
-MODULE_PARM_DESC(clock, "input clock: 48MHz=32768, 24MHz=16384, 12MHz=0 "
-                "(default=16384)");
-
-static unsigned short vif = M66592_LDRV;
-module_param(vif, ushort, 0644);
-MODULE_PARM_DESC(vif, "input VIF: 3.3V=32768, 1.5V=0 (default=32768)");
-
-static unsigned short endian;
-module_param(endian, ushort, 0644);
-MODULE_PARM_DESC(endian, "data endian: big=256, little=0 (default=0)");
-
-static unsigned short irq_sense = M66592_INTL;
-module_param(irq_sense, ushort, 0644);
-MODULE_PARM_DESC(irq_sense, "IRQ sense: low level=2, falling edge=0 "
-                "(default=2)");
-#endif
+#define DRIVER_VERSION  "21 July 2009"
 
 static const char udc_name[] = "m66592_udc";
 static const char *m66592_ep_name[] = {
@@ -244,6 +218,7 @@ static inline int get_buffer_size(struct m66592 *m66592, u16 pipenum)
 static inline void pipe_change(struct m66592 *m66592, u16 pipenum)
 {
         struct m66592_ep *ep = m66592->pipenum2ep[pipenum];
+        unsigned short mbw;
 
         if (ep->use_dma)
                 return;
@@ -252,7 +227,12 @@ static inline void pipe_change(struct m66592 *m66592, u16 pipenum)
 
         ndelay(450);
 
-        m66592_bset(m66592, M66592_MBW, ep->fifosel);
+        if (m66592->pdata->on_chip)
+                mbw = M66592_MBW_32;
+        else
+                mbw = M66592_MBW_16;
+
+        m66592_bset(m66592, mbw, ep->fifosel);
 }
 
 static int pipe_buffer_setting(struct m66592 *m66592,
@@ -276,24 +256,27 @@ static int pipe_buffer_setting(struct m66592 *m66592,
                 buf_bsize = 0;
                 break;
         case M66592_BULK:
-                bufnum = m66592->bi_bufnum +
-                         (info->pipe - M66592_BASE_PIPENUM_BULK) * 16;
-                m66592->bi_bufnum += 16;
+                /* isochronous pipes may be used as bulk pipes */
+                if (info->pipe > M66592_BASE_PIPENUM_BULK)
+                        bufnum = info->pipe - M66592_BASE_PIPENUM_BULK;
+                else
+                        bufnum = info->pipe - M66592_BASE_PIPENUM_ISOC;
+
+                bufnum = M66592_BASE_BUFNUM + (bufnum * 16);
                 buf_bsize = 7;
                 pipecfg |= M66592_DBLB;
                 if (!info->dir_in)
                         pipecfg |= M66592_SHTNAK;
                 break;
         case M66592_ISO:
-                bufnum = m66592->bi_bufnum +
+                bufnum = M66592_BASE_BUFNUM +
                          (info->pipe - M66592_BASE_PIPENUM_ISOC) * 16;
-                m66592->bi_bufnum += 16;
                 buf_bsize = 7;
                 break;
         }
-        if (m66592->bi_bufnum > M66592_MAX_BUFNUM) {
-                pr_err("m66592 pipe memory is insufficient(%d)\n",
-                                m66592->bi_bufnum);
+
+        if (buf_bsize && ((bufnum + 16) >= M66592_MAX_BUFNUM)) {
+                pr_err("m66592 pipe memory is insufficient\n");
                 return -ENOMEM;
         }
 
@@ -313,17 +296,6 @@ static void pipe_buffer_release(struct m66592 *m66592,
         if (info->pipe == 0)
                 return;
 
-        switch (info->type) {
-        case M66592_BULK:
-                if (is_bulk_pipe(info->pipe))
-                        m66592->bi_bufnum -= 16;
-                break;
-        case M66592_ISO:
-                if (is_isoc_pipe(info->pipe))
-                        m66592->bi_bufnum -= 16;
-                break;
-        }
-
         if (is_bulk_pipe(info->pipe)) {
                 m66592->bulk--;
         } else if (is_interrupt_pipe(info->pipe))
@@ -340,6 +312,7 @@ static void pipe_buffer_release(struct m66592 *m66592,
 static void pipe_initialize(struct m66592_ep *ep)
 {
         struct m66592 *m66592 = ep->m66592;
+        unsigned short mbw;
 
         m66592_mdfy(m66592, 0, M66592_CURPIPE, ep->fifosel);
 
@@ -351,7 +324,12 @@ static void pipe_initialize(struct m66592_ep *ep)
 
                 ndelay(450);
 
-                m66592_bset(m66592, M66592_MBW, ep->fifosel);
+                if (m66592->pdata->on_chip)
+                        mbw = M66592_MBW_32;
+                else
+                        mbw = M66592_MBW_16;
+
+                m66592_bset(m66592, mbw, ep->fifosel);
         }
 }
 
@@ -367,15 +345,13 @@ static void m66592_ep_setting(struct m66592 *m66592, struct m66592_ep *ep,
                         ep->fifosel = M66592_D0FIFOSEL;
                         ep->fifoctr = M66592_D0FIFOCTR;
                         ep->fifotrn = M66592_D0FIFOTRN;
-#if !defined(CONFIG_SUPERH_BUILT_IN_M66592)
-                } else if (m66592->num_dma == 1) {
+                } else if (!m66592->pdata->on_chip && m66592->num_dma == 1) {
                         m66592->num_dma++;
                         ep->use_dma = 1;
                         ep->fifoaddr = M66592_D1FIFO;
                         ep->fifosel = M66592_D1FIFOSEL;
                         ep->fifoctr = M66592_D1FIFOCTR;
                         ep->fifotrn = M66592_D1FIFOTRN;
-#endif
                 } else {
                         ep->use_dma = 0;
                         ep->fifoaddr = M66592_CFIFO;
@@ -620,76 +596,120 @@ static void start_ep0(struct m66592_ep *ep, struct m66592_request *req)
         }
 }
 
-#if defined(CONFIG_SUPERH_BUILT_IN_M66592)
 static void init_controller(struct m66592 *m66592)
 {
-        m66592_bset(m66592, M66592_HSE, M66592_SYSCFG);         /* High spd */
-        m66592_bclr(m66592, M66592_USBE, M66592_SYSCFG);
-        m66592_bclr(m66592, M66592_DPRPU, M66592_SYSCFG);
-        m66592_bset(m66592, M66592_USBE, M66592_SYSCFG);
+        unsigned int endian;
 
-        /* This is a workaound for SH7722 2nd cut */
-        m66592_bset(m66592, 0x8000, M66592_DVSTCTR);
-        m66592_bset(m66592, 0x1000, M66592_TESTMODE);
-        m66592_bclr(m66592, 0x8000, M66592_DVSTCTR);
+        if (m66592->pdata->on_chip) {
+                if (m66592->pdata->endian)
+                        endian = 0; /* big endian */
+                else
+                        endian = M66592_LITTLE; /* little endian */
 
-        m66592_bset(m66592, M66592_INTL, M66592_INTENB1);
+                m66592_bset(m66592, M66592_HSE, M66592_SYSCFG); /* High spd */
+                m66592_bclr(m66592, M66592_USBE, M66592_SYSCFG);
+                m66592_bclr(m66592, M66592_DPRPU, M66592_SYSCFG);
+                m66592_bset(m66592, M66592_USBE, M66592_SYSCFG);
 
-        m66592_write(m66592, 0, M66592_CFBCFG);
-        m66592_write(m66592, 0, M66592_D0FBCFG);
-        m66592_bset(m66592, endian, M66592_CFBCFG);
-        m66592_bset(m66592, endian, M66592_D0FBCFG);
-}
-#else   /* #if defined(CONFIG_SUPERH_BUILT_IN_M66592) */
-static void init_controller(struct m66592 *m66592)
-{
-        m66592_bset(m66592, (vif & M66592_LDRV) | (endian & M66592_BIGEND),
-                        M66592_PINCFG);
-        m66592_bset(m66592, M66592_HSE, M66592_SYSCFG);         /* High spd */
-        m66592_mdfy(m66592, clock & M66592_XTAL, M66592_XTAL, M66592_SYSCFG);
+                /* This is a workaound for SH7722 2nd cut */
+                m66592_bset(m66592, 0x8000, M66592_DVSTCTR);
+                m66592_bset(m66592, 0x1000, M66592_TESTMODE);
+                m66592_bclr(m66592, 0x8000, M66592_DVSTCTR);
 
-        m66592_bclr(m66592, M66592_USBE, M66592_SYSCFG);
-        m66592_bclr(m66592, M66592_DPRPU, M66592_SYSCFG);
-        m66592_bset(m66592, M66592_USBE, M66592_SYSCFG);
+                m66592_bset(m66592, M66592_INTL, M66592_INTENB1);
+
+                m66592_write(m66592, 0, M66592_CFBCFG);
+                m66592_write(m66592, 0, M66592_D0FBCFG);
+                m66592_bset(m66592, endian, M66592_CFBCFG);
+                m66592_bset(m66592, endian, M66592_D0FBCFG);
+        } else {
+                unsigned int clock, vif, irq_sense;
+
+                if (m66592->pdata->endian)
+                        endian = M66592_BIGEND; /* big endian */
+                else
+                        endian = 0; /* little endian */
+
+                if (m66592->pdata->vif)
+                        vif = M66592_LDRV; /* 3.3v */
+                else
+                        vif = 0; /* 1.5v */
+
+                switch (m66592->pdata->xtal) {
+                case M66592_PLATDATA_XTAL_12MHZ:
+                        clock = M66592_XTAL12;
+                        break;
+                case M66592_PLATDATA_XTAL_24MHZ:
+                        clock = M66592_XTAL24;
+                        break;
+                case M66592_PLATDATA_XTAL_48MHZ:
+                        clock = M66592_XTAL48;
+                        break;
+                default:
+                        pr_warning("m66592-udc: xtal configuration error\n");
+                        clock = 0;
+                }
+
+                switch (m66592->irq_trigger) {
+                case IRQF_TRIGGER_LOW:
+                        irq_sense = M66592_INTL;
+                        break;
+                case IRQF_TRIGGER_FALLING:
+                        irq_sense = 0;
+                        break;
+                default:
+                        pr_warning("m66592-udc: irq trigger config error\n");
+                        irq_sense = 0;
+                }
 
-        m66592_bset(m66592, M66592_XCKE, M66592_SYSCFG);
+                m66592_bset(m66592,
+                            (vif & M66592_LDRV) | (endian & M66592_BIGEND),
+                            M66592_PINCFG);
+                m66592_bset(m66592, M66592_HSE, M66592_SYSCFG); /* High spd */
+                m66592_mdfy(m66592, clock & M66592_XTAL, M66592_XTAL,
+                            M66592_SYSCFG);
+                m66592_bclr(m66592, M66592_USBE, M66592_SYSCFG);
+                m66592_bclr(m66592, M66592_DPRPU, M66592_SYSCFG);
+                m66592_bset(m66592, M66592_USBE, M66592_SYSCFG);
+
+                m66592_bset(m66592, M66592_XCKE, M66592_SYSCFG);
 
-        msleep(3);
+                msleep(3);
 
-        m66592_bset(m66592, M66592_RCKE | M66592_PLLC, M66592_SYSCFG);
+                m66592_bset(m66592, M66592_RCKE | M66592_PLLC, M66592_SYSCFG);
 
-        msleep(1);
+                msleep(1);
 
-        m66592_bset(m66592, M66592_SCKE, M66592_SYSCFG);
+                m66592_bset(m66592, M66592_SCKE, M66592_SYSCFG);
 
-        m66592_bset(m66592, irq_sense & M66592_INTL, M66592_INTENB1);
-        m66592_write(m66592, M66592_BURST | M66592_CPU_ADR_RD_WR,
-                        M66592_DMA0CFG);
+                m66592_bset(m66592, irq_sense & M66592_INTL, M66592_INTENB1);
+                m66592_write(m66592, M66592_BURST | M66592_CPU_ADR_RD_WR,
+                             M66592_DMA0CFG);
+        }
 }
-#endif  /* #if defined(CONFIG_SUPERH_BUILT_IN_M66592) */
 
 static void disable_controller(struct m66592 *m66592)
 {
-#if !defined(CONFIG_SUPERH_BUILT_IN_M66592)
-        m66592_bclr(m66592, M66592_SCKE, M66592_SYSCFG);
-        udelay(1);
-        m66592_bclr(m66592, M66592_PLLC, M66592_SYSCFG);
-        udelay(1);
-        m66592_bclr(m66592, M66592_RCKE, M66592_SYSCFG);
-        udelay(1);
-        m66592_bclr(m66592, M66592_XCKE, M66592_SYSCFG);
-#endif
+        if (!m66592->pdata->on_chip) {
+                m66592_bclr(m66592, M66592_SCKE, M66592_SYSCFG);
+                udelay(1);
+                m66592_bclr(m66592, M66592_PLLC, M66592_SYSCFG);
+                udelay(1);
+                m66592_bclr(m66592, M66592_RCKE, M66592_SYSCFG);
+                udelay(1);
+                m66592_bclr(m66592, M66592_XCKE, M66592_SYSCFG);
+        }
 }
 
 static void m66592_start_xclock(struct m66592 *m66592)
 {
-#if !defined(CONFIG_SUPERH_BUILT_IN_M66592)
         u16 tmp;
 
-        tmp = m66592_read(m66592, M66592_SYSCFG);
-        if (!(tmp & M66592_XCKE))
-                m66592_bset(m66592, M66592_XCKE, M66592_SYSCFG);
-#endif
+        if (!m66592->pdata->on_chip) {
+                tmp = m66592_read(m66592, M66592_SYSCFG);
+                if (!(tmp & M66592_XCKE))
+                        m66592_bset(m66592, M66592_XCKE, M66592_SYSCFG);
+        }
 }
 
 /*-------------------------------------------------------------------------*/
@@ -1177,8 +1197,7 @@ static irqreturn_t m66592_irq(int irq, void *_m66592)
         intsts0 = m66592_read(m66592, M66592_INTSTS0);
         intenb0 = m66592_read(m66592, M66592_INTENB0);
 
-#if defined(CONFIG_SUPERH_BUILT_IN_M66592)
-        if (!intsts0 && !intenb0) {
+        if (m66592->pdata->on_chip && !intsts0 && !intenb0) {
                 /*
                  * When USB clock stops, it cannot read register. Even if a
                  * clock stops, the interrupt occurs. So this driver turn on
@@ -1188,7 +1207,6 @@ static irqreturn_t m66592_irq(int irq, void *_m66592)
                 intsts0 = m66592_read(m66592, M66592_INTSTS0);
                 intenb0 = m66592_read(m66592, M66592_INTENB0);
         }
-#endif
 
         savepipe = m66592_read(m66592, M66592_CFIFOSEL);
 
@@ -1534,9 +1552,11 @@ static int __exit m66592_remove(struct platform_device *pdev)
         iounmap(m66592->reg);
         free_irq(platform_get_irq(pdev, 0), m66592);
         m66592_free_request(&m66592->ep[0].ep, m66592->ep0_req);
-#if defined(CONFIG_SUPERH_BUILT_IN_M66592) && defined(CONFIG_HAVE_CLK)
-        clk_disable(m66592->clk);
-        clk_put(m66592->clk);
+#ifdef CONFIG_HAVE_CLK
+        if (m66592->pdata->on_chip) {
+                clk_disable(m66592->clk);
+                clk_put(m66592->clk);
+        }
 #endif
         kfree(m66592);
         return 0;
@@ -1548,11 +1568,10 @@ static void nop_completion(struct usb_ep *ep, struct usb_request *r)
 
 static int __init m66592_probe(struct platform_device *pdev)
 {
-        struct resource *res;
-        int irq;
+        struct resource *res, *ires;
         void __iomem *reg = NULL;
         struct m66592 *m66592 = NULL;
-#if defined(CONFIG_SUPERH_BUILT_IN_M66592) && defined(CONFIG_HAVE_CLK)
+#ifdef CONFIG_HAVE_CLK
         char clk_name[8];
 #endif
         int ret = 0;
@@ -1565,10 +1584,11 @@ static int __init m66592_probe(struct platform_device *pdev)
                 goto clean_up;
         }
 
-        irq = platform_get_irq(pdev, 0);
-        if (irq < 0) {
+        ires = platform_get_resource(pdev, IORESOURCE_IRQ, 0);
+        if (!ires) {
                 ret = -ENODEV;
-                pr_err("platform_get_irq error.\n");
+                dev_err(&pdev->dev,
+                        "platform_get_resource IORESOURCE_IRQ error.\n");
                 goto clean_up;
         }
 
@@ -1579,6 +1599,12 @@ static int __init m66592_probe(struct platform_device *pdev)
                 goto clean_up;
         }
 
+        if (pdev->dev.platform_data == NULL) {
+                dev_err(&pdev->dev, "no platform data\n");
+                ret = -ENODEV;
+                goto clean_up;
+        }
+
         /* initialize ucd */
         m66592 = kzalloc(sizeof(struct m66592), GFP_KERNEL);
         if (m66592 == NULL) {
@@ -1586,6 +1612,9 @@ static int __init m66592_probe(struct platform_device *pdev)
                 goto clean_up;
         }
 
+        m66592->pdata = pdev->dev.platform_data;
+        m66592->irq_trigger = ires->flags & IRQF_TRIGGER_MASK;
+
         spin_lock_init(&m66592->lock);
         dev_set_drvdata(&pdev->dev, m66592);
 
@@ -1603,24 +1632,25 @@ static int __init m66592_probe(struct platform_device *pdev)
         m66592->timer.data = (unsigned long)m66592;
         m66592->reg = reg;
 
-        m66592->bi_bufnum = M66592_BASE_BUFNUM;
-
-        ret = request_irq(irq, m66592_irq, IRQF_DISABLED | IRQF_SHARED,
+        ret = request_irq(ires->start, m66592_irq, IRQF_DISABLED | IRQF_SHARED,
                         udc_name, m66592);
         if (ret < 0) {
                 pr_err("request_irq error (%d)\n", ret);
                 goto clean_up;
         }
 
-#if defined(CONFIG_SUPERH_BUILT_IN_M66592) && defined(CONFIG_HAVE_CLK)
-        snprintf(clk_name, sizeof(clk_name), "usbf%d", pdev->id);
-        m66592->clk = clk_get(&pdev->dev, clk_name);
-        if (IS_ERR(m66592->clk)) {
-                dev_err(&pdev->dev, "cannot get clock \"%s\"\n", clk_name);
-                ret = PTR_ERR(m66592->clk);
-                goto clean_up2;
+#ifdef CONFIG_HAVE_CLK
+        if (m66592->pdata->on_chip) {
+                snprintf(clk_name, sizeof(clk_name), "usbf%d", pdev->id);
+                m66592->clk = clk_get(&pdev->dev, clk_name);
+                if (IS_ERR(m66592->clk)) {
+                        dev_err(&pdev->dev, "cannot get clock \"%s\"\n",
+                                clk_name);
+                        ret = PTR_ERR(m66592->clk);
+                        goto clean_up2;
+                }
+                clk_enable(m66592->clk);
         }
-        clk_enable(m66592->clk);
 #endif
         INIT_LIST_HEAD(&m66592->gadget.ep_list);
         m66592->gadget.ep0 = &m66592->ep[0].ep;
@@ -1662,12 +1692,14 @@ static int __init m66592_probe(struct platform_device *pdev)
         return 0;
 
 clean_up3:
-#if defined(CONFIG_SUPERH_BUILT_IN_M66592) && defined(CONFIG_HAVE_CLK)
-        clk_disable(m66592->clk);
-        clk_put(m66592->clk);
+#ifdef CONFIG_HAVE_CLK
+        if (m66592->pdata->on_chip) {
+                clk_disable(m66592->clk);
+                clk_put(m66592->clk);
+        }
 clean_up2:
 #endif
-        free_irq(irq, m66592);
+        free_irq(ires->start, m66592);
 clean_up:
         if (m66592) {
                 if (m66592->ep0_req)
diff --git a/drivers/usb/gadget/m66592-udc.h b/drivers/usb/gadget/m66592-udc.h
index 286ce07e7960..8b960deed680 100644
--- a/drivers/usb/gadget/m66592-udc.h
+++ b/drivers/usb/gadget/m66592-udc.h
@@ -23,10 +23,12 @@
 #ifndef __M66592_UDC_H__
 #define __M66592_UDC_H__
 
-#if defined(CONFIG_SUPERH_BUILT_IN_M66592) && defined(CONFIG_HAVE_CLK)
+#ifdef CONFIG_HAVE_CLK
 #include <linux/clk.h>
 #endif
 
+#include <linux/usb/m66592.h>
+
 #define M66592_SYSCFG           0x00
 #define M66592_XTAL             0xC000  /* b15-14: Crystal selection */
 #define   M66592_XTAL48          0x8000         /* 48MHz */
@@ -76,11 +78,11 @@
 #define   M66592_P_TST_J         0x0001         /* PERI TEST J */
 #define   M66592_P_TST_NORMAL    0x0000         /* PERI Normal Mode */
 
-#if defined(CONFIG_SUPERH_BUILT_IN_M66592)
+/* built-in registers */
 #define M66592_CFBCFG           0x0A
 #define M66592_D0FBCFG          0x0C
 #define M66592_LITTLE           0x0100  /* b8: Little endian mode */
-#else
+/* external chip case */
 #define M66592_PINCFG           0x0A
 #define M66592_LDRV             0x8000  /* b15: Drive Current Adjust */
 #define M66592_BIGEND           0x0100  /* b8: Big endian mode */
@@ -100,8 +102,8 @@
 #define M66592_PKTM             0x0020  /* b5: Packet mode */
 #define M66592_DENDE            0x0010  /* b4: Dend enable */
 #define M66592_OBUS             0x0004  /* b2: OUTbus mode */
-#endif  /* #if defined(CONFIG_SUPERH_BUILT_IN_M66592) */
 
+/* common case */
 #define M66592_CFIFO            0x10
 #define M66592_D0FIFO           0x14
 #define M66592_D1FIFO           0x18
@@ -113,13 +115,9 @@
 #define M66592_REW              0x4000  /* b14: Buffer rewind */
 #define M66592_DCLRM            0x2000  /* b13: DMA buffer clear mode */
 #define M66592_DREQE            0x1000  /* b12: DREQ output enable */
-#if defined(CONFIG_SUPERH_BUILT_IN_M66592)
-#define M66592_MBW              0x0800  /* b11: Maximum bit width for FIFO */
-#else
-#define M66592_MBW              0x0400  /* b10: Maximum bit width for FIFO */
-#define   M66592_MBW_8           0x0000   /*  8bit */
-#define   M66592_MBW_16          0x0400   /* 16bit */
-#endif  /* #if defined(CONFIG_SUPERH_BUILT_IN_M66592) */
+#define M66592_MBW_8            0x0000   /*  8bit */
+#define M66592_MBW_16           0x0400   /* 16bit */
+#define M66592_MBW_32           0x0800   /* 32bit */
 #define M66592_TRENB            0x0200  /* b9: Transaction counter enable */
 #define M66592_TRCLR            0x0100  /* b8: Transaction counter clear */
 #define M66592_DEZPM            0x0080  /* b7: Zero-length packet mode */
@@ -480,9 +478,11 @@ struct m66592_ep {
 struct m66592 {
         spinlock_t              lock;
         void __iomem            *reg;
-#if defined(CONFIG_SUPERH_BUILT_IN_M66592) && defined(CONFIG_HAVE_CLK)
+#ifdef CONFIG_HAVE_CLK
         struct clk *clk;
 #endif
+        struct m66592_platdata  *pdata;
+        unsigned long           irq_trigger;
 
         struct usb_gadget               gadget;
         struct usb_gadget_driver        *driver;
@@ -506,7 +506,6 @@ struct m66592 {
         int interrupt;
         int isochronous;
         int num_dma;
-        int bi_bufnum;  /* bulk and isochronous's bufnum */
 };
 
 #define gadget_to_m66592(_gadget) container_of(_gadget, struct m66592, gadget)
@@ -547,13 +546,13 @@ static inline void m66592_read_fifo(struct m66592 *m66592,
 {
         unsigned long fifoaddr = (unsigned long)m66592->reg + offset;
 
-#if defined(CONFIG_SUPERH_BUILT_IN_M66592)
-        len = (len + 3) / 4;
-        insl(fifoaddr, buf, len);
-#else
-        len = (len + 1) / 2;
-        insw(fifoaddr, buf, len);
-#endif
+        if (m66592->pdata->on_chip) {
+                len = (len + 3) / 4;
+                insl(fifoaddr, buf, len);
+        } else {
+                len = (len + 1) / 2;
+                insw(fifoaddr, buf, len);
+        }
 }
 
 static inline void m66592_write(struct m66592 *m66592, u16 val,
@@ -567,33 +566,34 @@ static inline void m66592_write_fifo(struct m66592 *m66592,
                 void *buf, unsigned long len)
 {
         unsigned long fifoaddr = (unsigned long)m66592->reg + offset;
-#if defined(CONFIG_SUPERH_BUILT_IN_M66592)
-        unsigned long count;
-        unsigned char *pb;
-        int i;
-
-        count = len / 4;
-        outsl(fifoaddr, buf, count);
-
-        if (len & 0x00000003) {
-                pb = buf + count * 4;
-                for (i = 0; i < (len & 0x00000003); i++) {
-                        if (m66592_read(m66592, M66592_CFBCFG)) /* little */
-                                outb(pb[i], fifoaddr + (3 - i));
-                        else
-                                outb(pb[i], fifoaddr + i);
+
+        if (m66592->pdata->on_chip) {
+                unsigned long count;
+                unsigned char *pb;
+                int i;
+
+                count = len / 4;
+                outsl(fifoaddr, buf, count);
+
+                if (len & 0x00000003) {
+                        pb = buf + count * 4;
+                        for (i = 0; i < (len & 0x00000003); i++) {
+                                if (m66592_read(m66592, M66592_CFBCFG)) /* le */
+                                        outb(pb[i], fifoaddr + (3 - i));
+                                else
+                                        outb(pb[i], fifoaddr + i);
+                        }
+                }
+        } else {
+                unsigned long odd = len & 0x0001;
+
+                len = len / 2;
+                outsw(fifoaddr, buf, len);
+                if (odd) {
+                        unsigned char *p = buf + len*2;
+                        outb(*p, fifoaddr);
                 }
         }
-#else
-        unsigned long odd = len & 0x0001;
-
-        len = len / 2;
-        outsw(fifoaddr, buf, len);
-        if (odd) {
-                unsigned char *p = buf + len*2;
-                outb(*p, fifoaddr);
-        }
-#endif  /* #if defined(CONFIG_SUPERH_BUILT_IN_M66592) */
 }
 
 static inline void m66592_mdfy(struct m66592 *m66592, u16 val, u16 pat,
diff --git a/drivers/usb/gadget/pxa25x_udc.c b/drivers/usb/gadget/pxa25x_udc.c
index ed21e263f832..e6fedbd5a654 100644
--- a/drivers/usb/gadget/pxa25x_udc.c
+++ b/drivers/usb/gadget/pxa25x_udc.c
@@ -56,6 +56,7 @@
 
 #include <linux/usb/ch9.h>
 #include <linux/usb/gadget.h>
+#include <linux/usb/otg.h>
 
 /*
  * This driver is PXA25x only.  Grab the right register definitions.
@@ -1008,15 +1009,27 @@ static int pxa25x_udc_pullup(struct usb_gadget *_gadget, int is_active)
         return 0;
 }
 
+/* boards may consume current from VBUS, up to 100-500mA based on config.
+ * the 500uA suspend ceiling means that exclusively vbus-powered PXA designs
+ * violate USB specs.
+ */
+static int pxa25x_udc_vbus_draw(struct usb_gadget *_gadget, unsigned mA)
+{
+        struct pxa25x_udc       *udc;
+
+        udc = container_of(_gadget, struct pxa25x_udc, gadget);
+
+        if (udc->transceiver)
+                return otg_set_power(udc->transceiver, mA);
+        return -EOPNOTSUPP;
+}
+
 static const struct usb_gadget_ops pxa25x_udc_ops = {
         .get_frame      = pxa25x_udc_get_frame,
         .wakeup         = pxa25x_udc_wakeup,
         .vbus_session   = pxa25x_udc_vbus_session,
         .pullup         = pxa25x_udc_pullup,
-
-        // .vbus_draw ... boards may consume current from VBUS, up to
-        // 100-500mA based on config.  the 500uA suspend ceiling means
-        // that exclusively vbus-powered PXA designs violate USB specs.
+        .vbus_draw      = pxa25x_udc_vbus_draw,
 };
 
 /*-------------------------------------------------------------------------*/
@@ -1303,9 +1316,23 @@ fail:
          * for set_configuration as well as eventual disconnect.
          */
         DMSG("registered gadget driver '%s'\n", driver->driver.name);
+
+        /* connect to bus through transceiver */
+        if (dev->transceiver) {
+                retval = otg_set_peripheral(dev->transceiver, &dev->gadget);
+                if (retval) {
+                        DMSG("can't bind to transceiver\n");
+                        if (driver->unbind)
+                                driver->unbind(&dev->gadget);
+                        goto bind_fail;
+                }
+        }
+
         pullup(dev);
         dump_state(dev);
         return 0;
+bind_fail:
+        return retval;
 }
 EXPORT_SYMBOL(usb_gadget_register_driver);
 
@@ -1351,6 +1378,9 @@ int usb_gadget_unregister_driver(struct usb_gadget_driver *driver)
         stop_activity(dev, driver);
         local_irq_enable();
 
+        if (dev->transceiver)
+                (void) otg_set_peripheral(dev->transceiver, NULL);
+
         driver->unbind(&dev->gadget);
         dev->gadget.dev.driver = NULL;
         dev->driver = NULL;
@@ -2162,6 +2192,8 @@ static int __init pxa25x_udc_probe(struct platform_device *pdev)
         dev->dev = &pdev->dev;
         dev->mach = pdev->dev.platform_data;
 
+        dev->transceiver = otg_get_transceiver();
+
         if (gpio_is_valid(dev->mach->gpio_vbus)) {
                 if ((retval = gpio_request(dev->mach->gpio_vbus,
                                 "pxa25x_udc GPIO VBUS"))) {
@@ -2264,6 +2296,10 @@ lubbock_fail0:
         if (gpio_is_valid(dev->mach->gpio_vbus))
                 gpio_free(dev->mach->gpio_vbus);
  err_gpio_vbus:
+        if (dev->transceiver) {
+                otg_put_transceiver(dev->transceiver);
+                dev->transceiver = NULL;
+        }
         clk_put(dev->clk);
  err_clk:
         return retval;
@@ -2305,6 +2341,11 @@ static int __exit pxa25x_udc_remove(struct platform_device *pdev)
 
         clk_put(dev->clk);
 
+        if (dev->transceiver) {
+                otg_put_transceiver(dev->transceiver);
+                dev->transceiver = NULL;
+        }
+
         platform_set_drvdata(pdev, NULL);
         the_controller = NULL;
         return 0;
diff --git a/drivers/usb/gadget/pxa25x_udc.h b/drivers/usb/gadget/pxa25x_udc.h
index 1d51aa21e6eb..f572c5617462 100644
--- a/drivers/usb/gadget/pxa25x_udc.h
+++ b/drivers/usb/gadget/pxa25x_udc.h
@@ -128,6 +128,7 @@ struct pxa25x_udc {
         struct device                           *dev;
         struct clk                              *clk;
         struct pxa2xx_udc_mach_info             *mach;
+        struct otg_transceiver                  *transceiver;
         u64                                     dma_mask;
         struct pxa25x_ep                        ep [PXA_UDC_NUM_ENDPOINTS];
 
diff --git a/drivers/usb/gadget/r8a66597-udc.c b/drivers/usb/gadget/r8a66597-udc.c
new file mode 100644
index 000000000000..e220fb8091a3
--- /dev/null
+++ b/drivers/usb/gadget/r8a66597-udc.c
@@ -0,0 +1,1689 @@
+/*
+ * R8A66597 UDC (USB gadget)
+ *
+ * Copyright (C) 2006-2009 Renesas Solutions Corp.
+ *
+ * Author : Yoshihiro Shimoda <shimoda.yoshihiro@renesas.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; version 2 of the License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ *
+ */
+
+#include <linux/module.h>
+#include <linux/interrupt.h>
+#include <linux/delay.h>
+#include <linux/io.h>
+#include <linux/platform_device.h>
+#include <linux/clk.h>
+
+#include <linux/usb/ch9.h>
+#include <linux/usb/gadget.h>
+
+#include "r8a66597-udc.h"
+
+#define DRIVER_VERSION  "2009-08-18"
+
+static const char udc_name[] = "r8a66597_udc";
+static const char *r8a66597_ep_name[] = {
+        "ep0", "ep1", "ep2", "ep3", "ep4", "ep5", "ep6", "ep7",
+        "ep8", "ep9",
+};
+
+static void disable_controller(struct r8a66597 *r8a66597);
+static void irq_ep0_write(struct r8a66597_ep *ep, struct r8a66597_request *req);
+static void irq_packet_write(struct r8a66597_ep *ep,
+                                struct r8a66597_request *req);
+static int r8a66597_queue(struct usb_ep *_ep, struct usb_request *_req,
+                        gfp_t gfp_flags);
+
+static void transfer_complete(struct r8a66597_ep *ep,
+                struct r8a66597_request *req, int status);
+
+/*-------------------------------------------------------------------------*/
+static inline u16 get_usb_speed(struct r8a66597 *r8a66597)
+{
+        return r8a66597_read(r8a66597, DVSTCTR0) & RHST;
+}
+
+static void enable_pipe_irq(struct r8a66597 *r8a66597, u16 pipenum,
+                unsigned long reg)
+{
+        u16 tmp;
+
+        tmp = r8a66597_read(r8a66597, INTENB0);
+        r8a66597_bclr(r8a66597, BEMPE | NRDYE | BRDYE,
+                        INTENB0);
+        r8a66597_bset(r8a66597, (1 << pipenum), reg);
+        r8a66597_write(r8a66597, tmp, INTENB0);
+}
+
+static void disable_pipe_irq(struct r8a66597 *r8a66597, u16 pipenum,
+                unsigned long reg)
+{
+        u16 tmp;
+
+        tmp = r8a66597_read(r8a66597, INTENB0);
+        r8a66597_bclr(r8a66597, BEMPE | NRDYE | BRDYE,
+                        INTENB0);
+        r8a66597_bclr(r8a66597, (1 << pipenum), reg);
+        r8a66597_write(r8a66597, tmp, INTENB0);
+}
+
+static void r8a66597_usb_connect(struct r8a66597 *r8a66597)
+{
+        r8a66597_bset(r8a66597, CTRE, INTENB0);
+        r8a66597_bset(r8a66597, BEMPE | BRDYE, INTENB0);
+
+        r8a66597_bset(r8a66597, DPRPU, SYSCFG0);
+}
+
+static void r8a66597_usb_disconnect(struct r8a66597 *r8a66597)
+__releases(r8a66597->lock)
+__acquires(r8a66597->lock)
+{
+        r8a66597_bclr(r8a66597, CTRE, INTENB0);
+        r8a66597_bclr(r8a66597, BEMPE | BRDYE, INTENB0);
+        r8a66597_bclr(r8a66597, DPRPU, SYSCFG0);
+
+        r8a66597->gadget.speed = USB_SPEED_UNKNOWN;
+        spin_unlock(&r8a66597->lock);
+        r8a66597->driver->disconnect(&r8a66597->gadget);
+        spin_lock(&r8a66597->lock);
+
+        disable_controller(r8a66597);
+        INIT_LIST_HEAD(&r8a66597->ep[0].queue);
+}
+
+static inline u16 control_reg_get_pid(struct r8a66597 *r8a66597, u16 pipenum)
+{
+        u16 pid = 0;
+        unsigned long offset;
+
+        if (pipenum == 0)
+                pid = r8a66597_read(r8a66597, DCPCTR) & PID;
+        else if (pipenum < R8A66597_MAX_NUM_PIPE) {
+                offset = get_pipectr_addr(pipenum);
+                pid = r8a66597_read(r8a66597, offset) & PID;
+        } else
+                printk(KERN_ERR "unexpect pipe num (%d)\n", pipenum);
+
+        return pid;
+}
+
+static inline void control_reg_set_pid(struct r8a66597 *r8a66597, u16 pipenum,
+                u16 pid)
+{
+        unsigned long offset;
+
+        if (pipenum == 0)
+                r8a66597_mdfy(r8a66597, pid, PID, DCPCTR);
+        else if (pipenum < R8A66597_MAX_NUM_PIPE) {
+                offset = get_pipectr_addr(pipenum);
+                r8a66597_mdfy(r8a66597, pid, PID, offset);
+        } else
+                printk(KERN_ERR "unexpect pipe num (%d)\n", pipenum);
+}
+
+static inline void pipe_start(struct r8a66597 *r8a66597, u16 pipenum)
+{
+        control_reg_set_pid(r8a66597, pipenum, PID_BUF);
+}
+
+static inline void pipe_stop(struct r8a66597 *r8a66597, u16 pipenum)
+{
+        control_reg_set_pid(r8a66597, pipenum, PID_NAK);
+}
+
+static inline void pipe_stall(struct r8a66597 *r8a66597, u16 pipenum)
+{
+        control_reg_set_pid(r8a66597, pipenum, PID_STALL);
+}
+
+static inline u16 control_reg_get(struct r8a66597 *r8a66597, u16 pipenum)
+{
+        u16 ret = 0;
+        unsigned long offset;
+
+        if (pipenum == 0)
+                ret = r8a66597_read(r8a66597, DCPCTR);
+        else if (pipenum < R8A66597_MAX_NUM_PIPE) {
+                offset = get_pipectr_addr(pipenum);
+                ret = r8a66597_read(r8a66597, offset);
+        } else
+                printk(KERN_ERR "unexpect pipe num (%d)\n", pipenum);
+
+        return ret;
+}
+
+static inline void control_reg_sqclr(struct r8a66597 *r8a66597, u16 pipenum)
+{
+        unsigned long offset;
+
+        pipe_stop(r8a66597, pipenum);
+
+        if (pipenum == 0)
+                r8a66597_bset(r8a66597, SQCLR, DCPCTR);
+        else if (pipenum < R8A66597_MAX_NUM_PIPE) {
+                offset = get_pipectr_addr(pipenum);
+                r8a66597_bset(r8a66597, SQCLR, offset);
+        } else
+                printk(KERN_ERR "unexpect pipe num(%d)\n", pipenum);
+}
+
+static inline int get_buffer_size(struct r8a66597 *r8a66597, u16 pipenum)
+{
+        u16 tmp;
+        int size;
+
+        if (pipenum == 0) {
+                tmp = r8a66597_read(r8a66597, DCPCFG);
+                if ((tmp & R8A66597_CNTMD) != 0)
+                        size = 256;
+                else {
+                        tmp = r8a66597_read(r8a66597, DCPMAXP);
+                        size = tmp & MAXP;
+                }
+        } else {
+                r8a66597_write(r8a66597, pipenum, PIPESEL);
+                tmp = r8a66597_read(r8a66597, PIPECFG);
+                if ((tmp & R8A66597_CNTMD) != 0) {
+                        tmp = r8a66597_read(r8a66597, PIPEBUF);
+                        size = ((tmp >> 10) + 1) * 64;
+                } else {
+                        tmp = r8a66597_read(r8a66597, PIPEMAXP);
+                        size = tmp & MXPS;
+                }
+        }
+
+        return size;
+}
+
+static inline unsigned short mbw_value(struct r8a66597 *r8a66597)
+{
+        if (r8a66597->pdata->on_chip)
+                return MBW_32;
+        else
+                return MBW_16;
+}
+
+static inline void pipe_change(struct r8a66597 *r8a66597, u16 pipenum)
+{
+        struct r8a66597_ep *ep = r8a66597->pipenum2ep[pipenum];
+
+        if (ep->use_dma)
+                return;
+
+        r8a66597_mdfy(r8a66597, pipenum, CURPIPE, ep->fifosel);
+
+        ndelay(450);
+
+        r8a66597_bset(r8a66597, mbw_value(r8a66597), ep->fifosel);
+}
+
+static int pipe_buffer_setting(struct r8a66597 *r8a66597,
+                struct r8a66597_pipe_info *info)
+{
+        u16 bufnum = 0, buf_bsize = 0;
+        u16 pipecfg = 0;
+
+        if (info->pipe == 0)
+                return -EINVAL;
+
+        r8a66597_write(r8a66597, info->pipe, PIPESEL);
+
+        if (info->dir_in)
+                pipecfg |= R8A66597_DIR;
+        pipecfg |= info->type;
+        pipecfg |= info->epnum;
+        switch (info->type) {
+        case R8A66597_INT:
+                bufnum = 4 + (info->pipe - R8A66597_BASE_PIPENUM_INT);
+                buf_bsize = 0;
+                break;
+        case R8A66597_BULK:
+                /* isochronous pipes may be used as bulk pipes */
+                if (info->pipe > R8A66597_BASE_PIPENUM_BULK)
+                        bufnum = info->pipe - R8A66597_BASE_PIPENUM_BULK;
+                else
+                        bufnum = info->pipe - R8A66597_BASE_PIPENUM_ISOC;
+
+                bufnum = R8A66597_BASE_BUFNUM + (bufnum * 16);
+                buf_bsize = 7;
+                pipecfg |= R8A66597_DBLB;
+                if (!info->dir_in)
+                        pipecfg |= R8A66597_SHTNAK;
+                break;
+        case R8A66597_ISO:
+                bufnum = R8A66597_BASE_BUFNUM +
+                         (info->pipe - R8A66597_BASE_PIPENUM_ISOC) * 16;
+                buf_bsize = 7;
+                break;
+        }
+
+        if (buf_bsize && ((bufnum + 16) >= R8A66597_MAX_BUFNUM)) {
+                pr_err(KERN_ERR "r8a66597 pipe memory is insufficient\n");
+                return -ENOMEM;
+        }
+
+        r8a66597_write(r8a66597, pipecfg, PIPECFG);
+        r8a66597_write(r8a66597, (buf_bsize << 10) | (bufnum), PIPEBUF);
+        r8a66597_write(r8a66597, info->maxpacket, PIPEMAXP);
+        if (info->interval)
+                info->interval--;
+        r8a66597_write(r8a66597, info->interval, PIPEPERI);
+
+        return 0;
+}
+
+static void pipe_buffer_release(struct r8a66597 *r8a66597,
+                                struct r8a66597_pipe_info *info)
+{
+        if (info->pipe == 0)
+                return;
+
+        if (is_bulk_pipe(info->pipe))
+                r8a66597->bulk--;
+        else if (is_interrupt_pipe(info->pipe))
+                r8a66597->interrupt--;
+        else if (is_isoc_pipe(info->pipe)) {
+                r8a66597->isochronous--;
+                if (info->type == R8A66597_BULK)
+                        r8a66597->bulk--;
+        } else
+                printk(KERN_ERR "ep_release: unexpect pipenum (%d)\n",
+                                info->pipe);
+}
+
+static void pipe_initialize(struct r8a66597_ep *ep)
+{
+        struct r8a66597 *r8a66597 = ep->r8a66597;
+
+        r8a66597_mdfy(r8a66597, 0, CURPIPE, ep->fifosel);
+
+        r8a66597_write(r8a66597, ACLRM, ep->pipectr);
+        r8a66597_write(r8a66597, 0, ep->pipectr);
+        r8a66597_write(r8a66597, SQCLR, ep->pipectr);
+        if (ep->use_dma) {
+                r8a66597_mdfy(r8a66597, ep->pipenum, CURPIPE, ep->fifosel);
+
+                ndelay(450);
+
+                r8a66597_bset(r8a66597, mbw_value(r8a66597), ep->fifosel);
+        }
+}
+
+static void r8a66597_ep_setting(struct r8a66597 *r8a66597,
+                                struct r8a66597_ep *ep,
+                                const struct usb_endpoint_descriptor *desc,
+                                u16 pipenum, int dma)
+{
+        ep->use_dma = 0;
+        ep->fifoaddr = CFIFO;
+        ep->fifosel = CFIFOSEL;
+        ep->fifoctr = CFIFOCTR;
+        ep->fifotrn = 0;
+
+        ep->pipectr = get_pipectr_addr(pipenum);
+        ep->pipenum = pipenum;
+        ep->ep.maxpacket = le16_to_cpu(desc->wMaxPacketSize);
+        r8a66597->pipenum2ep[pipenum] = ep;
+        r8a66597->epaddr2ep[desc->bEndpointAddress & USB_ENDPOINT_NUMBER_MASK]
+                = ep;
+        INIT_LIST_HEAD(&ep->queue);
+}
+
+static void r8a66597_ep_release(struct r8a66597_ep *ep)
+{
+        struct r8a66597 *r8a66597 = ep->r8a66597;
+        u16 pipenum = ep->pipenum;
+
+        if (pipenum == 0)
+                return;
+
+        if (ep->use_dma)
+                r8a66597->num_dma--;
+        ep->pipenum = 0;
+        ep->busy = 0;
+        ep->use_dma = 0;
+}
+
+static int alloc_pipe_config(struct r8a66597_ep *ep,
+                const struct usb_endpoint_descriptor *desc)
+{
+        struct r8a66597 *r8a66597 = ep->r8a66597;
+        struct r8a66597_pipe_info info;
+        int dma = 0;
+        unsigned char *counter;
+        int ret;
+
+        ep->desc = desc;
+
+        if (ep->pipenum)        /* already allocated pipe  */
+                return 0;
+
+        switch (desc->bmAttributes & USB_ENDPOINT_XFERTYPE_MASK) {
+        case USB_ENDPOINT_XFER_BULK:
+                if (r8a66597->bulk >= R8A66597_MAX_NUM_BULK) {
+                        if (r8a66597->isochronous >= R8A66597_MAX_NUM_ISOC) {
+                                printk(KERN_ERR "bulk pipe is insufficient\n");
+                                return -ENODEV;
+                        } else {
+                                info.pipe = R8A66597_BASE_PIPENUM_ISOC
+                                                + r8a66597->isochronous;
+                                counter = &r8a66597->isochronous;
+                        }
+                } else {
+                        info.pipe = R8A66597_BASE_PIPENUM_BULK + r8a66597->bulk;
+                        counter = &r8a66597->bulk;
+                }
+                info.type = R8A66597_BULK;
+                dma = 1;
+                break;
+        case USB_ENDPOINT_XFER_INT:
+                if (r8a66597->interrupt >= R8A66597_MAX_NUM_INT) {
+                        printk(KERN_ERR "interrupt pipe is insufficient\n");
+                        return -ENODEV;
+                }
+                info.pipe = R8A66597_BASE_PIPENUM_INT + r8a66597->interrupt;
+                info.type = R8A66597_INT;
+                counter = &r8a66597->interrupt;
+                break;
+        case USB_ENDPOINT_XFER_ISOC:
+                if (r8a66597->isochronous >= R8A66597_MAX_NUM_ISOC) {
+                        printk(KERN_ERR "isochronous pipe is insufficient\n");
+                        return -ENODEV;
+                }
+                info.pipe = R8A66597_BASE_PIPENUM_ISOC + r8a66597->isochronous;
+                info.type = R8A66597_ISO;
+                counter = &r8a66597->isochronous;
+                break;
+        default:
+                printk(KERN_ERR "unexpect xfer type\n");
+                return -EINVAL;
+        }
+        ep->type = info.type;
+
+        info.epnum = desc->bEndpointAddress & USB_ENDPOINT_NUMBER_MASK;
+        info.maxpacket = le16_to_cpu(desc->wMaxPacketSize);
+        info.interval = desc->bInterval;
+        if (desc->bEndpointAddress & USB_ENDPOINT_DIR_MASK)
+                info.dir_in = 1;
+        else
+                info.dir_in = 0;
+
+        ret = pipe_buffer_setting(r8a66597, &info);
+        if (ret < 0) {
+                printk(KERN_ERR "pipe_buffer_setting fail\n");
+                return ret;
+        }
+
+        (*counter)++;
+        if ((counter == &r8a66597->isochronous) && info.type == R8A66597_BULK)
+                r8a66597->bulk++;
+
+        r8a66597_ep_setting(r8a66597, ep, desc, info.pipe, dma);
+        pipe_initialize(ep);
+
+        return 0;
+}
+
+static int free_pipe_config(struct r8a66597_ep *ep)
+{
+        struct r8a66597 *r8a66597 = ep->r8a66597;
+        struct r8a66597_pipe_info info;
+
+        info.pipe = ep->pipenum;
+        info.type = ep->type;
+        pipe_buffer_release(r8a66597, &info);
+        r8a66597_ep_release(ep);
+
+        return 0;
+}
+
+/*-------------------------------------------------------------------------*/
+static void pipe_irq_enable(struct r8a66597 *r8a66597, u16 pipenum)
+{
+        enable_irq_ready(r8a66597, pipenum);
+        enable_irq_nrdy(r8a66597, pipenum);
+}
+
+static void pipe_irq_disable(struct r8a66597 *r8a66597, u16 pipenum)
+{
+        disable_irq_ready(r8a66597, pipenum);
+        disable_irq_nrdy(r8a66597, pipenum);
+}
+
+/* if complete is true, gadget driver complete function is not call */
+static void control_end(struct r8a66597 *r8a66597, unsigned ccpl)
+{
+        r8a66597->ep[0].internal_ccpl = ccpl;
+        pipe_start(r8a66597, 0);
+        r8a66597_bset(r8a66597, CCPL, DCPCTR);
+}
+
+static void start_ep0_write(struct r8a66597_ep *ep,
+                                struct r8a66597_request *req)
+{
+        struct r8a66597 *r8a66597 = ep->r8a66597;
+
+        pipe_change(r8a66597, ep->pipenum);
+        r8a66597_mdfy(r8a66597, ISEL, (ISEL | CURPIPE), CFIFOSEL);
+        r8a66597_write(r8a66597, BCLR, ep->fifoctr);
+        if (req->req.length == 0) {
+                r8a66597_bset(r8a66597, BVAL, ep->fifoctr);
+                pipe_start(r8a66597, 0);
+                transfer_complete(ep, req, 0);
+        } else {
+                r8a66597_write(r8a66597, ~BEMP0, BEMPSTS);
+                irq_ep0_write(ep, req);
+        }
+}
+
+static void start_packet_write(struct r8a66597_ep *ep,
+                                struct r8a66597_request *req)
+{
+        struct r8a66597 *r8a66597 = ep->r8a66597;
+        u16 tmp;
+
+        pipe_change(r8a66597, ep->pipenum);
+        disable_irq_empty(r8a66597, ep->pipenum);
+        pipe_start(r8a66597, ep->pipenum);
+
+        tmp = r8a66597_read(r8a66597, ep->fifoctr);
+        if (unlikely((tmp & FRDY) == 0))
+                pipe_irq_enable(r8a66597, ep->pipenum);
+        else
+                irq_packet_write(ep, req);
+}
+
+static void start_packet_read(struct r8a66597_ep *ep,
+                                struct r8a66597_request *req)
+{
+        struct r8a66597 *r8a66597 = ep->r8a66597;
+        u16 pipenum = ep->pipenum;
+
+        if (ep->pipenum == 0) {
+                r8a66597_mdfy(r8a66597, 0, (ISEL | CURPIPE), CFIFOSEL);
+                r8a66597_write(r8a66597, BCLR, ep->fifoctr);
+                pipe_start(r8a66597, pipenum);
+                pipe_irq_enable(r8a66597, pipenum);
+        } else {
+                if (ep->use_dma) {
+                        r8a66597_bset(r8a66597, TRCLR, ep->fifosel);
+                        pipe_change(r8a66597, pipenum);
+                        r8a66597_bset(r8a66597, TRENB, ep->fifosel);
+                        r8a66597_write(r8a66597,
+                                (req->req.length + ep->ep.maxpacket - 1)
+                                        / ep->ep.maxpacket,
+                                ep->fifotrn);
+                }
+                pipe_start(r8a66597, pipenum);  /* trigger once */
+                pipe_irq_enable(r8a66597, pipenum);
+        }
+}
+
+static void start_packet(struct r8a66597_ep *ep, struct r8a66597_request *req)
+{
+        if (ep->desc->bEndpointAddress & USB_DIR_IN)
+                start_packet_write(ep, req);
+        else
+                start_packet_read(ep, req);
+}
+
+static void start_ep0(struct r8a66597_ep *ep, struct r8a66597_request *req)
+{
+        u16 ctsq;
+
+        ctsq = r8a66597_read(ep->r8a66597, INTSTS0) & CTSQ;
+
+        switch (ctsq) {
+        case CS_RDDS:
+                start_ep0_write(ep, req);
+                break;
+        case CS_WRDS:
+                start_packet_read(ep, req);
+                break;
+
+        case CS_WRND:
+                control_end(ep->r8a66597, 0);
+                break;
+        default:
+                printk(KERN_ERR "start_ep0: unexpect ctsq(%x)\n", ctsq);
+                break;
+        }
+}
+
+static void init_controller(struct r8a66597 *r8a66597)
+{
+        u16 vif = r8a66597->pdata->vif ? LDRV : 0;
+        u16 irq_sense = r8a66597->irq_sense_low ? INTL : 0;
+        u16 endian = r8a66597->pdata->endian ? BIGEND : 0;
+
+        if (r8a66597->pdata->on_chip) {
+                r8a66597_bset(r8a66597, 0x04, SYSCFG1);
+                r8a66597_bset(r8a66597, HSE, SYSCFG0);
+
+                r8a66597_bclr(r8a66597, USBE, SYSCFG0);
+                r8a66597_bclr(r8a66597, DPRPU, SYSCFG0);
+                r8a66597_bset(r8a66597, USBE, SYSCFG0);
+
+                r8a66597_bset(r8a66597, SCKE, SYSCFG0);
+
+                r8a66597_bset(r8a66597, irq_sense, INTENB1);
+                r8a66597_write(r8a66597, BURST | CPU_ADR_RD_WR,
+                                DMA0CFG);
+        } else {
+                r8a66597_bset(r8a66597, vif | endian, PINCFG);
+                r8a66597_bset(r8a66597, HSE, SYSCFG0);          /* High spd */
+                r8a66597_mdfy(r8a66597, get_xtal_from_pdata(r8a66597->pdata),
+                                XTAL, SYSCFG0);
+
+                r8a66597_bclr(r8a66597, USBE, SYSCFG0);
+                r8a66597_bclr(r8a66597, DPRPU, SYSCFG0);
+                r8a66597_bset(r8a66597, USBE, SYSCFG0);
+
+                r8a66597_bset(r8a66597, XCKE, SYSCFG0);
+
+                msleep(3);
+
+                r8a66597_bset(r8a66597, PLLC, SYSCFG0);
+
+                msleep(1);
+
+                r8a66597_bset(r8a66597, SCKE, SYSCFG0);
+
+                r8a66597_bset(r8a66597, irq_sense, INTENB1);
+                r8a66597_write(r8a66597, BURST | CPU_ADR_RD_WR,
+                               DMA0CFG);
+        }
+}
+
+static void disable_controller(struct r8a66597 *r8a66597)
+{
+        if (r8a66597->pdata->on_chip) {
+                r8a66597_bset(r8a66597, SCKE, SYSCFG0);
+
+                /* disable interrupts */
+                r8a66597_write(r8a66597, 0, INTENB0);
+                r8a66597_write(r8a66597, 0, INTENB1);
+                r8a66597_write(r8a66597, 0, BRDYENB);
+                r8a66597_write(r8a66597, 0, BEMPENB);
+                r8a66597_write(r8a66597, 0, NRDYENB);
+
+                /* clear status */
+                r8a66597_write(r8a66597, 0, BRDYSTS);
+                r8a66597_write(r8a66597, 0, NRDYSTS);
+                r8a66597_write(r8a66597, 0, BEMPSTS);
+
+                r8a66597_bclr(r8a66597, USBE, SYSCFG0);
+                r8a66597_bclr(r8a66597, SCKE, SYSCFG0);
+
+        } else {
+                r8a66597_bclr(r8a66597, SCKE, SYSCFG0);
+                udelay(1);
+                r8a66597_bclr(r8a66597, PLLC, SYSCFG0);
+                udelay(1);
+                udelay(1);
+                r8a66597_bclr(r8a66597, XCKE, SYSCFG0);
+        }
+}
+
+static void r8a66597_start_xclock(struct r8a66597 *r8a66597)
+{
+        u16 tmp;
+
+        if (!r8a66597->pdata->on_chip) {
+                tmp = r8a66597_read(r8a66597, SYSCFG0);
+                if (!(tmp & XCKE))
+                        r8a66597_bset(r8a66597, XCKE, SYSCFG0);
+        }
+}
+
+static struct r8a66597_request *get_request_from_ep(struct r8a66597_ep *ep)
+{
+        return list_entry(ep->queue.next, struct r8a66597_request, queue);
+}
+
+/*-------------------------------------------------------------------------*/
+static void transfer_complete(struct r8a66597_ep *ep,
+                struct r8a66597_request *req, int status)
+__releases(r8a66597->lock)
+__acquires(r8a66597->lock)
+{
+        int restart = 0;
+
+        if (unlikely(ep->pipenum == 0)) {
+                if (ep->internal_ccpl) {
+                        ep->internal_ccpl = 0;
+                        return;
+                }
+        }
+
+        list_del_init(&req->queue);
+        if (ep->r8a66597->gadget.speed == USB_SPEED_UNKNOWN)
+                req->req.status = -ESHUTDOWN;
+        else
+                req->req.status = status;
+
+        if (!list_empty(&ep->queue))
+                restart = 1;
+
+        spin_unlock(&ep->r8a66597->lock);
+        req->req.complete(&ep->ep, &req->req);
+        spin_lock(&ep->r8a66597->lock);
+
+        if (restart) {
+                req = get_request_from_ep(ep);
+                if (ep->desc)
+                        start_packet(ep, req);
+        }
+}
+
+static void irq_ep0_write(struct r8a66597_ep *ep, struct r8a66597_request *req)
+{
+        int i;
+        u16 tmp;
+        unsigned bufsize;
+        size_t size;
+        void *buf;
+        u16 pipenum = ep->pipenum;
+        struct r8a66597 *r8a66597 = ep->r8a66597;
+
+        pipe_change(r8a66597, pipenum);
+        r8a66597_bset(r8a66597, ISEL, ep->fifosel);
+
+        i = 0;
+        do {
+                tmp = r8a66597_read(r8a66597, ep->fifoctr);
+                if (i++ > 100000) {
+                        printk(KERN_ERR "pipe0 is busy. maybe cpu i/o bus"
+                                "conflict. please power off this controller.");
+                        return;
+                }
+                ndelay(1);
+        } while ((tmp & FRDY) == 0);
+
+        /* prepare parameters */
+        bufsize = get_buffer_size(r8a66597, pipenum);
+        buf = req->req.buf + req->req.actual;
+        size = min(bufsize, req->req.length - req->req.actual);
+
+        /* write fifo */
+        if (req->req.buf) {
+                if (size > 0)
+                        r8a66597_write_fifo(r8a66597, ep->fifoaddr, buf, size);
+                if ((size == 0) || ((size % ep->ep.maxpacket) != 0))
+                        r8a66597_bset(r8a66597, BVAL, ep->fifoctr);
+        }
+
+        /* update parameters */
+        req->req.actual += size;
+
+        /* check transfer finish */
+        if ((!req->req.zero && (req->req.actual == req->req.length))
+                        || (size % ep->ep.maxpacket)
+                        || (size == 0)) {
+                disable_irq_ready(r8a66597, pipenum);
+                disable_irq_empty(r8a66597, pipenum);
+        } else {
+                disable_irq_ready(r8a66597, pipenum);
+                enable_irq_empty(r8a66597, pipenum);
+        }
+        pipe_start(r8a66597, pipenum);
+}
+
+static void irq_packet_write(struct r8a66597_ep *ep,
+                                struct r8a66597_request *req)
+{
+        u16 tmp;
+        unsigned bufsize;
+        size_t size;
+        void *buf;
+        u16 pipenum = ep->pipenum;
+        struct r8a66597 *r8a66597 = ep->r8a66597;
+
+        pipe_change(r8a66597, pipenum);
+        tmp = r8a66597_read(r8a66597, ep->fifoctr);
+        if (unlikely((tmp & FRDY) == 0)) {
+                pipe_stop(r8a66597, pipenum);
+                pipe_irq_disable(r8a66597, pipenum);
+                printk(KERN_ERR "write fifo not ready. pipnum=%d\n", pipenum);
+                return;
+        }
+
+        /* prepare parameters */
+        bufsize = get_buffer_size(r8a66597, pipenum);
+        buf = req->req.buf + req->req.actual;
+        size = min(bufsize, req->req.length - req->req.actual);
+
+        /* write fifo */
+        if (req->req.buf) {
+                r8a66597_write_fifo(r8a66597, ep->fifoaddr, buf, size);
+                if ((size == 0)
+                                || ((size % ep->ep.maxpacket) != 0)
+                                || ((bufsize != ep->ep.maxpacket)
+                                        && (bufsize > size)))
+                        r8a66597_bset(r8a66597, BVAL, ep->fifoctr);
+        }
+
+        /* update parameters */
+        req->req.actual += size;
+        /* check transfer finish */
+        if ((!req->req.zero && (req->req.actual == req->req.length))
+                        || (size % ep->ep.maxpacket)
+                        || (size == 0)) {
+                disable_irq_ready(r8a66597, pipenum);
+                enable_irq_empty(r8a66597, pipenum);
+        } else {
+                disable_irq_empty(r8a66597, pipenum);
+                pipe_irq_enable(r8a66597, pipenum);
+        }
+}
+
+static void irq_packet_read(struct r8a66597_ep *ep,
+                                struct r8a66597_request *req)
+{
+        u16 tmp;
+        int rcv_len, bufsize, req_len;
+        int size;
+        void *buf;
+        u16 pipenum = ep->pipenum;
+        struct r8a66597 *r8a66597 = ep->r8a66597;
+        int finish = 0;
+
+        pipe_change(r8a66597, pipenum);
+        tmp = r8a66597_read(r8a66597, ep->fifoctr);
+        if (unlikely((tmp & FRDY) == 0)) {
+                req->req.status = -EPIPE;
+                pipe_stop(r8a66597, pipenum);
+                pipe_irq_disable(r8a66597, pipenum);
+                printk(KERN_ERR "read fifo not ready");
+                return;
+        }
+
+        /* prepare parameters */
+        rcv_len = tmp & DTLN;
+        bufsize = get_buffer_size(r8a66597, pipenum);
+
+        buf = req->req.buf + req->req.actual;
+        req_len = req->req.length - req->req.actual;
+        if (rcv_len < bufsize)
+                size = min(rcv_len, req_len);
+        else
+                size = min(bufsize, req_len);
+
+        /* update parameters */
+        req->req.actual += size;
+
+        /* check transfer finish */
+        if ((!req->req.zero && (req->req.actual == req->req.length))
+                        || (size % ep->ep.maxpacket)
+                        || (size == 0)) {
+                pipe_stop(r8a66597, pipenum);
+                pipe_irq_disable(r8a66597, pipenum);
+                finish = 1;
+        }
+
+        /* read fifo */
+        if (req->req.buf) {
+                if (size == 0)
+                        r8a66597_write(r8a66597, BCLR, ep->fifoctr);
+                else
+                        r8a66597_read_fifo(r8a66597, ep->fifoaddr, buf, size);
+
+        }
+
+        if ((ep->pipenum != 0) && finish)
+                transfer_complete(ep, req, 0);
+}
+
+static void irq_pipe_ready(struct r8a66597 *r8a66597, u16 status, u16 enb)
+{
+        u16 check;
+        u16 pipenum;
+        struct r8a66597_ep *ep;
+        struct r8a66597_request *req;
+
+        if ((status & BRDY0) && (enb & BRDY0)) {
+                r8a66597_write(r8a66597, ~BRDY0, BRDYSTS);
+                r8a66597_mdfy(r8a66597, 0, CURPIPE, CFIFOSEL);
+
+                ep = &r8a66597->ep[0];
+                req = get_request_from_ep(ep);
+                irq_packet_read(ep, req);
+        } else {
+                for (pipenum = 1; pipenum < R8A66597_MAX_NUM_PIPE; pipenum++) {
+                        check = 1 << pipenum;
+                        if ((status & check) && (enb & check)) {
+                                r8a66597_write(r8a66597, ~check, BRDYSTS);
+                                ep = r8a66597->pipenum2ep[pipenum];
+                                req = get_request_from_ep(ep);
+                                if (ep->desc->bEndpointAddress & USB_DIR_IN)
+                                        irq_packet_write(ep, req);
+                                else
+                                        irq_packet_read(ep, req);
+                        }
+                }
+        }
+}
+
+static void irq_pipe_empty(struct r8a66597 *r8a66597, u16 status, u16 enb)
+{
+        u16 tmp;
+        u16 check;
+        u16 pipenum;
+        struct r8a66597_ep *ep;
+        struct r8a66597_request *req;
+
+        if ((status & BEMP0) && (enb & BEMP0)) {
+                r8a66597_write(r8a66597, ~BEMP0, BEMPSTS);
+
+                ep = &r8a66597->ep[0];
+                req = get_request_from_ep(ep);
+                irq_ep0_write(ep, req);
+        } else {
+                for (pipenum = 1; pipenum < R8A66597_MAX_NUM_PIPE; pipenum++) {
+                        check = 1 << pipenum;
+                        if ((status & check) && (enb & check)) {
+                                r8a66597_write(r8a66597, ~check, BEMPSTS);
+                                tmp = control_reg_get(r8a66597, pipenum);
+                                if ((tmp & INBUFM) == 0) {
+                                        disable_irq_empty(r8a66597, pipenum);
+                                        pipe_irq_disable(r8a66597, pipenum);
+                                        pipe_stop(r8a66597, pipenum);
+                                        ep = r8a66597->pipenum2ep[pipenum];
+                                        req = get_request_from_ep(ep);
+                                        if (!list_empty(&ep->queue))
+                                                transfer_complete(ep, req, 0);
+                                }
+                        }
+                }
+        }
+}
+
+static void get_status(struct r8a66597 *r8a66597, struct usb_ctrlrequest *ctrl)
+__releases(r8a66597->lock)
+__acquires(r8a66597->lock)
+{
+        struct r8a66597_ep *ep;
+        u16 pid;
+        u16 status = 0;
+        u16 w_index = le16_to_cpu(ctrl->wIndex);
+
+        switch (ctrl->bRequestType & USB_RECIP_MASK) {
+        case USB_RECIP_DEVICE:
+                status = 1 << USB_DEVICE_SELF_POWERED;
+                break;
+        case USB_RECIP_INTERFACE:
+                status = 0;
+                break;
+        case USB_RECIP_ENDPOINT:
+                ep = r8a66597->epaddr2ep[w_index & USB_ENDPOINT_NUMBER_MASK];
+                pid = control_reg_get_pid(r8a66597, ep->pipenum);
+                if (pid == PID_STALL)
+                        status = 1 << USB_ENDPOINT_HALT;
+                else
+                        status = 0;
+                break;
+        default:
+                pipe_stall(r8a66597, 0);
+                return;         /* exit */
+        }
+
+        r8a66597->ep0_data = cpu_to_le16(status);
+        r8a66597->ep0_req->buf = &r8a66597->ep0_data;
+        r8a66597->ep0_req->length = 2;
+        /* AV: what happens if we get called again before that gets through? */
+        spin_unlock(&r8a66597->lock);
+        r8a66597_queue(r8a66597->gadget.ep0, r8a66597->ep0_req, GFP_KERNEL);
+        spin_lock(&r8a66597->lock);
+}
+
+static void clear_feature(struct r8a66597 *r8a66597,
+                                struct usb_ctrlrequest *ctrl)
+{
+        switch (ctrl->bRequestType & USB_RECIP_MASK) {
+        case USB_RECIP_DEVICE:
+                control_end(r8a66597, 1);
+                break;
+        case USB_RECIP_INTERFACE:
+                control_end(r8a66597, 1);
+                break;
+        case USB_RECIP_ENDPOINT: {
+                struct r8a66597_ep *ep;
+                struct r8a66597_request *req;
+                u16 w_index = le16_to_cpu(ctrl->wIndex);
+
+                ep = r8a66597->epaddr2ep[w_index & USB_ENDPOINT_NUMBER_MASK];
+                if (!ep->wedge) {
+                        pipe_stop(r8a66597, ep->pipenum);
+                        control_reg_sqclr(r8a66597, ep->pipenum);
+                        spin_unlock(&r8a66597->lock);
+                        usb_ep_clear_halt(&ep->ep);
+                        spin_lock(&r8a66597->lock);
+                }
+
+                control_end(r8a66597, 1);
+
+                req = get_request_from_ep(ep);
+                if (ep->busy) {
+                        ep->busy = 0;
+                        if (list_empty(&ep->queue))
+                                break;
+                        start_packet(ep, req);
+                } else if (!list_empty(&ep->queue))
+                        pipe_start(r8a66597, ep->pipenum);
+                }
+                break;
+        default:
+                pipe_stall(r8a66597, 0);
+                break;
+        }
+}
+
+static void set_feature(struct r8a66597 *r8a66597, struct usb_ctrlrequest *ctrl)
+{
+
+        switch (ctrl->bRequestType & USB_RECIP_MASK) {
+        case USB_RECIP_DEVICE:
+                control_end(r8a66597, 1);
+                break;
+        case USB_RECIP_INTERFACE:
+                control_end(r8a66597, 1);
+                break;
+        case USB_RECIP_ENDPOINT: {
+                struct r8a66597_ep *ep;
+                u16 w_index = le16_to_cpu(ctrl->wIndex);
+
+                ep = r8a66597->epaddr2ep[w_index & USB_ENDPOINT_NUMBER_MASK];
+                pipe_stall(r8a66597, ep->pipenum);
+
+                control_end(r8a66597, 1);
+                }
+                break;
+        default:
+                pipe_stall(r8a66597, 0);
+                break;
+        }
+}
+
+/* if return value is true, call class driver's setup() */
+static int setup_packet(struct r8a66597 *r8a66597, struct usb_ctrlrequest *ctrl)
+{
+        u16 *p = (u16 *)ctrl;
+        unsigned long offset = USBREQ;
+        int i, ret = 0;
+
+        /* read fifo */
+        r8a66597_write(r8a66597, ~VALID, INTSTS0);
+
+        for (i = 0; i < 4; i++)
+                p[i] = r8a66597_read(r8a66597, offset + i*2);
+
+        /* check request */
+        if ((ctrl->bRequestType & USB_TYPE_MASK) == USB_TYPE_STANDARD) {
+                switch (ctrl->bRequest) {
+                case USB_REQ_GET_STATUS:
+                        get_status(r8a66597, ctrl);
+                        break;
+                case USB_REQ_CLEAR_FEATURE:
+                        clear_feature(r8a66597, ctrl);
+                        break;
+                case USB_REQ_SET_FEATURE:
+                        set_feature(r8a66597, ctrl);
+                        break;
+                default:
+                        ret = 1;
+                        break;
+                }
+        } else
+                ret = 1;
+        return ret;
+}
+
+static void r8a66597_update_usb_speed(struct r8a66597 *r8a66597)
+{
+        u16 speed = get_usb_speed(r8a66597);
+
+        switch (speed) {
+        case HSMODE:
+                r8a66597->gadget.speed = USB_SPEED_HIGH;
+                break;
+        case FSMODE:
+                r8a66597->gadget.speed = USB_SPEED_FULL;
+                break;
+        default:
+                r8a66597->gadget.speed = USB_SPEED_UNKNOWN;
+                printk(KERN_ERR "USB speed unknown\n");
+        }
+}
+
+static void irq_device_state(struct r8a66597 *r8a66597)
+{
+        u16 dvsq;
+
+        dvsq = r8a66597_read(r8a66597, INTSTS0) & DVSQ;
+        r8a66597_write(r8a66597, ~DVST, INTSTS0);
+
+        if (dvsq == DS_DFLT) {
+                /* bus reset */
+                r8a66597->driver->disconnect(&r8a66597->gadget);
+                r8a66597_update_usb_speed(r8a66597);
+        }
+        if (r8a66597->old_dvsq == DS_CNFG && dvsq != DS_CNFG)
+                r8a66597_update_usb_speed(r8a66597);
+        if ((dvsq == DS_CNFG || dvsq == DS_ADDS)
+                        && r8a66597->gadget.speed == USB_SPEED_UNKNOWN)
+                r8a66597_update_usb_speed(r8a66597);
+
+        r8a66597->old_dvsq = dvsq;
+}
+
+static void irq_control_stage(struct r8a66597 *r8a66597)
+__releases(r8a66597->lock)
+__acquires(r8a66597->lock)
+{
+        struct usb_ctrlrequest ctrl;
+        u16 ctsq;
+
+        ctsq = r8a66597_read(r8a66597, INTSTS0) & CTSQ;
+        r8a66597_write(r8a66597, ~CTRT, INTSTS0);
+
+        switch (ctsq) {
+        case CS_IDST: {
+                struct r8a66597_ep *ep;
+                struct r8a66597_request *req;
+                ep = &r8a66597->ep[0];
+                req = get_request_from_ep(ep);
+                transfer_complete(ep, req, 0);
+                }
+                break;
+
+        case CS_RDDS:
+        case CS_WRDS:
+        case CS_WRND:
+                if (setup_packet(r8a66597, &ctrl)) {
+                        spin_unlock(&r8a66597->lock);
+                        if (r8a66597->driver->setup(&r8a66597->gadget, &ctrl)
+                                < 0)
+                                pipe_stall(r8a66597, 0);
+                        spin_lock(&r8a66597->lock);
+                }
+                break;
+        case CS_RDSS:
+        case CS_WRSS:
+                control_end(r8a66597, 0);
+                break;
+        default:
+                printk(KERN_ERR "ctrl_stage: unexpect ctsq(%x)\n", ctsq);
+                break;
+        }
+}
+
+static irqreturn_t r8a66597_irq(int irq, void *_r8a66597)
+{
+        struct r8a66597 *r8a66597 = _r8a66597;
+        u16 intsts0;
+        u16 intenb0;
+        u16 brdysts, nrdysts, bempsts;
+        u16 brdyenb, nrdyenb, bempenb;
+        u16 savepipe;
+        u16 mask0;
+
+        spin_lock(&r8a66597->lock);
+
+        intsts0 = r8a66597_read(r8a66597, INTSTS0);
+        intenb0 = r8a66597_read(r8a66597, INTENB0);
+
+        savepipe = r8a66597_read(r8a66597, CFIFOSEL);
+
+        mask0 = intsts0 & intenb0;
+        if (mask0) {
+                brdysts = r8a66597_read(r8a66597, BRDYSTS);
+                nrdysts = r8a66597_read(r8a66597, NRDYSTS);
+                bempsts = r8a66597_read(r8a66597, BEMPSTS);
+                brdyenb = r8a66597_read(r8a66597, BRDYENB);
+                nrdyenb = r8a66597_read(r8a66597, NRDYENB);
+                bempenb = r8a66597_read(r8a66597, BEMPENB);
+
+                if (mask0 & VBINT) {
+                        r8a66597_write(r8a66597,  0xffff & ~VBINT,
+                                        INTSTS0);
+                        r8a66597_start_xclock(r8a66597);
+
+                        /* start vbus sampling */
+                        r8a66597->old_vbus = r8a66597_read(r8a66597, INTSTS0)
+                                        & VBSTS;
+                        r8a66597->scount = R8A66597_MAX_SAMPLING;
+
+                        mod_timer(&r8a66597->timer,
+                                        jiffies + msecs_to_jiffies(50));
+                }
+                if (intsts0 & DVSQ)
+                        irq_device_state(r8a66597);
+
+                if ((intsts0 & BRDY) && (intenb0 & BRDYE)
+                                && (brdysts & brdyenb))
+                        irq_pipe_ready(r8a66597, brdysts, brdyenb);
+                if ((intsts0 & BEMP) && (intenb0 & BEMPE)
+                                && (bempsts & bempenb))
+                        irq_pipe_empty(r8a66597, bempsts, bempenb);
+
+                if (intsts0 & CTRT)
+                        irq_control_stage(r8a66597);
+        }
+
+        r8a66597_write(r8a66597, savepipe, CFIFOSEL);
+
+        spin_unlock(&r8a66597->lock);
+        return IRQ_HANDLED;
+}
+
+static void r8a66597_timer(unsigned long _r8a66597)
+{
+        struct r8a66597 *r8a66597 = (struct r8a66597 *)_r8a66597;
+        unsigned long flags;
+        u16 tmp;
+
+        spin_lock_irqsave(&r8a66597->lock, flags);
+        tmp = r8a66597_read(r8a66597, SYSCFG0);
+        if (r8a66597->scount > 0) {
+                tmp = r8a66597_read(r8a66597, INTSTS0) & VBSTS;
+                if (tmp == r8a66597->old_vbus) {
+                        r8a66597->scount--;
+                        if (r8a66597->scount == 0) {
+                                if (tmp == VBSTS)
+                                        r8a66597_usb_connect(r8a66597);
+                                else
+                                        r8a66597_usb_disconnect(r8a66597);
+                        } else {
+                                mod_timer(&r8a66597->timer,
+                                        jiffies + msecs_to_jiffies(50));
+                        }
+                } else {
+                        r8a66597->scount = R8A66597_MAX_SAMPLING;
+                        r8a66597->old_vbus = tmp;
+                        mod_timer(&r8a66597->timer,
+                                        jiffies + msecs_to_jiffies(50));
+                }
+        }
+        spin_unlock_irqrestore(&r8a66597->lock, flags);
+}
+
+/*-------------------------------------------------------------------------*/
+static int r8a66597_enable(struct usb_ep *_ep,
+                         const struct usb_endpoint_descriptor *desc)
+{
+        struct r8a66597_ep *ep;
+
+        ep = container_of(_ep, struct r8a66597_ep, ep);
+        return alloc_pipe_config(ep, desc);
+}
+
+static int r8a66597_disable(struct usb_ep *_ep)
+{
+        struct r8a66597_ep *ep;
+        struct r8a66597_request *req;
+        unsigned long flags;
+
+        ep = container_of(_ep, struct r8a66597_ep, ep);
+        BUG_ON(!ep);
+
+        while (!list_empty(&ep->queue)) {
+                req = get_request_from_ep(ep);
+                spin_lock_irqsave(&ep->r8a66597->lock, flags);
+                transfer_complete(ep, req, -ECONNRESET);
+                spin_unlock_irqrestore(&ep->r8a66597->lock, flags);
+        }
+
+        pipe_irq_disable(ep->r8a66597, ep->pipenum);
+        return free_pipe_config(ep);
+}
+
+static struct usb_request *r8a66597_alloc_request(struct usb_ep *_ep,
+                                                gfp_t gfp_flags)
+{
+        struct r8a66597_request *req;
+
+        req = kzalloc(sizeof(struct r8a66597_request), gfp_flags);
+        if (!req)
+                return NULL;
+
+        INIT_LIST_HEAD(&req->queue);
+
+        return &req->req;
+}
+
+static void r8a66597_free_request(struct usb_ep *_ep, struct usb_request *_req)
+{
+        struct r8a66597_request *req;
+
+        req = container_of(_req, struct r8a66597_request, req);
+        kfree(req);
+}
+
+static int r8a66597_queue(struct usb_ep *_ep, struct usb_request *_req,
+                        gfp_t gfp_flags)
+{
+        struct r8a66597_ep *ep;
+        struct r8a66597_request *req;
+        unsigned long flags;
+        int request = 0;
+
+        ep = container_of(_ep, struct r8a66597_ep, ep);
+        req = container_of(_req, struct r8a66597_request, req);
+
+        if (ep->r8a66597->gadget.speed == USB_SPEED_UNKNOWN)
+                return -ESHUTDOWN;
+
+        spin_lock_irqsave(&ep->r8a66597->lock, flags);
+
+        if (list_empty(&ep->queue))
+                request = 1;
+
+        list_add_tail(&req->queue, &ep->queue);
+        req->req.actual = 0;
+        req->req.status = -EINPROGRESS;
+
+        if (ep->desc == NULL)   /* control */
+                start_ep0(ep, req);
+        else {
+                if (request && !ep->busy)
+                        start_packet(ep, req);
+        }
+
+        spin_unlock_irqrestore(&ep->r8a66597->lock, flags);
+
+        return 0;
+}
+
+static int r8a66597_dequeue(struct usb_ep *_ep, struct usb_request *_req)
+{
+        struct r8a66597_ep *ep;
+        struct r8a66597_request *req;
+        unsigned long flags;
+
+        ep = container_of(_ep, struct r8a66597_ep, ep);
+        req = container_of(_req, struct r8a66597_request, req);
+
+        spin_lock_irqsave(&ep->r8a66597->lock, flags);
+        if (!list_empty(&ep->queue))
+                transfer_complete(ep, req, -ECONNRESET);
+        spin_unlock_irqrestore(&ep->r8a66597->lock, flags);
+
+        return 0;
+}
+
+static int r8a66597_set_halt(struct usb_ep *_ep, int value)
+{
+        struct r8a66597_ep *ep;
+        struct r8a66597_request *req;
+        unsigned long flags;
+        int ret = 0;
+
+        ep = container_of(_ep, struct r8a66597_ep, ep);
+        req = get_request_from_ep(ep);
+
+        spin_lock_irqsave(&ep->r8a66597->lock, flags);
+        if (!list_empty(&ep->queue)) {
+                ret = -EAGAIN;
+                goto out;
+        }
+        if (value) {
+                ep->busy = 1;
+                pipe_stall(ep->r8a66597, ep->pipenum);
+        } else {
+                ep->busy = 0;
+                ep->wedge = 0;
+                pipe_stop(ep->r8a66597, ep->pipenum);
+        }
+
+out:
+        spin_unlock_irqrestore(&ep->r8a66597->lock, flags);
+        return ret;
+}
+
+static int r8a66597_set_wedge(struct usb_ep *_ep)
+{
+        struct r8a66597_ep *ep;
+        unsigned long flags;
+
+        ep = container_of(_ep, struct r8a66597_ep, ep);
+
+        if (!ep || !ep->desc)
+                return -EINVAL;
+
+        spin_lock_irqsave(&ep->r8a66597->lock, flags);
+        ep->wedge = 1;
+        spin_unlock_irqrestore(&ep->r8a66597->lock, flags);
+
+        return usb_ep_set_halt(_ep);
+}
+
+static void r8a66597_fifo_flush(struct usb_ep *_ep)
+{
+        struct r8a66597_ep *ep;
+        unsigned long flags;
+
+        ep = container_of(_ep, struct r8a66597_ep, ep);
+        spin_lock_irqsave(&ep->r8a66597->lock, flags);
+        if (list_empty(&ep->queue) && !ep->busy) {
+                pipe_stop(ep->r8a66597, ep->pipenum);
+                r8a66597_bclr(ep->r8a66597, BCLR, ep->fifoctr);
+        }
+        spin_unlock_irqrestore(&ep->r8a66597->lock, flags);
+}
+
+static struct usb_ep_ops r8a66597_ep_ops = {
+        .enable         = r8a66597_enable,
+        .disable        = r8a66597_disable,
+
+        .alloc_request  = r8a66597_alloc_request,
+        .free_request   = r8a66597_free_request,
+
+        .queue          = r8a66597_queue,
+        .dequeue        = r8a66597_dequeue,
+
+        .set_halt       = r8a66597_set_halt,
+        .set_wedge      = r8a66597_set_wedge,
+        .fifo_flush     = r8a66597_fifo_flush,
+};
+
+/*-------------------------------------------------------------------------*/
+static struct r8a66597 *the_controller;
+
+int usb_gadget_register_driver(struct usb_gadget_driver *driver)
+{
+        struct r8a66597 *r8a66597 = the_controller;
+        int retval;
+
+        if (!driver
+                        || driver->speed != USB_SPEED_HIGH
+                        || !driver->bind
+                        || !driver->setup)
+                return -EINVAL;
+        if (!r8a66597)
+                return -ENODEV;
+        if (r8a66597->driver)
+                return -EBUSY;
+
+        /* hook up the driver */
+        driver->driver.bus = NULL;
+        r8a66597->driver = driver;
+        r8a66597->gadget.dev.driver = &driver->driver;
+
+        retval = device_add(&r8a66597->gadget.dev);
+        if (retval) {
+                printk(KERN_ERR "device_add error (%d)\n", retval);
+                goto error;
+        }
+
+        retval = driver->bind(&r8a66597->gadget);
+        if (retval) {
+                printk(KERN_ERR "bind to driver error (%d)\n", retval);
+                device_del(&r8a66597->gadget.dev);
+                goto error;
+        }
+
+        r8a66597_bset(r8a66597, VBSE, INTENB0);
+        if (r8a66597_read(r8a66597, INTSTS0) & VBSTS) {
+                r8a66597_start_xclock(r8a66597);
+                /* start vbus sampling */
+                r8a66597->old_vbus = r8a66597_read(r8a66597,
+                                         INTSTS0) & VBSTS;
+                r8a66597->scount = R8A66597_MAX_SAMPLING;
+                mod_timer(&r8a66597->timer, jiffies + msecs_to_jiffies(50));
+        }
+
+        return 0;
+
+error:
+        r8a66597->driver = NULL;
+        r8a66597->gadget.dev.driver = NULL;
+
+        return retval;
+}
+EXPORT_SYMBOL(usb_gadget_register_driver);
+
+int usb_gadget_unregister_driver(struct usb_gadget_driver *driver)
+{
+        struct r8a66597 *r8a66597 = the_controller;
+        unsigned long flags;
+
+        if (driver != r8a66597->driver || !driver->unbind)
+                return -EINVAL;
+
+        spin_lock_irqsave(&r8a66597->lock, flags);
+        if (r8a66597->gadget.speed != USB_SPEED_UNKNOWN)
+                r8a66597_usb_disconnect(r8a66597);
+        spin_unlock_irqrestore(&r8a66597->lock, flags);
+
+        r8a66597_bclr(r8a66597, VBSE, INTENB0);
+
+        driver->unbind(&r8a66597->gadget);
+
+        init_controller(r8a66597);
+        disable_controller(r8a66597);
+
+        device_del(&r8a66597->gadget.dev);
+        r8a66597->driver = NULL;
+        return 0;
+}
+EXPORT_SYMBOL(usb_gadget_unregister_driver);
+
+/*-------------------------------------------------------------------------*/
+static int r8a66597_get_frame(struct usb_gadget *_gadget)
+{
+        struct r8a66597 *r8a66597 = gadget_to_r8a66597(_gadget);
+        return r8a66597_read(r8a66597, FRMNUM) & 0x03FF;
+}
+
+static struct usb_gadget_ops r8a66597_gadget_ops = {
+        .get_frame              = r8a66597_get_frame,
+};
+
+static int __exit r8a66597_remove(struct platform_device *pdev)
+{
+        struct r8a66597         *r8a66597 = dev_get_drvdata(&pdev->dev);
+
+        del_timer_sync(&r8a66597->timer);
+        iounmap((void *)r8a66597->reg);
+        free_irq(platform_get_irq(pdev, 0), r8a66597);
+        r8a66597_free_request(&r8a66597->ep[0].ep, r8a66597->ep0_req);
+#ifdef CONFIG_HAVE_CLK
+        if (r8a66597->pdata->on_chip) {
+                clk_disable(r8a66597->clk);
+                clk_put(r8a66597->clk);
+        }
+#endif
+        kfree(r8a66597);
+        return 0;
+}
+
+static void nop_completion(struct usb_ep *ep, struct usb_request *r)
+{
+}
+
+static int __init r8a66597_probe(struct platform_device *pdev)
+{
+#ifdef CONFIG_HAVE_CLK
+        char clk_name[8];
+#endif
+        struct resource *res, *ires;
+        int irq;
+        void __iomem *reg = NULL;
+        struct r8a66597 *r8a66597 = NULL;
+        int ret = 0;
+        int i;
+        unsigned long irq_trigger;
+
+        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        if (!res) {
+                ret = -ENODEV;
+                printk(KERN_ERR "platform_get_resource error.\n");
+                goto clean_up;
+        }
+
+        ires = platform_get_resource(pdev, IORESOURCE_IRQ, 0);
+        irq = ires->start;
+        irq_trigger = ires->flags & IRQF_TRIGGER_MASK;
+
+        if (irq < 0) {
+                ret = -ENODEV;
+                printk(KERN_ERR "platform_get_irq error.\n");
+                goto clean_up;
+        }
+
+        reg = ioremap(res->start, resource_size(res));
+        if (reg == NULL) {
+                ret = -ENOMEM;
+                printk(KERN_ERR "ioremap error.\n");
+                goto clean_up;
+        }
+
+        /* initialize ucd */
+        r8a66597 = kzalloc(sizeof(struct r8a66597), GFP_KERNEL);
+        if (r8a66597 == NULL) {
+                printk(KERN_ERR "kzalloc error\n");
+                goto clean_up;
+        }
+
+        spin_lock_init(&r8a66597->lock);
+        dev_set_drvdata(&pdev->dev, r8a66597);
+        r8a66597->pdata = pdev->dev.platform_data;
+        r8a66597->irq_sense_low = irq_trigger == IRQF_TRIGGER_LOW;
+
+        r8a66597->gadget.ops = &r8a66597_gadget_ops;
+        device_initialize(&r8a66597->gadget.dev);
+        dev_set_name(&r8a66597->gadget.dev, "gadget");
+        r8a66597->gadget.is_dualspeed = 1;
+        r8a66597->gadget.dev.parent = &pdev->dev;
+        r8a66597->gadget.dev.dma_mask = pdev->dev.dma_mask;
+        r8a66597->gadget.dev.release = pdev->dev.release;
+        r8a66597->gadget.name = udc_name;
+
+        init_timer(&r8a66597->timer);
+        r8a66597->timer.function = r8a66597_timer;
+        r8a66597->timer.data = (unsigned long)r8a66597;
+        r8a66597->reg = (unsigned long)reg;
+
+#ifdef CONFIG_HAVE_CLK
+        if (r8a66597->pdata->on_chip) {
+                snprintf(clk_name, sizeof(clk_name), "usb%d", pdev->id);
+                r8a66597->clk = clk_get(&pdev->dev, clk_name);
+                if (IS_ERR(r8a66597->clk)) {
+                        dev_err(&pdev->dev, "cannot get clock \"%s\"\n",
+                                clk_name);
+                        ret = PTR_ERR(r8a66597->clk);
+                        goto clean_up;
+                }
+                clk_enable(r8a66597->clk);
+        }
+#endif
+
+        disable_controller(r8a66597); /* make sure controller is disabled */
+
+        ret = request_irq(irq, r8a66597_irq, IRQF_DISABLED | IRQF_SHARED,
+                        udc_name, r8a66597);
+        if (ret < 0) {
+                printk(KERN_ERR "request_irq error (%d)\n", ret);
+                goto clean_up2;
+        }
+
+        INIT_LIST_HEAD(&r8a66597->gadget.ep_list);
+        r8a66597->gadget.ep0 = &r8a66597->ep[0].ep;
+        INIT_LIST_HEAD(&r8a66597->gadget.ep0->ep_list);
+        for (i = 0; i < R8A66597_MAX_NUM_PIPE; i++) {
+                struct r8a66597_ep *ep = &r8a66597->ep[i];
+
+                if (i != 0) {
+                        INIT_LIST_HEAD(&r8a66597->ep[i].ep.ep_list);
+                        list_add_tail(&r8a66597->ep[i].ep.ep_list,
+                                        &r8a66597->gadget.ep_list);
+                }
+                ep->r8a66597 = r8a66597;
+                INIT_LIST_HEAD(&ep->queue);
+                ep->ep.name = r8a66597_ep_name[i];
+                ep->ep.ops = &r8a66597_ep_ops;
+                ep->ep.maxpacket = 512;
+        }
+        r8a66597->ep[0].ep.maxpacket = 64;
+        r8a66597->ep[0].pipenum = 0;
+        r8a66597->ep[0].fifoaddr = CFIFO;
+        r8a66597->ep[0].fifosel = CFIFOSEL;
+        r8a66597->ep[0].fifoctr = CFIFOCTR;
+        r8a66597->ep[0].fifotrn = 0;
+        r8a66597->ep[0].pipectr = get_pipectr_addr(0);
+        r8a66597->pipenum2ep[0] = &r8a66597->ep[0];
+        r8a66597->epaddr2ep[0] = &r8a66597->ep[0];
+
+        the_controller = r8a66597;
+
+        r8a66597->ep0_req = r8a66597_alloc_request(&r8a66597->ep[0].ep,
+                                                        GFP_KERNEL);
+        if (r8a66597->ep0_req == NULL)
+                goto clean_up3;
+        r8a66597->ep0_req->complete = nop_completion;
+
+        init_controller(r8a66597);
+
+        dev_info(&pdev->dev, "version %s\n", DRIVER_VERSION);
+        return 0;
+
+clean_up3:
+        free_irq(irq, r8a66597);
+clean_up2:
+#ifdef CONFIG_HAVE_CLK
+        if (r8a66597->pdata->on_chip) {
+                clk_disable(r8a66597->clk);
+                clk_put(r8a66597->clk);
+        }
+#endif
+clean_up:
+        if (r8a66597) {
+                if (r8a66597->ep0_req)
+                        r8a66597_free_request(&r8a66597->ep[0].ep,
+                                                r8a66597->ep0_req);
+                kfree(r8a66597);
+        }
+        if (reg)
+                iounmap(reg);
+
+        return ret;
+}
+
+/*-------------------------------------------------------------------------*/
+static struct platform_driver r8a66597_driver = {
+        .remove =       __exit_p(r8a66597_remove),
+        .driver         = {
+                .name = (char *) udc_name,
+        },
+};
+
+static int __init r8a66597_udc_init(void)
+{
+        return platform_driver_probe(&r8a66597_driver, r8a66597_probe);
+}
+module_init(r8a66597_udc_init);
+
+static void __exit r8a66597_udc_cleanup(void)
+{
+        platform_driver_unregister(&r8a66597_driver);
+}
+module_exit(r8a66597_udc_cleanup);
+
+MODULE_DESCRIPTION("R8A66597 USB gadget driver");
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Yoshihiro Shimoda");
+
diff --git a/drivers/usb/gadget/r8a66597-udc.h b/drivers/usb/gadget/r8a66597-udc.h
new file mode 100644
index 000000000000..03087e7b9190
--- /dev/null
+++ b/drivers/usb/gadget/r8a66597-udc.h
@@ -0,0 +1,256 @@
+/*
+ * R8A66597 UDC
+ *
+ * Copyright (C) 2007-2009 Renesas Solutions Corp.
+ *
+ * Author : Yoshihiro Shimoda <shimoda.yoshihiro@renesas.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; version 2 of the License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ *
+ */
+
+#ifndef __R8A66597_H__
+#define __R8A66597_H__
+
+#ifdef CONFIG_HAVE_CLK
+#include <linux/clk.h>
+#endif
+
+#include <linux/usb/r8a66597.h>
+
+#define R8A66597_MAX_SAMPLING   10
+
+#define R8A66597_MAX_NUM_PIPE   8
+#define R8A66597_MAX_NUM_BULK   3
+#define R8A66597_MAX_NUM_ISOC   2
+#define R8A66597_MAX_NUM_INT    2
+
+#define R8A66597_BASE_PIPENUM_BULK      3
+#define R8A66597_BASE_PIPENUM_ISOC      1
+#define R8A66597_BASE_PIPENUM_INT       6
+
+#define R8A66597_BASE_BUFNUM    6
+#define R8A66597_MAX_BUFNUM     0x4F
+
+#define is_bulk_pipe(pipenum)   \
+        ((pipenum >= R8A66597_BASE_PIPENUM_BULK) && \
+         (pipenum < (R8A66597_BASE_PIPENUM_BULK + R8A66597_MAX_NUM_BULK)))
+#define is_interrupt_pipe(pipenum)      \
+        ((pipenum >= R8A66597_BASE_PIPENUM_INT) && \
+         (pipenum < (R8A66597_BASE_PIPENUM_INT + R8A66597_MAX_NUM_INT)))
+#define is_isoc_pipe(pipenum)   \
+        ((pipenum >= R8A66597_BASE_PIPENUM_ISOC) && \
+         (pipenum < (R8A66597_BASE_PIPENUM_ISOC + R8A66597_MAX_NUM_ISOC)))
+
+struct r8a66597_pipe_info {
+        u16     pipe;
+        u16     epnum;
+        u16     maxpacket;
+        u16     type;
+        u16     interval;
+        u16     dir_in;
+};
+
+struct r8a66597_request {
+        struct usb_request      req;
+        struct list_head        queue;
+};
+
+struct r8a66597_ep {
+        struct usb_ep           ep;
+        struct r8a66597         *r8a66597;
+
+        struct list_head        queue;
+        unsigned                busy:1;
+        unsigned                wedge:1;
+        unsigned                internal_ccpl:1;        /* use only control */
+
+        /* this member can able to after r8a66597_enable */
+        unsigned                use_dma:1;
+        u16                     pipenum;
+        u16                     type;
+        const struct usb_endpoint_descriptor    *desc;
+        /* register address */
+        unsigned char           fifoaddr;
+        unsigned char           fifosel;
+        unsigned char           fifoctr;
+        unsigned char           fifotrn;
+        unsigned char           pipectr;
+};
+
+struct r8a66597 {
+        spinlock_t              lock;
+        unsigned long           reg;
+
+#ifdef CONFIG_HAVE_CLK
+        struct clk *clk;
+#endif
+        struct r8a66597_platdata        *pdata;
+
+        struct usb_gadget               gadget;
+        struct usb_gadget_driver        *driver;
+
+        struct r8a66597_ep      ep[R8A66597_MAX_NUM_PIPE];
+        struct r8a66597_ep      *pipenum2ep[R8A66597_MAX_NUM_PIPE];
+        struct r8a66597_ep      *epaddr2ep[16];
+
+        struct timer_list       timer;
+        struct usb_request      *ep0_req;       /* for internal request */
+        u16                     ep0_data;       /* for internal request */
+        u16                     old_vbus;
+        u16                     scount;
+        u16                     old_dvsq;
+
+        /* pipe config */
+        unsigned char bulk;
+        unsigned char interrupt;
+        unsigned char isochronous;
+        unsigned char num_dma;
+
+        unsigned irq_sense_low:1;
+};
+
+#define gadget_to_r8a66597(_gadget)     \
+                container_of(_gadget, struct r8a66597, gadget)
+#define r8a66597_to_gadget(r8a66597) (&r8a66597->gadget)
+
+static inline u16 r8a66597_read(struct r8a66597 *r8a66597, unsigned long offset)
+{
+        return inw(r8a66597->reg + offset);
+}
+
+static inline void r8a66597_read_fifo(struct r8a66597 *r8a66597,
+                                      unsigned long offset, u16 *buf,
+                                      int len)
+{
+        if (r8a66597->pdata->on_chip) {
+                unsigned long fifoaddr = r8a66597->reg + offset;
+                unsigned long count;
+                union {
+                        unsigned long dword;
+                        unsigned char byte[4];
+                } data;
+                unsigned char *pb;
+                int i;
+
+                count = len / 4;
+                insl(fifoaddr, buf, count);
+
+                if (len & 0x00000003) {
+                        data.dword = inl(fifoaddr);
+                        pb = (unsigned char *)buf + count * 4;
+                        for (i = 0; i < (len & 0x00000003); i++)
+                                pb[i] = data.byte[i];
+                }
+        } else {
+                len = (len + 1) / 2;
+                insw(r8a66597->reg + offset, buf, len);
+        }
+}
+
+static inline void r8a66597_write(struct r8a66597 *r8a66597, u16 val,
+                                  unsigned long offset)
+{
+        outw(val, r8a66597->reg + offset);
+}
+
+static inline void r8a66597_write_fifo(struct r8a66597 *r8a66597,
+                                       unsigned long offset, u16 *buf,
+                                       int len)
+{
+        unsigned long fifoaddr = r8a66597->reg + offset;
+
+        if (r8a66597->pdata->on_chip) {
+                unsigned long count;
+                unsigned char *pb;
+                int i;
+
+                count = len / 4;
+                outsl(fifoaddr, buf, count);
+
+                if (len & 0x00000003) {
+                        pb = (unsigned char *)buf + count * 4;
+                        for (i = 0; i < (len & 0x00000003); i++) {
+                                if (r8a66597_read(r8a66597, CFIFOSEL) & BIGEND)
+                                        outb(pb[i], fifoaddr + i);
+                                else
+                                        outb(pb[i], fifoaddr + 3 - i);
+                        }
+                }
+        } else {
+                int odd = len & 0x0001;
+
+                len = len / 2;
+                outsw(fifoaddr, buf, len);
+                if (unlikely(odd)) {
+                        buf = &buf[len];
+                        outb((unsigned char)*buf, fifoaddr);
+                }
+        }
+}
+
+static inline void r8a66597_mdfy(struct r8a66597 *r8a66597,
+                                 u16 val, u16 pat, unsigned long offset)
+{
+        u16 tmp;
+        tmp = r8a66597_read(r8a66597, offset);
+        tmp = tmp & (~pat);
+        tmp = tmp | val;
+        r8a66597_write(r8a66597, tmp, offset);
+}
+
+static inline u16 get_xtal_from_pdata(struct r8a66597_platdata *pdata)
+{
+        u16 clock = 0;
+
+        switch (pdata->xtal) {
+        case R8A66597_PLATDATA_XTAL_12MHZ:
+                clock = XTAL12;
+                break;
+        case R8A66597_PLATDATA_XTAL_24MHZ:
+                clock = XTAL24;
+                break;
+        case R8A66597_PLATDATA_XTAL_48MHZ:
+                clock = XTAL48;
+                break;
+        default:
+                printk(KERN_ERR "r8a66597: platdata clock is wrong.\n");
+                break;
+        }
+
+        return clock;
+}
+
+#define r8a66597_bclr(r8a66597, val, offset)    \
+                        r8a66597_mdfy(r8a66597, 0, val, offset)
+#define r8a66597_bset(r8a66597, val, offset)    \
+                        r8a66597_mdfy(r8a66597, val, 0, offset)
+
+#define get_pipectr_addr(pipenum)       (PIPE1CTR + (pipenum - 1) * 2)
+
+#define enable_irq_ready(r8a66597, pipenum)     \
+        enable_pipe_irq(r8a66597, pipenum, BRDYENB)
+#define disable_irq_ready(r8a66597, pipenum)    \
+        disable_pipe_irq(r8a66597, pipenum, BRDYENB)
+#define enable_irq_empty(r8a66597, pipenum)     \
+        enable_pipe_irq(r8a66597, pipenum, BEMPENB)
+#define disable_irq_empty(r8a66597, pipenum)    \
+        disable_pipe_irq(r8a66597, pipenum, BEMPENB)
+#define enable_irq_nrdy(r8a66597, pipenum)      \
+        enable_pipe_irq(r8a66597, pipenum, NRDYENB)
+#define disable_irq_nrdy(r8a66597, pipenum)     \
+        disable_pipe_irq(r8a66597, pipenum, NRDYENB)
+
+#endif  /* __R8A66597_H__ */
+
diff --git a/drivers/usb/gadget/rndis.c b/drivers/usb/gadget/rndis.c
index ca41b0b5afb3..48267bc0b2e0 100644
--- a/drivers/usb/gadget/rndis.c
+++ b/drivers/usb/gadget/rndis.c
@@ -1022,22 +1022,29 @@ static rndis_resp_t *rndis_add_response (int configNr, u32 length)
         return r;
 }
 
-int rndis_rm_hdr(struct sk_buff *skb)
+int rndis_rm_hdr(struct gether *port,
+                        struct sk_buff *skb,
+                        struct sk_buff_head *list)
 {
         /* tmp points to a struct rndis_packet_msg_type */
         __le32          *tmp = (void *) skb->data;
 
         /* MessageType, MessageLength */
         if (cpu_to_le32(REMOTE_NDIS_PACKET_MSG)
-                        != get_unaligned(tmp++))
+                        != get_unaligned(tmp++)) {
+                dev_kfree_skb_any(skb);
                 return -EINVAL;
+        }
         tmp++;
 
         /* DataOffset, DataLength */
-        if (!skb_pull(skb, get_unaligned_le32(tmp++) + 8))
+        if (!skb_pull(skb, get_unaligned_le32(tmp++) + 8)) {
+                dev_kfree_skb_any(skb);
                 return -EOVERFLOW;
+        }
         skb_trim(skb, get_unaligned_le32(tmp++));
 
+        skb_queue_tail(list, skb);
         return 0;
 }
 
diff --git a/drivers/usb/gadget/rndis.h b/drivers/usb/gadget/rndis.h
index aac61dfe0f03..c236aaa9dcd1 100644
--- a/drivers/usb/gadget/rndis.h
+++ b/drivers/usb/gadget/rndis.h
@@ -251,7 +251,8 @@ int  rndis_set_param_vendor (u8 configNr, u32 vendorID,
                             const char *vendorDescr);
 int  rndis_set_param_medium (u8 configNr, u32 medium, u32 speed);
 void rndis_add_hdr (struct sk_buff *skb);
-int rndis_rm_hdr (struct sk_buff *skb);
+int rndis_rm_hdr(struct gether *port, struct sk_buff *skb,
+                        struct sk_buff_head *list);
 u8   *rndis_get_next_response (int configNr, u32 *length);
 void rndis_free_response (int configNr, u8 *buf);
 
diff --git a/drivers/usb/gadget/s3c-hsotg.c b/drivers/usb/gadget/s3c-hsotg.c
index 50c71aae2cc2..4b5dbd0127f5 100644
--- a/drivers/usb/gadget/s3c-hsotg.c
+++ b/drivers/usb/gadget/s3c-hsotg.c
@@ -2392,7 +2392,7 @@ static int s3c_hsotg_corereset(struct s3c_hsotg *hsotg)
                 grstctl = readl(hsotg->regs + S3C_GRSTCTL);
         } while (!(grstctl & S3C_GRSTCTL_CSftRst) && timeout-- > 0);
 
-        if (!grstctl & S3C_GRSTCTL_CSftRst) {
+        if (!(grstctl & S3C_GRSTCTL_CSftRst)) {
                 dev_err(hsotg->dev, "Failed to get CSftRst asserted\n");
                 return -EINVAL;
         }
@@ -2514,8 +2514,8 @@ int usb_gadget_register_driver(struct usb_gadget_driver *driver)
          * DMA mode we may need this. */
         writel(S3C_DOEPMSK_SetupMsk | S3C_DOEPMSK_AHBErrMsk |
                S3C_DOEPMSK_EPDisbldMsk |
-               using_dma(hsotg) ? (S3C_DIEPMSK_XferComplMsk |
-                                   S3C_DIEPMSK_TimeOUTMsk) : 0,
+               (using_dma(hsotg) ? (S3C_DIEPMSK_XferComplMsk |
+                                   S3C_DIEPMSK_TimeOUTMsk) : 0),
                hsotg->regs + S3C_DOEPMSK);
 
         writel(0, hsotg->regs + S3C_DAINTMSK);
diff --git a/drivers/usb/gadget/s3c2410_udc.c b/drivers/usb/gadget/s3c2410_udc.c
index a9b452fe6221..d5f4c1d45c97 100644
--- a/drivers/usb/gadget/s3c2410_udc.c
+++ b/drivers/usb/gadget/s3c2410_udc.c
@@ -1703,8 +1703,7 @@ int usb_gadget_unregister_driver(struct usb_gadget_driver *driver)
         dprintk(DEBUG_NORMAL,"usb_gadget_register_driver() '%s'\n",
                 driver->driver.name);
 
-        if (driver->disconnect)
-                driver->disconnect(&udc->gadget);
+        driver->unbind(&udc->gadget);
 
         device_del(&udc->gadget.dev);
         udc->driver = NULL;
diff --git a/drivers/usb/gadget/u_audio.c b/drivers/usb/gadget/u_audio.c
index 0f3d22fc030e..8252595d619d 100644
--- a/drivers/usb/gadget/u_audio.c
+++ b/drivers/usb/gadget/u_audio.c
@@ -10,7 +10,6 @@
  */
 
 #include <linux/kernel.h>
-#include <linux/utsname.h>
 #include <linux/device.h>
 #include <linux/delay.h>
 #include <linux/ctype.h>
@@ -253,11 +252,13 @@ static int gaudio_open_snd_dev(struct gaudio *card)
         snd->filp = filp_open(fn_cap, O_RDONLY, 0);
         if (IS_ERR(snd->filp)) {
                 ERROR(card, "No such PCM capture device: %s\n", fn_cap);
-                snd->filp = NULL;
+                snd->substream = NULL;
+                snd->card = NULL;
+        } else {
+                pcm_file = snd->filp->private_data;
+                snd->substream = pcm_file->substream;
+                snd->card = card;
         }
-        pcm_file = snd->filp->private_data;
-        snd->substream = pcm_file->substream;
-        snd->card = card;
 
         return 0;
 }
diff --git a/drivers/usb/gadget/u_ether.c b/drivers/usb/gadget/u_ether.c
index c66521953917..2fc02bd95848 100644
--- a/drivers/usb/gadget/u_ether.c
+++ b/drivers/usb/gadget/u_ether.c
@@ -23,7 +23,6 @@
 /* #define VERBOSE_DEBUG */
 
 #include <linux/kernel.h>
-#include <linux/utsname.h>
 #include <linux/device.h>
 #include <linux/ctype.h>
 #include <linux/etherdevice.h>
@@ -37,8 +36,9 @@
  * one (!) network link through the USB gadget stack, normally "usb0".
  *
  * The control and data models are handled by the function driver which
- * connects to this code; such as CDC Ethernet, "CDC Subset", or RNDIS.
- * That includes all descriptor and endpoint management.
+ * connects to this code; such as CDC Ethernet (ECM or EEM),
+ * "CDC Subset", or RNDIS.  That includes all descriptor and endpoint
+ * management.
  *
  * Link level addressing is handled by this component using module
  * parameters; if no such parameters are provided, random link level
@@ -68,9 +68,13 @@ struct eth_dev {
         struct list_head        tx_reqs, rx_reqs;
         atomic_t                tx_qlen;
 
+        struct sk_buff_head     rx_frames;
+
         unsigned                header_len;
-        struct sk_buff          *(*wrap)(struct sk_buff *skb);
-        int                     (*unwrap)(struct sk_buff *skb);
+        struct sk_buff          *(*wrap)(struct gether *, struct sk_buff *skb);
+        int                     (*unwrap)(struct gether *,
+                                                struct sk_buff *skb,
+                                                struct sk_buff_head *list);
 
         struct work_struct      work;
 
@@ -269,7 +273,7 @@ enomem:
 
 static void rx_complete(struct usb_ep *ep, struct usb_request *req)
 {
-        struct sk_buff  *skb = req->context;
+        struct sk_buff  *skb = req->context, *skb2;
         struct eth_dev  *dev = ep->driver_data;
         int             status = req->status;
 
@@ -278,26 +282,47 @@ static void rx_complete(struct usb_ep *ep, struct usb_request *req)
         /* normal completion */
         case 0:
                 skb_put(skb, req->actual);
-                if (dev->unwrap)
-                        status = dev->unwrap(skb);
-                if (status < 0
-                                || ETH_HLEN > skb->len
-                                || skb->len > ETH_FRAME_LEN) {
-                        dev->net->stats.rx_errors++;
-                        dev->net->stats.rx_length_errors++;
-                        DBG(dev, "rx length %d\n", skb->len);
-                        break;
-                }
 
-                skb->protocol = eth_type_trans(skb, dev->net);
-                dev->net->stats.rx_packets++;
-                dev->net->stats.rx_bytes += skb->len;
+                if (dev->unwrap) {
+                        unsigned long   flags;
 
-                /* no buffer copies needed, unless hardware can't
-                 * use skb buffers.
-                 */
-                status = netif_rx(skb);
+                        spin_lock_irqsave(&dev->lock, flags);
+                        if (dev->port_usb) {
+                                status = dev->unwrap(dev->port_usb,
+                                                        skb,
+                                                        &dev->rx_frames);
+                        } else {
+                                dev_kfree_skb_any(skb);
+                                status = -ENOTCONN;
+                        }
+                        spin_unlock_irqrestore(&dev->lock, flags);
+                } else {
+                        skb_queue_tail(&dev->rx_frames, skb);
+                }
                 skb = NULL;
+
+                skb2 = skb_dequeue(&dev->rx_frames);
+                while (skb2) {
+                        if (status < 0
+                                        || ETH_HLEN > skb2->len
+                                        || skb2->len > ETH_FRAME_LEN) {
+                                dev->net->stats.rx_errors++;
+                                dev->net->stats.rx_length_errors++;
+                                DBG(dev, "rx length %d\n", skb2->len);
+                                dev_kfree_skb_any(skb2);
+                                goto next_frame;
+                        }
+                        skb2->protocol = eth_type_trans(skb2, dev->net);
+                        dev->net->stats.rx_packets++;
+                        dev->net->stats.rx_bytes += skb2->len;
+
+                        /* no buffer copies needed, unless hardware can't
+                         * use skb buffers.
+                         */
+                        status = netif_rx(skb2);
+next_frame:
+                        skb2 = skb_dequeue(&dev->rx_frames);
+                }
                 break;
 
         /* software-driven interface shutdown */
@@ -537,14 +562,15 @@ static netdev_tx_t eth_start_xmit(struct sk_buff *skb,
          * or there's not enough space for extra headers we need
          */
         if (dev->wrap) {
-                struct sk_buff  *skb_new;
+                unsigned long   flags;
 
-                skb_new = dev->wrap(skb);
-                if (!skb_new)
+                spin_lock_irqsave(&dev->lock, flags);
+                if (dev->port_usb)
+                        skb = dev->wrap(dev->port_usb, skb);
+                spin_unlock_irqrestore(&dev->lock, flags);
+                if (!skb)
                         goto drop;
 
-                dev_kfree_skb_any(skb);
-                skb = skb_new;
                 length = skb->len;
         }
         req->buf = skb->data;
@@ -578,9 +604,9 @@ static netdev_tx_t eth_start_xmit(struct sk_buff *skb,
         }
 
         if (retval) {
+                dev_kfree_skb_any(skb);
 drop:
                 dev->net->stats.tx_dropped++;
-                dev_kfree_skb_any(skb);
                 spin_lock_irqsave(&dev->req_lock, flags);
                 if (list_empty(&dev->tx_reqs))
                         netif_start_queue(net);
@@ -753,6 +779,8 @@ int __init gether_setup(struct usb_gadget *g, u8 ethaddr[ETH_ALEN])
         INIT_LIST_HEAD(&dev->tx_reqs);
         INIT_LIST_HEAD(&dev->rx_reqs);
 
+        skb_queue_head_init(&dev->rx_frames);
+
         /* network device setup */
         dev->net = net;
         strcpy(net->name, "usb%d");
diff --git a/drivers/usb/gadget/u_ether.h b/drivers/usb/gadget/u_ether.h
index 0d1f7ae3b071..91b39ffdf6ea 100644
--- a/drivers/usb/gadget/u_ether.h
+++ b/drivers/usb/gadget/u_ether.h
@@ -60,12 +60,13 @@ struct gether {
 
         u16                             cdc_filter;
 
-        /* hooks for added framing, as needed for RNDIS and EEM.
-         * we currently don't support multiple frames per SKB.
-         */
+        /* hooks for added framing, as needed for RNDIS and EEM. */
         u32                             header_len;
-        struct sk_buff                  *(*wrap)(struct sk_buff *skb);
-        int                             (*unwrap)(struct sk_buff *skb);
+        struct sk_buff                  *(*wrap)(struct gether *port,
+                                                struct sk_buff *skb);
+        int                             (*unwrap)(struct gether *port,
+                                                struct sk_buff *skb,
+                                                struct sk_buff_head *list);
 
         /* called on network open/close */
         void                            (*open)(struct gether *);
@@ -109,6 +110,7 @@ static inline bool can_support_ecm(struct usb_gadget *gadget)
 /* each configuration may bind one instance of an ethernet link */
 int geth_bind_config(struct usb_configuration *c, u8 ethaddr[ETH_ALEN]);
 int ecm_bind_config(struct usb_configuration *c, u8 ethaddr[ETH_ALEN]);
+int eem_bind_config(struct usb_configuration *c);
 
 #ifdef CONFIG_USB_ETH_RNDIS
 
diff --git a/drivers/usb/gadget/u_serial.c b/drivers/usb/gadget/u_serial.c
index fc6e709f45b1..adf8260c3a6a 100644
--- a/drivers/usb/gadget/u_serial.c
+++ b/drivers/usb/gadget/u_serial.c
@@ -1114,7 +1114,6 @@ int __init gserial_setup(struct usb_gadget *g, unsigned count)
         /* export the driver ... */
         status = tty_register_driver(gs_tty_driver);
         if (status) {
-                put_tty_driver(gs_tty_driver);
                 pr_err("%s: cannot register, err %d\n",
                                 __func__, status);
                 goto fail;
diff --git a/drivers/usb/host/Kconfig b/drivers/usb/host/Kconfig
index 1a920c70b5a1..9b43b226817f 100644
--- a/drivers/usb/host/Kconfig
+++ b/drivers/usb/host/Kconfig
@@ -113,6 +113,12 @@ config USB_EHCI_HCD_PPC_OF
           Enables support for the USB controller present on the PowerPC
           OpenFirmware platform bus.
 
+config USB_W90X900_EHCI
+        bool "W90X900(W90P910) EHCI support"
+        depends on USB_EHCI_HCD && ARCH_W90X900
+        ---help---
+                Enables support for the W90X900 USB controller
+
 config USB_OXU210HP_HCD
         tristate "OXU210HP HCD support"
         depends on USB
@@ -153,6 +159,18 @@ config USB_ISP1760_HCD
           To compile this driver as a module, choose M here: the
           module will be called isp1760.
 
+config USB_ISP1362_HCD
+        tristate "ISP1362 HCD support"
+        depends on USB
+        default N
+        ---help---
+          Supports the Philips ISP1362 chip as a host controller
+
+          This driver does not support isochronous transfers.
+
+          To compile this driver as a module, choose M here: the
+          module will be called isp1362-hcd.
+
 config USB_OHCI_HCD
         tristate "OHCI HCD support"
         depends on USB && USB_ARCH_HAS_OHCI
@@ -336,13 +354,6 @@ config USB_R8A66597_HCD
           To compile this driver as a module, choose M here: the
           module will be called r8a66597-hcd.
 
-config SUPERH_ON_CHIP_R8A66597
-        boolean "Enable SuperH on-chip R8A66597 USB"
-        depends on USB_R8A66597_HCD && (CPU_SUBTYPE_SH7366 || CPU_SUBTYPE_SH7723 || CPU_SUBTYPE_SH7724)
-        help
-           This driver enables support for the on-chip R8A66597 in the
-           SH7366, SH7723 and SH7724 processors.
-
 config USB_WHCI_HCD
         tristate "Wireless USB Host Controller Interface (WHCI) driver (EXPERIMENTAL)"
         depends on EXPERIMENTAL
diff --git a/drivers/usb/host/Makefile b/drivers/usb/host/Makefile
index 289d748bb414..f58b2494c44a 100644
--- a/drivers/usb/host/Makefile
+++ b/drivers/usb/host/Makefile
@@ -21,6 +21,7 @@ obj-$(CONFIG_PCI)		+= pci-quirks.o
 obj-$(CONFIG_USB_EHCI_HCD)      += ehci-hcd.o
 obj-$(CONFIG_USB_OXU210HP_HCD)  += oxu210hp-hcd.o
 obj-$(CONFIG_USB_ISP116X_HCD)   += isp116x-hcd.o
+obj-$(CONFIG_USB_ISP1362_HCD)   += isp1362-hcd.o
 obj-$(CONFIG_USB_OHCI_HCD)      += ohci-hcd.o
 obj-$(CONFIG_USB_UHCI_HCD)      += uhci-hcd.o
 obj-$(CONFIG_USB_FHCI_HCD)      += fhci.o
diff --git a/drivers/usb/host/ehci-atmel.c b/drivers/usb/host/ehci-atmel.c
new file mode 100644
index 000000000000..87c1b7c34c0e
--- /dev/null
+++ b/drivers/usb/host/ehci-atmel.c
@@ -0,0 +1,230 @@
+/*
+ * Driver for EHCI UHP on Atmel chips
+ *
+ *  Copyright (C) 2009 Atmel Corporation,
+ *                     Nicolas Ferre <nicolas.ferre@atmel.com>
+ *
+ *  Based on various ehci-*.c drivers
+ *
+ * This file is subject to the terms and conditions of the GNU General Public
+ * License.  See the file COPYING in the main directory of this archive for
+ * more details.
+ */
+
+#include <linux/clk.h>
+#include <linux/platform_device.h>
+
+/* interface and function clocks */
+static struct clk *iclk, *fclk;
+static int clocked;
+
+/*-------------------------------------------------------------------------*/
+
+static void atmel_start_clock(void)
+{
+        clk_enable(iclk);
+        clk_enable(fclk);
+        clocked = 1;
+}
+
+static void atmel_stop_clock(void)
+{
+        clk_disable(fclk);
+        clk_disable(iclk);
+        clocked = 0;
+}
+
+static void atmel_start_ehci(struct platform_device *pdev)
+{
+        dev_dbg(&pdev->dev, "start\n");
+        atmel_start_clock();
+}
+
+static void atmel_stop_ehci(struct platform_device *pdev)
+{
+        dev_dbg(&pdev->dev, "stop\n");
+        atmel_stop_clock();
+}
+
+/*-------------------------------------------------------------------------*/
+
+static int ehci_atmel_setup(struct usb_hcd *hcd)
+{
+        struct ehci_hcd *ehci = hcd_to_ehci(hcd);
+        int retval = 0;
+
+        /* registers start at offset 0x0 */
+        ehci->caps = hcd->regs;
+        ehci->regs = hcd->regs +
+                HC_LENGTH(ehci_readl(ehci, &ehci->caps->hc_capbase));
+        dbg_hcs_params(ehci, "reset");
+        dbg_hcc_params(ehci, "reset");
+
+        /* cache this readonly data; minimize chip reads */
+        ehci->hcs_params = ehci_readl(ehci, &ehci->caps->hcs_params);
+
+        retval = ehci_halt(ehci);
+        if (retval)
+                return retval;
+
+        /* data structure init */
+        retval = ehci_init(hcd);
+        if (retval)
+                return retval;
+
+        ehci->sbrn = 0x20;
+
+        ehci_reset(ehci);
+        ehci_port_power(ehci, 0);
+
+        return retval;
+}
+
+static const struct hc_driver ehci_atmel_hc_driver = {
+        .description            = hcd_name,
+        .product_desc           = "Atmel EHCI UHP HS",
+        .hcd_priv_size          = sizeof(struct ehci_hcd),
+
+        /* generic hardware linkage */
+        .irq                    = ehci_irq,
+        .flags                  = HCD_MEMORY | HCD_USB2,
+
+        /* basic lifecycle operations */
+        .reset                  = ehci_atmel_setup,
+        .start                  = ehci_run,
+        .stop                   = ehci_stop,
+        .shutdown               = ehci_shutdown,
+
+        /* managing i/o requests and associated device resources */
+        .urb_enqueue            = ehci_urb_enqueue,
+        .urb_dequeue            = ehci_urb_dequeue,
+        .endpoint_disable       = ehci_endpoint_disable,
+
+        /* scheduling support */
+        .get_frame_number       = ehci_get_frame,
+
+        /* root hub support */
+        .hub_status_data        = ehci_hub_status_data,
+        .hub_control            = ehci_hub_control,
+        .bus_suspend            = ehci_bus_suspend,
+        .bus_resume             = ehci_bus_resume,
+        .relinquish_port        = ehci_relinquish_port,
+        .port_handed_over       = ehci_port_handed_over,
+};
+
+static int __init ehci_atmel_drv_probe(struct platform_device *pdev)
+{
+        struct usb_hcd *hcd;
+        const struct hc_driver *driver = &ehci_atmel_hc_driver;
+        struct resource *res;
+        int irq;
+        int retval;
+
+        if (usb_disabled())
+                return -ENODEV;
+
+        pr_debug("Initializing Atmel-SoC USB Host Controller\n");
+
+        irq = platform_get_irq(pdev, 0);
+        if (irq <= 0) {
+                dev_err(&pdev->dev,
+                        "Found HC with no IRQ. Check %s setup!\n",
+                        dev_name(&pdev->dev));
+                retval = -ENODEV;
+                goto fail_create_hcd;
+        }
+
+        hcd = usb_create_hcd(driver, &pdev->dev, dev_name(&pdev->dev));
+        if (!hcd) {
+                retval = -ENOMEM;
+                goto fail_create_hcd;
+        }
+
+        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        if (!res) {
+                dev_err(&pdev->dev,
+                        "Found HC with no register addr. Check %s setup!\n",
+                        dev_name(&pdev->dev));
+                retval = -ENODEV;
+                goto fail_request_resource;
+        }
+        hcd->rsrc_start = res->start;
+        hcd->rsrc_len = res->end - res->start + 1;
+
+        if (!request_mem_region(hcd->rsrc_start, hcd->rsrc_len,
+                                driver->description)) {
+                dev_dbg(&pdev->dev, "controller already in use\n");
+                retval = -EBUSY;
+                goto fail_request_resource;
+        }
+
+        hcd->regs = ioremap_nocache(hcd->rsrc_start, hcd->rsrc_len);
+        if (hcd->regs == NULL) {
+                dev_dbg(&pdev->dev, "error mapping memory\n");
+                retval = -EFAULT;
+                goto fail_ioremap;
+        }
+
+        iclk = clk_get(&pdev->dev, "ehci_clk");
+        if (IS_ERR(iclk)) {
+                dev_err(&pdev->dev, "Error getting interface clock\n");
+                retval = -ENOENT;
+                goto fail_get_iclk;
+        }
+        fclk = clk_get(&pdev->dev, "uhpck");
+        if (IS_ERR(fclk)) {
+                dev_err(&pdev->dev, "Error getting function clock\n");
+                retval = -ENOENT;
+                goto fail_get_fclk;
+        }
+
+        atmel_start_ehci(pdev);
+
+        retval = usb_add_hcd(hcd, irq, IRQF_SHARED);
+        if (retval)
+                goto fail_add_hcd;
+
+        return retval;
+
+fail_add_hcd:
+        atmel_stop_ehci(pdev);
+        clk_put(fclk);
+fail_get_fclk:
+        clk_put(iclk);
+fail_get_iclk:
+        iounmap(hcd->regs);
+fail_ioremap:
+        release_mem_region(hcd->rsrc_start, hcd->rsrc_len);
+fail_request_resource:
+        usb_put_hcd(hcd);
+fail_create_hcd:
+        dev_err(&pdev->dev, "init %s fail, %d\n",
+                dev_name(&pdev->dev), retval);
+
+        return retval;
+}
+
+static int __exit ehci_atmel_drv_remove(struct platform_device *pdev)
+{
+        struct usb_hcd *hcd = platform_get_drvdata(pdev);
+
+        ehci_shutdown(hcd);
+        usb_remove_hcd(hcd);
+        iounmap(hcd->regs);
+        release_mem_region(hcd->rsrc_start, hcd->rsrc_len);
+        usb_put_hcd(hcd);
+
+        atmel_stop_ehci(pdev);
+        clk_put(fclk);
+        clk_put(iclk);
+        fclk = iclk = NULL;
+
+        return 0;
+}
+
+static struct platform_driver ehci_atmel_driver = {
+        .probe          = ehci_atmel_drv_probe,
+        .remove         = __exit_p(ehci_atmel_drv_remove),
+        .shutdown       = usb_hcd_platform_shutdown,
+        .driver.name    = "atmel-ehci",
+};
diff --git a/drivers/usb/host/ehci-au1xxx.c b/drivers/usb/host/ehci-au1xxx.c
index 59d208d94d4e..ed77be76d6bb 100644
--- a/drivers/usb/host/ehci-au1xxx.c
+++ b/drivers/usb/host/ehci-au1xxx.c
@@ -199,10 +199,9 @@ static int ehci_hcd_au1xxx_drv_remove(struct platform_device *pdev)
 }
 
 #ifdef CONFIG_PM
-static int ehci_hcd_au1xxx_drv_suspend(struct platform_device *pdev,
-                                        pm_message_t message)
+static int ehci_hcd_au1xxx_drv_suspend(struct device *dev)
 {
-        struct usb_hcd *hcd = platform_get_drvdata(pdev);
+        struct usb_hcd *hcd = dev_get_drvdata(dev);
         struct ehci_hcd *ehci = hcd_to_ehci(hcd);
         unsigned long flags;
         int rc;
@@ -229,12 +228,6 @@ static int ehci_hcd_au1xxx_drv_suspend(struct platform_device *pdev,
         ehci_writel(ehci, 0, &ehci->regs->intr_enable);
         (void)ehci_readl(ehci, &ehci->regs->intr_enable);
 
-        /* make sure snapshot being resumed re-enumerates everything */
-        if (message.event == PM_EVENT_PRETHAW) {
-                ehci_halt(ehci);
-                ehci_reset(ehci);
-        }
-
         clear_bit(HCD_FLAG_HW_ACCESSIBLE, &hcd->flags);
 
         au1xxx_stop_ehc();
@@ -248,10 +241,9 @@ bail:
         return rc;
 }
 
-
-static int ehci_hcd_au1xxx_drv_resume(struct platform_device *pdev)
+static int ehci_hcd_au1xxx_drv_resume(struct device *dev)
 {
-        struct usb_hcd *hcd = platform_get_drvdata(pdev);
+        struct usb_hcd *hcd = dev_get_drvdata(dev);
         struct ehci_hcd *ehci = hcd_to_ehci(hcd);
 
         au1xxx_start_ehc();
@@ -305,20 +297,25 @@ static int ehci_hcd_au1xxx_drv_resume(struct platform_device *pdev)
         return 0;
 }
 
+static struct dev_pm_ops au1xxx_ehci_pmops = {
+        .suspend        = ehci_hcd_au1xxx_drv_suspend,
+        .resume         = ehci_hcd_au1xxx_drv_resume,
+};
+
+#define AU1XXX_EHCI_PMOPS &au1xxx_ehci_pmops
+
 #else
-#define ehci_hcd_au1xxx_drv_suspend NULL
-#define ehci_hcd_au1xxx_drv_resume NULL
+#define AU1XXX_EHCI_PMOPS NULL
 #endif
 
 static struct platform_driver ehci_hcd_au1xxx_driver = {
         .probe          = ehci_hcd_au1xxx_drv_probe,
         .remove         = ehci_hcd_au1xxx_drv_remove,
         .shutdown       = usb_hcd_platform_shutdown,
-        .suspend        = ehci_hcd_au1xxx_drv_suspend,
-        .resume         = ehci_hcd_au1xxx_drv_resume,
         .driver = {
                 .name   = "au1xxx-ehci",
                 .owner  = THIS_MODULE,
+                .pm     = AU1XXX_EHCI_PMOPS,
         }
 };
 
diff --git a/drivers/usb/host/ehci-dbg.c b/drivers/usb/host/ehci-dbg.c
index 7f4ace73d44a..874d2000bf92 100644
--- a/drivers/usb/host/ehci-dbg.c
+++ b/drivers/usb/host/ehci-dbg.c
@@ -134,10 +134,11 @@ dbg_qtd (const char *label, struct ehci_hcd *ehci, struct ehci_qtd *qtd)
 static void __maybe_unused
 dbg_qh (const char *label, struct ehci_hcd *ehci, struct ehci_qh *qh)
 {
+        struct ehci_qh_hw *hw = qh->hw;
+
         ehci_dbg (ehci, "%s qh %p n%08x info %x %x qtd %x\n", label,
-                qh, qh->hw_next, qh->hw_info1, qh->hw_info2,
-                qh->hw_current);
-        dbg_qtd ("overlay", ehci, (struct ehci_qtd *) &qh->hw_qtd_next);
+                qh, hw->hw_next, hw->hw_info1, hw->hw_info2, hw->hw_current);
+        dbg_qtd("overlay", ehci, (struct ehci_qtd *) &hw->hw_qtd_next);
 }
 
 static void __maybe_unused
@@ -400,31 +401,32 @@ static void qh_lines (
         char                    *next = *nextp;
         char                    mark;
         __le32                  list_end = EHCI_LIST_END(ehci);
+        struct ehci_qh_hw       *hw = qh->hw;
 
-        if (qh->hw_qtd_next == list_end)        /* NEC does this */
+        if (hw->hw_qtd_next == list_end)        /* NEC does this */
                 mark = '@';
         else
-                mark = token_mark(ehci, qh->hw_token);
+                mark = token_mark(ehci, hw->hw_token);
         if (mark == '/') {      /* qh_alt_next controls qh advance? */
-                if ((qh->hw_alt_next & QTD_MASK(ehci))
-                                == ehci->async->hw_alt_next)
+                if ((hw->hw_alt_next & QTD_MASK(ehci))
+                                == ehci->async->hw->hw_alt_next)
                         mark = '#';     /* blocked */
-                else if (qh->hw_alt_next == list_end)
+                else if (hw->hw_alt_next == list_end)
                         mark = '.';     /* use hw_qtd_next */
                 /* else alt_next points to some other qtd */
         }
-        scratch = hc32_to_cpup(ehci, &qh->hw_info1);
-        hw_curr = (mark == '*') ? hc32_to_cpup(ehci, &qh->hw_current) : 0;
+        scratch = hc32_to_cpup(ehci, &hw->hw_info1);
+        hw_curr = (mark == '*') ? hc32_to_cpup(ehci, &hw->hw_current) : 0;
         temp = scnprintf (next, size,
                         "qh/%p dev%d %cs ep%d %08x %08x (%08x%c %s nak%d)",
                         qh, scratch & 0x007f,
                         speed_char (scratch),
                         (scratch >> 8) & 0x000f,
-                        scratch, hc32_to_cpup(ehci, &qh->hw_info2),
-                        hc32_to_cpup(ehci, &qh->hw_token), mark,
-                        (cpu_to_hc32(ehci, QTD_TOGGLE) & qh->hw_token)
+                        scratch, hc32_to_cpup(ehci, &hw->hw_info2),
+                        hc32_to_cpup(ehci, &hw->hw_token), mark,
+                        (cpu_to_hc32(ehci, QTD_TOGGLE) & hw->hw_token)
                                 ? "data1" : "data0",
-                        (hc32_to_cpup(ehci, &qh->hw_alt_next) >> 1) & 0x0f);
+                        (hc32_to_cpup(ehci, &hw->hw_alt_next) >> 1) & 0x0f);
         size -= temp;
         next += temp;
 
@@ -435,10 +437,10 @@ static void qh_lines (
                 mark = ' ';
                 if (hw_curr == td->qtd_dma)
                         mark = '*';
-                else if (qh->hw_qtd_next == cpu_to_hc32(ehci, td->qtd_dma))
+                else if (hw->hw_qtd_next == cpu_to_hc32(ehci, td->qtd_dma))
                         mark = '+';
                 else if (QTD_LENGTH (scratch)) {
-                        if (td->hw_alt_next == ehci->async->hw_alt_next)
+                        if (td->hw_alt_next == ehci->async->hw->hw_alt_next)
                                 mark = '#';
                         else if (td->hw_alt_next != list_end)
                                 mark = '/';
@@ -550,12 +552,15 @@ static ssize_t fill_periodic_buffer(struct debug_buffer *buf)
                 next += temp;
 
                 do {
+                        struct ehci_qh_hw *hw;
+
                         switch (hc32_to_cpu(ehci, tag)) {
                         case Q_TYPE_QH:
+                                hw = p.qh->hw;
                                 temp = scnprintf (next, size, " qh%d-%04x/%p",
                                                 p.qh->period,
                                                 hc32_to_cpup(ehci,
-                                                                &p.qh->hw_info2)
+                                                        &hw->hw_info2)
                                                         /* uframe masks */
                                                         & (QH_CMASK | QH_SMASK),
                                                 p.qh);
@@ -576,7 +581,7 @@ static ssize_t fill_periodic_buffer(struct debug_buffer *buf)
                                 /* show more info the first time around */
                                 if (temp == seen_count) {
                                         u32     scratch = hc32_to_cpup(ehci,
-                                                        &p.qh->hw_info1);
+                                                        &hw->hw_info1);
                                         struct ehci_qtd *qtd;
                                         char            *type = "";
 
@@ -609,7 +614,7 @@ static ssize_t fill_periodic_buffer(struct debug_buffer *buf)
                                 } else
                                         temp = 0;
                                 if (p.qh) {
-                                        tag = Q_NEXT_TYPE(ehci, p.qh->hw_next);
+                                        tag = Q_NEXT_TYPE(ehci, hw->hw_next);
                                         p = p.qh->qh_next;
                                 }
                                 break;
@@ -879,8 +884,7 @@ static int debug_close(struct inode *inode, struct file *file)
         struct debug_buffer *buf = file->private_data;
 
         if (buf) {
-                if (buf->output_buf)
-                        vfree(buf->output_buf);
+                vfree(buf->output_buf);
                 kfree(buf);
         }
 
diff --git a/drivers/usb/host/ehci-hcd.c b/drivers/usb/host/ehci-hcd.c
index 11c627ce6022..9835e0713943 100644
--- a/drivers/usb/host/ehci-hcd.c
+++ b/drivers/usb/host/ehci-hcd.c
@@ -30,7 +30,6 @@
 #include <linux/timer.h>
 #include <linux/list.h>
 #include <linux/interrupt.h>
-#include <linux/reboot.h>
 #include <linux/usb.h>
 #include <linux/moduleparam.h>
 #include <linux/dma-mapping.h>
@@ -127,6 +126,8 @@ timer_action(struct ehci_hcd *ehci, enum ehci_timer_action action)
 
                 switch (action) {
                 case TIMER_IO_WATCHDOG:
+                        if (!ehci->need_io_watchdog)
+                                return;
                         t = EHCI_IO_JIFFIES;
                         break;
                 case TIMER_ASYNC_OFF:
@@ -239,6 +240,11 @@ static int ehci_reset (struct ehci_hcd *ehci)
         int     retval;
         u32     command = ehci_readl(ehci, &ehci->regs->command);
 
+        /* If the EHCI debug controller is active, special care must be
+         * taken before and after a host controller reset */
+        if (ehci->debug && !dbgp_reset_prep())
+                ehci->debug = NULL;
+
         command |= CMD_RESET;
         dbg_cmd (ehci, "reset", command);
         ehci_writel(ehci, command, &ehci->regs->command);
@@ -247,12 +253,21 @@ static int ehci_reset (struct ehci_hcd *ehci)
         retval = handshake (ehci, &ehci->regs->command,
                             CMD_RESET, 0, 250 * 1000);
 
+        if (ehci->has_hostpc) {
+                ehci_writel(ehci, USBMODE_EX_HC | USBMODE_EX_VBPS,
+                        (u32 __iomem *)(((u8 *)ehci->regs) + USBMODE_EX));
+                ehci_writel(ehci, TXFIFO_DEFAULT,
+                        (u32 __iomem *)(((u8 *)ehci->regs) + TXFILLTUNING));
+        }
         if (retval)
                 return retval;
 
         if (ehci_is_TDI(ehci))
                 tdi_reset (ehci);
 
+        if (ehci->debug)
+                dbgp_external_startup();
+
         return retval;
 }
 
@@ -505,9 +520,14 @@ static int ehci_init(struct usb_hcd *hcd)
         u32                     temp;
         int                     retval;
         u32                     hcc_params;
+        struct ehci_qh_hw       *hw;
 
         spin_lock_init(&ehci->lock);
 
+        /*
+         * keep io watchdog by default, those good HCDs could turn off it later
+         */
+        ehci->need_io_watchdog = 1;
         init_timer(&ehci->watchdog);
         ehci->watchdog.function = ehci_watchdog;
         ehci->watchdog.data = (unsigned long) ehci;
@@ -544,12 +564,13 @@ static int ehci_init(struct usb_hcd *hcd)
          * from automatically advancing to the next td after short reads.
          */
         ehci->async->qh_next.qh = NULL;
-        ehci->async->hw_next = QH_NEXT(ehci, ehci->async->qh_dma);
-        ehci->async->hw_info1 = cpu_to_hc32(ehci, QH_HEAD);
-        ehci->async->hw_token = cpu_to_hc32(ehci, QTD_STS_HALT);
-        ehci->async->hw_qtd_next = EHCI_LIST_END(ehci);
+        hw = ehci->async->hw;
+        hw->hw_next = QH_NEXT(ehci, ehci->async->qh_dma);
+        hw->hw_info1 = cpu_to_hc32(ehci, QH_HEAD);
+        hw->hw_token = cpu_to_hc32(ehci, QTD_STS_HALT);
+        hw->hw_qtd_next = EHCI_LIST_END(ehci);
         ehci->async->qh_state = QH_STATE_LINKED;
-        ehci->async->hw_alt_next = QTD_NEXT(ehci, ehci->async->dummy->qtd_dma);
+        hw->hw_alt_next = QTD_NEXT(ehci, ehci->async->dummy->qtd_dma);
 
         /* clear interrupt enables, set irq latency */
         if (log2_irq_thresh < 0 || log2_irq_thresh > 6)
@@ -850,12 +871,18 @@ static void unlink_async (struct ehci_hcd *ehci, struct ehci_qh *qh)
         if (!HC_IS_RUNNING(ehci_to_hcd(ehci)->state) && ehci->reclaim)
                 end_unlink_async(ehci);
 
-        /* if it's not linked then there's nothing to do */
-        if (qh->qh_state != QH_STATE_LINKED)
-                ;
+        /* If the QH isn't linked then there's nothing we can do
+         * unless we were called during a giveback, in which case
+         * qh_completions() has to deal with it.
+         */
+        if (qh->qh_state != QH_STATE_LINKED) {
+                if (qh->qh_state == QH_STATE_COMPLETING)
+                        qh->needs_rescan = 1;
+                return;
+        }
 
         /* defer till later if busy */
-        else if (ehci->reclaim) {
+        if (ehci->reclaim) {
                 struct ehci_qh          *last;
 
                 for (last = ehci->reclaim;
@@ -915,8 +942,9 @@ static int ehci_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status)
                         break;
                 switch (qh->qh_state) {
                 case QH_STATE_LINKED:
+                case QH_STATE_COMPLETING:
                         intr_deschedule (ehci, qh);
-                        /* FALL THROUGH */
+                        break;
                 case QH_STATE_IDLE:
                         qh_completions (ehci, qh);
                         break;
@@ -925,23 +953,6 @@ static int ehci_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status)
                                         qh, qh->qh_state);
                         goto done;
                 }
-
-                /* reschedule QH iff another request is queued */
-                if (!list_empty (&qh->qtd_list)
-                                && HC_IS_RUNNING (hcd->state)) {
-                        rc = qh_schedule(ehci, qh);
-
-                        /* An error here likely indicates handshake failure
-                         * or no space left in the schedule.  Neither fault
-                         * should happen often ...
-                         *
-                         * FIXME kill the now-dysfunctional queued urbs
-                         */
-                        if (rc != 0)
-                                ehci_err(ehci,
-                                        "can't reschedule qh %p, err %d",
-                                        qh, rc);
-                }
                 break;
 
         case PIPE_ISOCHRONOUS:
@@ -979,7 +990,7 @@ rescan:
         /* endpoints can be iso streams.  for now, we don't
          * accelerate iso completions ... so spin a while.
          */
-        if (qh->hw_info1 == 0) {
+        if (qh->hw->hw_info1 == 0) {
                 ehci_vdbg (ehci, "iso delay\n");
                 goto idle_timeout;
         }
@@ -988,6 +999,7 @@ rescan:
                 qh->qh_state = QH_STATE_IDLE;
         switch (qh->qh_state) {
         case QH_STATE_LINKED:
+        case QH_STATE_COMPLETING:
                 for (tmp = ehci->async->qh_next.qh;
                                 tmp && tmp != qh;
                                 tmp = tmp->qh_next.qh)
@@ -1052,18 +1064,17 @@ ehci_endpoint_reset(struct usb_hcd *hcd, struct usb_host_endpoint *ep)
                 usb_settoggle(qh->dev, epnum, is_out, 0);
                 if (!list_empty(&qh->qtd_list)) {
                         WARN_ONCE(1, "clear_halt for a busy endpoint\n");
-                } else if (qh->qh_state == QH_STATE_LINKED) {
+                } else if (qh->qh_state == QH_STATE_LINKED ||
+                                qh->qh_state == QH_STATE_COMPLETING) {
 
                         /* The toggle value in the QH can't be updated
                          * while the QH is active.  Unlink it now;
                          * re-linking will call qh_refresh().
                          */
-                        if (eptype == USB_ENDPOINT_XFER_BULK) {
+                        if (eptype == USB_ENDPOINT_XFER_BULK)
                                 unlink_async(ehci, qh);
-                        } else {
+                        else
                                 intr_deschedule(ehci, qh);
-                                (void) qh_schedule(ehci, qh);
-                        }
                 }
         }
         spin_unlock_irqrestore(&ehci->lock, flags);
@@ -1117,6 +1128,16 @@ MODULE_LICENSE ("GPL");
 #define PLATFORM_DRIVER         ixp4xx_ehci_driver
 #endif
 
+#ifdef CONFIG_USB_W90X900_EHCI
+#include "ehci-w90x900.c"
+#define PLATFORM_DRIVER         ehci_hcd_w90x900_driver
+#endif
+
+#ifdef CONFIG_ARCH_AT91
+#include "ehci-atmel.c"
+#define PLATFORM_DRIVER         ehci_atmel_driver
+#endif
+
 #if !defined(PCI_DRIVER) && !defined(PLATFORM_DRIVER) && \
     !defined(PS3_SYSTEM_BUS_DRIVER) && !defined(OF_PLATFORM_DRIVER)
 #error "missing bus glue for ehci-hcd"
diff --git a/drivers/usb/host/ehci-hub.c b/drivers/usb/host/ehci-hub.c
index f46ad27c9a90..1b6f1c0e5cee 100644
--- a/drivers/usb/host/ehci-hub.c
+++ b/drivers/usb/host/ehci-hub.c
@@ -111,6 +111,7 @@ static int ehci_bus_suspend (struct usb_hcd *hcd)
         struct ehci_hcd         *ehci = hcd_to_ehci (hcd);
         int                     port;
         int                     mask;
+        u32 __iomem             *hostpc_reg = NULL;
 
         ehci_dbg(ehci, "suspend root hub\n");
 
@@ -142,6 +143,9 @@ static int ehci_bus_suspend (struct usb_hcd *hcd)
                 u32             t1 = ehci_readl(ehci, reg) & ~PORT_RWC_BITS;
                 u32             t2 = t1;
 
+                if (ehci->has_hostpc)
+                        hostpc_reg = (u32 __iomem *)((u8 *)ehci->regs
+                                + HOSTPC0 + 4 * (port & 0xff));
                 /* keep track of which ports we suspend */
                 if (t1 & PORT_OWNER)
                         set_bit(port, &ehci->owned_ports);
@@ -151,15 +155,37 @@ static int ehci_bus_suspend (struct usb_hcd *hcd)
                 }
 
                 /* enable remote wakeup on all ports */
-                if (hcd->self.root_hub->do_remote_wakeup)
-                        t2 |= PORT_WAKE_BITS;
-                else
+                if (hcd->self.root_hub->do_remote_wakeup) {
+                        /* only enable appropriate wake bits, otherwise the
+                         * hardware can not go phy low power mode. If a race
+                         * condition happens here(connection change during bits
+                         * set), the port change detection will finally fix it.
+                         */
+                        if (t1 & PORT_CONNECT) {
+                                t2 |= PORT_WKOC_E | PORT_WKDISC_E;
+                                t2 &= ~PORT_WKCONN_E;
+                        } else {
+                                t2 |= PORT_WKOC_E | PORT_WKCONN_E;
+                                t2 &= ~PORT_WKDISC_E;
+                        }
+                } else
                         t2 &= ~PORT_WAKE_BITS;
 
                 if (t1 != t2) {
                         ehci_vdbg (ehci, "port %d, %08x -> %08x\n",
                                 port + 1, t1, t2);
                         ehci_writel(ehci, t2, reg);
+                        if (hostpc_reg) {
+                                u32     t3;
+
+                                msleep(5);/* 5ms for HCD enter low pwr mode */
+                                t3 = ehci_readl(ehci, hostpc_reg);
+                                ehci_writel(ehci, t3 | HOSTPC_PHCD, hostpc_reg);
+                                t3 = ehci_readl(ehci, hostpc_reg);
+                                ehci_dbg(ehci, "Port%d phy low pwr mode %s\n",
+                                        port, (t3 & HOSTPC_PHCD) ?
+                                        "succeeded" : "failed");
+                        }
                 }
         }
 
@@ -183,6 +209,11 @@ static int ehci_bus_suspend (struct usb_hcd *hcd)
 
         ehci->next_statechange = jiffies + msecs_to_jiffies(10);
         spin_unlock_irq (&ehci->lock);
+
+        /* ehci_work() may have re-enabled the watchdog timer, which we do not
+         * want, and so we must delete any pending watchdog timer events.
+         */
+        del_timer_sync(&ehci->watchdog);
         return 0;
 }
 
@@ -204,6 +235,13 @@ static int ehci_bus_resume (struct usb_hcd *hcd)
                 return -ESHUTDOWN;
         }
 
+        if (unlikely(ehci->debug)) {
+                if (ehci->debug && !dbgp_reset_prep())
+                        ehci->debug = NULL;
+                else
+                        dbgp_external_startup();
+        }
+
         /* Ideally and we've got a real resume here, and no port's power
          * was lost.  (For PCI, that means Vaux was maintained.)  But we
          * could instead be restoring a swsusp snapshot -- so that BIOS was
@@ -563,7 +601,8 @@ static int ehci_hub_control (
         int             ports = HCS_N_PORTS (ehci->hcs_params);
         u32 __iomem     *status_reg = &ehci->regs->port_status[
                                 (wIndex & 0xff) - 1];
-        u32             temp, status;
+        u32 __iomem     *hostpc_reg = NULL;
+        u32             temp, temp1, status;
         unsigned long   flags;
         int             retval = 0;
         unsigned        selector;
@@ -575,6 +614,9 @@ static int ehci_hub_control (
          * power, "this is the one", etc.  EHCI spec supports this.
          */
 
+        if (ehci->has_hostpc)
+                hostpc_reg = (u32 __iomem *)((u8 *)ehci->regs
+                                + HOSTPC0 + 4 * ((wIndex & 0xff) - 1));
         spin_lock_irqsave (&ehci->lock, flags);
         switch (typeReq) {
         case ClearHubFeature:
@@ -773,7 +815,11 @@ static int ehci_hub_control (
                 if (temp & PORT_CONNECT) {
                         status |= 1 << USB_PORT_FEAT_CONNECTION;
                         // status may be from integrated TT
-                        status |= ehci_port_speed(ehci, temp);
+                        if (ehci->has_hostpc) {
+                                temp1 = ehci_readl(ehci, hostpc_reg);
+                                status |= ehci_port_speed(ehci, temp1);
+                        } else
+                                status |= ehci_port_speed(ehci, temp);
                 }
                 if (temp & PORT_PE)
                         status |= 1 << USB_PORT_FEAT_ENABLE;
@@ -816,6 +862,15 @@ static int ehci_hub_control (
         case SetPortFeature:
                 selector = wIndex >> 8;
                 wIndex &= 0xff;
+                if (unlikely(ehci->debug)) {
+                        /* If the debug port is active any port
+                         * feature requests should get denied */
+                        if (wIndex == HCS_DEBUG_PORT(ehci->hcs_params) &&
+                            (readl(&ehci->debug->control) & DBGP_ENABLED)) {
+                                retval = -ENODEV;
+                                goto error_exit;
+                        }
+                }
                 if (!wIndex || wIndex > ports)
                         goto error;
                 wIndex--;
@@ -832,6 +887,24 @@ static int ehci_hub_control (
                                         || (temp & PORT_RESET) != 0)
                                 goto error;
                         ehci_writel(ehci, temp | PORT_SUSPEND, status_reg);
+                        /* After above check the port must be connected.
+                         * Set appropriate bit thus could put phy into low power
+                         * mode if we have hostpc feature
+                         */
+                        if (hostpc_reg) {
+                                temp &= ~PORT_WKCONN_E;
+                                temp |= (PORT_WKDISC_E | PORT_WKOC_E);
+                                ehci_writel(ehci, temp | PORT_SUSPEND,
+                                                        status_reg);
+                                msleep(5);/* 5ms for HCD enter low pwr mode */
+                                temp1 = ehci_readl(ehci, hostpc_reg);
+                                ehci_writel(ehci, temp1 | HOSTPC_PHCD,
+                                        hostpc_reg);
+                                temp1 = ehci_readl(ehci, hostpc_reg);
+                                ehci_dbg(ehci, "Port%d phy low pwr mode %s\n",
+                                        wIndex, (temp1 & HOSTPC_PHCD) ?
+                                        "succeeded" : "failed");
+                        }
                         set_bit(wIndex, &ehci->suspended_ports);
                         break;
                 case USB_PORT_FEAT_POWER:
@@ -894,6 +967,7 @@ error:
                 /* "stall" on error */
                 retval = -EPIPE;
         }
+error_exit:
         spin_unlock_irqrestore (&ehci->lock, flags);
         return retval;
 }
diff --git a/drivers/usb/host/ehci-mem.c b/drivers/usb/host/ehci-mem.c
index 10d52919abbb..aeda96e0af67 100644
--- a/drivers/usb/host/ehci-mem.c
+++ b/drivers/usb/host/ehci-mem.c
@@ -75,7 +75,8 @@ static void qh_destroy(struct ehci_qh *qh)
         }
         if (qh->dummy)
                 ehci_qtd_free (ehci, qh->dummy);
-        dma_pool_free (ehci->qh_pool, qh, qh->qh_dma);
+        dma_pool_free(ehci->qh_pool, qh->hw, qh->qh_dma);
+        kfree(qh);
 }
 
 static struct ehci_qh *ehci_qh_alloc (struct ehci_hcd *ehci, gfp_t flags)
@@ -83,12 +84,14 @@ static struct ehci_qh *ehci_qh_alloc (struct ehci_hcd *ehci, gfp_t flags)
         struct ehci_qh          *qh;
         dma_addr_t              dma;
 
-        qh = (struct ehci_qh *)
-                dma_pool_alloc (ehci->qh_pool, flags, &dma);
+        qh = kzalloc(sizeof *qh, GFP_ATOMIC);
         if (!qh)
-                return qh;
-
-        memset (qh, 0, sizeof *qh);
+                goto done;
+        qh->hw = (struct ehci_qh_hw *)
+                dma_pool_alloc(ehci->qh_pool, flags, &dma);
+        if (!qh->hw)
+                goto fail;
+        memset(qh->hw, 0, sizeof *qh->hw);
         qh->refcount = 1;
         qh->ehci = ehci;
         qh->qh_dma = dma;
@@ -99,10 +102,15 @@ static struct ehci_qh *ehci_qh_alloc (struct ehci_hcd *ehci, gfp_t flags)
         qh->dummy = ehci_qtd_alloc (ehci, flags);
         if (qh->dummy == NULL) {
                 ehci_dbg (ehci, "no dummy td\n");
-                dma_pool_free (ehci->qh_pool, qh, qh->qh_dma);
-                qh = NULL;
+                goto fail1;
         }
+done:
         return qh;
+fail1:
+        dma_pool_free(ehci->qh_pool, qh->hw, qh->qh_dma);
+fail:
+        kfree(qh);
+        return NULL;
 }
 
 /* to share a qh (cpu threads, or hc) */
@@ -180,7 +188,7 @@ static int ehci_mem_init (struct ehci_hcd *ehci, gfp_t flags)
         /* QHs for control/bulk/intr transfers */
         ehci->qh_pool = dma_pool_create ("ehci_qh",
                         ehci_to_hcd(ehci)->self.controller,
-                        sizeof (struct ehci_qh),
+                        sizeof(struct ehci_qh_hw),
                         32 /* byte alignment (for hw parts) */,
                         4096 /* can't cross 4K */);
         if (!ehci->qh_pool) {
diff --git a/drivers/usb/host/ehci-pci.c b/drivers/usb/host/ehci-pci.c
index c2f1b7df918c..378861b9d79a 100644
--- a/drivers/usb/host/ehci-pci.c
+++ b/drivers/usb/host/ehci-pci.c
@@ -27,28 +27,8 @@
 /* called after powerup, by probe or system-pm "wakeup" */
 static int ehci_pci_reinit(struct ehci_hcd *ehci, struct pci_dev *pdev)
 {
-        u32                     temp;
         int                     retval;
 
-        /* optional debug port, normally in the first BAR */
-        temp = pci_find_capability(pdev, 0x0a);
-        if (temp) {
-                pci_read_config_dword(pdev, temp, &temp);
-                temp >>= 16;
-                if ((temp & (3 << 13)) == (1 << 13)) {
-                        temp &= 0x1fff;
-                        ehci->debug = ehci_to_hcd(ehci)->regs + temp;
-                        temp = ehci_readl(ehci, &ehci->debug->control);
-                        ehci_info(ehci, "debug port %d%s\n",
-                                HCS_DEBUG_PORT(ehci->hcs_params),
-                                (temp & DBGP_ENABLED)
-                                        ? " IN USE"
-                                        : "");
-                        if (!(temp & DBGP_ENABLED))
-                                ehci->debug = NULL;
-                }
-        }
-
         /* we expect static quirk code to handle the "extended capabilities"
          * (currently just BIOS handoff) allowed starting with EHCI 0.96
          */
@@ -129,6 +109,9 @@ static int ehci_pci_setup(struct usb_hcd *hcd)
                 return retval;
 
         switch (pdev->vendor) {
+        case PCI_VENDOR_ID_INTEL:
+                ehci->need_io_watchdog = 0;
+                break;
         case PCI_VENDOR_ID_TDI:
                 if (pdev->device == PCI_DEVICE_ID_TDI_EHCI) {
                         hcd->has_tt = 1;
@@ -192,6 +175,25 @@ static int ehci_pci_setup(struct usb_hcd *hcd)
                 break;
         }
 
+        /* optional debug port, normally in the first BAR */
+        temp = pci_find_capability(pdev, 0x0a);
+        if (temp) {
+                pci_read_config_dword(pdev, temp, &temp);
+                temp >>= 16;
+                if ((temp & (3 << 13)) == (1 << 13)) {
+                        temp &= 0x1fff;
+                        ehci->debug = ehci_to_hcd(ehci)->regs + temp;
+                        temp = ehci_readl(ehci, &ehci->debug->control);
+                        ehci_info(ehci, "debug port %d%s\n",
+                                HCS_DEBUG_PORT(ehci->hcs_params),
+                                (temp & DBGP_ENABLED)
+                                        ? " IN USE"
+                                        : "");
+                        if (!(temp & DBGP_ENABLED))
+                                ehci->debug = NULL;
+                }
+        }
+
         ehci_reset(ehci);
 
         /* at least the Genesys GL880S needs fixup here */
@@ -242,7 +244,7 @@ static int ehci_pci_setup(struct usb_hcd *hcd)
          * System suspend currently expects to be able to suspend the entire
          * device tree, device-at-a-time.  If we failed selective suspend
          * reports, system suspend would fail; so the root hub code must claim
-         * success.  That's lying to usbcore, and it matters for for runtime
+         * success.  That's lying to usbcore, and it matters for runtime
          * PM scenarios with selective suspend and remote wakeup...
          */
         if (ehci->no_selective_suspend && device_can_wakeup(&pdev->dev))
diff --git a/drivers/usb/host/ehci-q.c b/drivers/usb/host/ehci-q.c
index 7673554fa64d..00ad9ce392ed 100644
--- a/drivers/usb/host/ehci-q.c
+++ b/drivers/usb/host/ehci-q.c
@@ -87,31 +87,33 @@ qtd_fill(struct ehci_hcd *ehci, struct ehci_qtd *qtd, dma_addr_t buf,
 static inline void
 qh_update (struct ehci_hcd *ehci, struct ehci_qh *qh, struct ehci_qtd *qtd)
 {
+        struct ehci_qh_hw *hw = qh->hw;
+
         /* writes to an active overlay are unsafe */
         BUG_ON(qh->qh_state != QH_STATE_IDLE);
 
-        qh->hw_qtd_next = QTD_NEXT(ehci, qtd->qtd_dma);
-        qh->hw_alt_next = EHCI_LIST_END(ehci);
+        hw->hw_qtd_next = QTD_NEXT(ehci, qtd->qtd_dma);
+        hw->hw_alt_next = EHCI_LIST_END(ehci);
 
         /* Except for control endpoints, we make hardware maintain data
          * toggle (like OHCI) ... here (re)initialize the toggle in the QH,
          * and set the pseudo-toggle in udev. Only usb_clear_halt() will
          * ever clear it.
          */
-        if (!(qh->hw_info1 & cpu_to_hc32(ehci, 1 << 14))) {
+        if (!(hw->hw_info1 & cpu_to_hc32(ehci, 1 << 14))) {
                 unsigned        is_out, epnum;
 
                 is_out = !(qtd->hw_token & cpu_to_hc32(ehci, 1 << 8));
-                epnum = (hc32_to_cpup(ehci, &qh->hw_info1) >> 8) & 0x0f;
+                epnum = (hc32_to_cpup(ehci, &hw->hw_info1) >> 8) & 0x0f;
                 if (unlikely (!usb_gettoggle (qh->dev, epnum, is_out))) {
-                        qh->hw_token &= ~cpu_to_hc32(ehci, QTD_TOGGLE);
+                        hw->hw_token &= ~cpu_to_hc32(ehci, QTD_TOGGLE);
                         usb_settoggle (qh->dev, epnum, is_out, 1);
                 }
         }
 
         /* HC must see latest qtd and qh data before we clear ACTIVE+HALT */
         wmb ();
-        qh->hw_token &= cpu_to_hc32(ehci, QTD_TOGGLE | QTD_STS_PING);
+        hw->hw_token &= cpu_to_hc32(ehci, QTD_TOGGLE | QTD_STS_PING);
 }
 
 /* if it weren't for a common silicon quirk (writing the dummy into the qh
@@ -129,7 +131,7 @@ qh_refresh (struct ehci_hcd *ehci, struct ehci_qh *qh)
                 qtd = list_entry (qh->qtd_list.next,
                                 struct ehci_qtd, qtd_list);
                 /* first qtd may already be partially processed */
-                if (cpu_to_hc32(ehci, qtd->qtd_dma) == qh->hw_current)
+                if (cpu_to_hc32(ehci, qtd->qtd_dma) == qh->hw->hw_current)
                         qtd = NULL;
         }
 
@@ -260,7 +262,7 @@ __acquires(ehci->lock)
                 struct ehci_qh  *qh = (struct ehci_qh *) urb->hcpriv;
 
                 /* S-mask in a QH means it's an interrupt urb */
-                if ((qh->hw_info2 & cpu_to_hc32(ehci, QH_SMASK)) != 0) {
+                if ((qh->hw->hw_info2 & cpu_to_hc32(ehci, QH_SMASK)) != 0) {
 
                         /* ... update hc-wide periodic stats (for usbfs) */
                         ehci_to_hcd(ehci)->self.bandwidth_int_reqs--;
@@ -297,7 +299,6 @@ __acquires(ehci->lock)
 static void start_unlink_async (struct ehci_hcd *ehci, struct ehci_qh *qh);
 static void unlink_async (struct ehci_hcd *ehci, struct ehci_qh *qh);
 
-static void intr_deschedule (struct ehci_hcd *ehci, struct ehci_qh *qh);
 static int qh_schedule (struct ehci_hcd *ehci, struct ehci_qh *qh);
 
 /*
@@ -308,13 +309,14 @@ static int qh_schedule (struct ehci_hcd *ehci, struct ehci_qh *qh);
 static unsigned
 qh_completions (struct ehci_hcd *ehci, struct ehci_qh *qh)
 {
-        struct ehci_qtd         *last = NULL, *end = qh->dummy;
+        struct ehci_qtd         *last, *end = qh->dummy;
         struct list_head        *entry, *tmp;
-        int                     last_status = -EINPROGRESS;
+        int                     last_status;
         int                     stopped;
         unsigned                count = 0;
         u8                      state;
-        __le32                  halt = HALT_BIT(ehci);
+        const __le32            halt = HALT_BIT(ehci);
+        struct ehci_qh_hw       *hw = qh->hw;
 
         if (unlikely (list_empty (&qh->qtd_list)))
                 return count;
@@ -324,11 +326,20 @@ qh_completions (struct ehci_hcd *ehci, struct ehci_qh *qh)
          * they add urbs to this qh's queue or mark them for unlinking.
          *
          * NOTE:  unlinking expects to be done in queue order.
+         *
+         * It's a bug for qh->qh_state to be anything other than
+         * QH_STATE_IDLE, unless our caller is scan_async() or
+         * scan_periodic().
          */
         state = qh->qh_state;
         qh->qh_state = QH_STATE_COMPLETING;
         stopped = (state == QH_STATE_IDLE);
 
+ rescan:
+        last = NULL;
+        last_status = -EINPROGRESS;
+        qh->needs_rescan = 0;
+
         /* remove de-activated QTDs from front of queue.
          * after faults (including short reads), cleanup this urb
          * then let the queue advance.
@@ -392,7 +403,8 @@ qh_completions (struct ehci_hcd *ehci, struct ehci_qh *qh)
                                         qtd->hw_token = cpu_to_hc32(ehci,
                                                         token);
                                         wmb();
-                                        qh->hw_token = cpu_to_hc32(ehci, token);
+                                        hw->hw_token = cpu_to_hc32(ehci,
+                                                        token);
                                         goto retry_xacterr;
                                 }
                                 stopped = 1;
@@ -435,8 +447,8 @@ qh_completions (struct ehci_hcd *ehci, struct ehci_qh *qh)
                         /* qh unlinked; token in overlay may be most current */
                         if (state == QH_STATE_IDLE
                                         && cpu_to_hc32(ehci, qtd->qtd_dma)
-                                                == qh->hw_current) {
-                                token = hc32_to_cpu(ehci, qh->hw_token);
+                                                == hw->hw_current) {
+                                token = hc32_to_cpu(ehci, hw->hw_token);
 
                                 /* An unlink may leave an incomplete
                                  * async transaction in the TT buffer.
@@ -449,9 +461,9 @@ qh_completions (struct ehci_hcd *ehci, struct ehci_qh *qh)
                          * patch the qh later and so that completions can't
                          * activate it while we "know" it's stopped.
                          */
-                        if ((halt & qh->hw_token) == 0) {
+                        if ((halt & hw->hw_token) == 0) {
 halt:
-                                qh->hw_token |= halt;
+                                hw->hw_token |= halt;
                                 wmb ();
                         }
                 }
@@ -503,6 +515,21 @@ halt:
                 ehci_qtd_free (ehci, last);
         }
 
+        /* Do we need to rescan for URBs dequeued during a giveback? */
+        if (unlikely(qh->needs_rescan)) {
+                /* If the QH is already unlinked, do the rescan now. */
+                if (state == QH_STATE_IDLE)
+                        goto rescan;
+
+                /* Otherwise we have to wait until the QH is fully unlinked.
+                 * Our caller will start an unlink if qh->needs_rescan is
+                 * set.  But if an unlink has already started, nothing needs
+                 * to be done.
+                 */
+                if (state != QH_STATE_LINKED)
+                        qh->needs_rescan = 0;
+        }
+
         /* restore original state; caller must unlink or relink */
         qh->qh_state = state;
 
@@ -510,7 +537,7 @@ halt:
          * it after fault cleanup, or recovering from silicon wrongly
          * overlaying the dummy qtd (which reduces DMA chatter).
          */
-        if (stopped != 0 || qh->hw_qtd_next == EHCI_LIST_END(ehci)) {
+        if (stopped != 0 || hw->hw_qtd_next == EHCI_LIST_END(ehci)) {
                 switch (state) {
                 case QH_STATE_IDLE:
                         qh_refresh(ehci, qh);
@@ -527,12 +554,9 @@ halt:
                          * That should be rare for interrupt transfers,
                          * except maybe high bandwidth ...
                          */
-                        if ((cpu_to_hc32(ehci, QH_SMASK)
-                                        & qh->hw_info2) != 0) {
-                                intr_deschedule (ehci, qh);
-                                (void) qh_schedule (ehci, qh);
-                        } else
-                                unlink_async (ehci, qh);
+
+                        /* Tell the caller to start an unlink */
+                        qh->needs_rescan = 1;
                         break;
                 /* otherwise, unlink already started */
                 }
@@ -649,7 +673,7 @@ qh_urb_transaction (
                  * (this will usually be overridden later.)
                  */
                 if (is_input)
-                        qtd->hw_alt_next = ehci->async->hw_alt_next;
+                        qtd->hw_alt_next = ehci->async->hw->hw_alt_next;
 
                 /* qh makes control packets use qtd toggle; maybe switch it */
                 if ((maxpacket & (this_qtd_len + (maxpacket - 1))) == 0)
@@ -744,6 +768,7 @@ qh_make (
         int                     is_input, type;
         int                     maxp = 0;
         struct usb_tt           *tt = urb->dev->tt;
+        struct ehci_qh_hw       *hw;
 
         if (!qh)
                 return qh;
@@ -890,8 +915,9 @@ done:
 
         /* init as live, toggle clear, advance to dummy */
         qh->qh_state = QH_STATE_IDLE;
-        qh->hw_info1 = cpu_to_hc32(ehci, info1);
-        qh->hw_info2 = cpu_to_hc32(ehci, info2);
+        hw = qh->hw;
+        hw->hw_info1 = cpu_to_hc32(ehci, info1);
+        hw->hw_info2 = cpu_to_hc32(ehci, info2);
         usb_settoggle (urb->dev, usb_pipeendpoint (urb->pipe), !is_input, 1);
         qh_refresh (ehci, qh);
         return qh;
@@ -910,6 +936,8 @@ static void qh_link_async (struct ehci_hcd *ehci, struct ehci_qh *qh)
         if (unlikely(qh->clearing_tt))
                 return;
 
+        WARN_ON(qh->qh_state != QH_STATE_IDLE);
+
         /* (re)start the async schedule? */
         head = ehci->async;
         timer_action_done (ehci, TIMER_ASYNC_OFF);
@@ -928,16 +956,15 @@ static void qh_link_async (struct ehci_hcd *ehci, struct ehci_qh *qh)
         }
 
         /* clear halt and/or toggle; and maybe recover from silicon quirk */
-        if (qh->qh_state == QH_STATE_IDLE)
-                qh_refresh (ehci, qh);
+        qh_refresh(ehci, qh);
 
         /* splice right after start */
         qh->qh_next = head->qh_next;
-        qh->hw_next = head->hw_next;
+        qh->hw->hw_next = head->hw->hw_next;
         wmb ();
 
         head->qh_next.qh = qh;
-        head->hw_next = dma;
+        head->hw->hw_next = dma;
 
         qh_get(qh);
         qh->xacterrs = 0;
@@ -984,7 +1011,7 @@ static struct ehci_qh *qh_append_tds (
 
                         /* usb_reset_device() briefly reverts to address 0 */
                         if (usb_pipedevice (urb->pipe) == 0)
-                                qh->hw_info1 &= ~qh_addr_mask;
+                                qh->hw->hw_info1 &= ~qh_addr_mask;
                 }
 
                 /* just one way to queue requests: swap with the dummy qtd.
@@ -1169,7 +1196,7 @@ static void start_unlink_async (struct ehci_hcd *ehci, struct ehci_qh *qh)
         while (prev->qh_next.qh != qh)
                 prev = prev->qh_next.qh;
 
-        prev->hw_next = qh->hw_next;
+        prev->hw->hw_next = qh->hw->hw_next;
         prev->qh_next = qh->qh_next;
         wmb ();
 
@@ -1214,6 +1241,8 @@ rescan:
                                 qh = qh_get (qh);
                                 qh->stamp = ehci->stamp;
                                 temp = qh_completions (ehci, qh);
+                                if (qh->needs_rescan)
+                                        unlink_async(ehci, qh);
                                 qh_put (qh);
                                 if (temp != 0) {
                                         goto rescan;
diff --git a/drivers/usb/host/ehci-sched.c b/drivers/usb/host/ehci-sched.c
index edd61ee90323..3ea05936851f 100644
--- a/drivers/usb/host/ehci-sched.c
+++ b/drivers/usb/host/ehci-sched.c
@@ -60,6 +60,20 @@ periodic_next_shadow(struct ehci_hcd *ehci, union ehci_shadow *periodic,
         }
 }
 
+static __hc32 *
+shadow_next_periodic(struct ehci_hcd *ehci, union ehci_shadow *periodic,
+                __hc32 tag)
+{
+        switch (hc32_to_cpu(ehci, tag)) {
+        /* our ehci_shadow.qh is actually software part */
+        case Q_TYPE_QH:
+                return &periodic->qh->hw->hw_next;
+        /* others are hw parts */
+        default:
+                return periodic->hw_next;
+        }
+}
+
 /* caller must hold ehci->lock */
 static void periodic_unlink (struct ehci_hcd *ehci, unsigned frame, void *ptr)
 {
@@ -71,7 +85,8 @@ static void periodic_unlink (struct ehci_hcd *ehci, unsigned frame, void *ptr)
         while (here.ptr && here.ptr != ptr) {
                 prev_p = periodic_next_shadow(ehci, prev_p,
                                 Q_NEXT_TYPE(ehci, *hw_p));
-                hw_p = here.hw_next;
+                hw_p = shadow_next_periodic(ehci, &here,
+                                Q_NEXT_TYPE(ehci, *hw_p));
                 here = *prev_p;
         }
         /* an interrupt entry (at list end) could have been shared */
@@ -83,7 +98,7 @@ static void periodic_unlink (struct ehci_hcd *ehci, unsigned frame, void *ptr)
          */
         *prev_p = *periodic_next_shadow(ehci, &here,
                         Q_NEXT_TYPE(ehci, *hw_p));
-        *hw_p = *here.hw_next;
+        *hw_p = *shadow_next_periodic(ehci, &here, Q_NEXT_TYPE(ehci, *hw_p));
 }
 
 /* how many of the uframe's 125 usecs are allocated? */
@@ -93,18 +108,20 @@ periodic_usecs (struct ehci_hcd *ehci, unsigned frame, unsigned uframe)
         __hc32                  *hw_p = &ehci->periodic [frame];
         union ehci_shadow       *q = &ehci->pshadow [frame];
         unsigned                usecs = 0;
+        struct ehci_qh_hw       *hw;
 
         while (q->ptr) {
                 switch (hc32_to_cpu(ehci, Q_NEXT_TYPE(ehci, *hw_p))) {
                 case Q_TYPE_QH:
+                        hw = q->qh->hw;
                         /* is it in the S-mask? */
-                        if (q->qh->hw_info2 & cpu_to_hc32(ehci, 1 << uframe))
+                        if (hw->hw_info2 & cpu_to_hc32(ehci, 1 << uframe))
                                 usecs += q->qh->usecs;
                         /* ... or C-mask? */
-                        if (q->qh->hw_info2 & cpu_to_hc32(ehci,
+                        if (hw->hw_info2 & cpu_to_hc32(ehci,
                                         1 << (8 + uframe)))
                                 usecs += q->qh->c_usecs;
-                        hw_p = &q->qh->hw_next;
+                        hw_p = &hw->hw_next;
                         q = &q->qh->qh_next;
                         break;
                 // case Q_TYPE_FSTN:
@@ -237,10 +254,10 @@ periodic_tt_usecs (
                         continue;
                 case Q_TYPE_QH:
                         if (same_tt(dev, q->qh->dev)) {
-                                uf = tt_start_uframe(ehci, q->qh->hw_info2);
+                                uf = tt_start_uframe(ehci, q->qh->hw->hw_info2);
                                 tt_usecs[uf] += q->qh->tt_usecs;
                         }
-                        hw_p = &q->qh->hw_next;
+                        hw_p = &q->qh->hw->hw_next;
                         q = &q->qh->qh_next;
                         continue;
                 case Q_TYPE_SITD:
@@ -375,6 +392,7 @@ static int tt_no_collision (
         for (; frame < ehci->periodic_size; frame += period) {
                 union ehci_shadow       here;
                 __hc32                  type;
+                struct ehci_qh_hw       *hw;
 
                 here = ehci->pshadow [frame];
                 type = Q_NEXT_TYPE(ehci, ehci->periodic [frame]);
@@ -385,17 +403,18 @@ static int tt_no_collision (
                                 here = here.itd->itd_next;
                                 continue;
                         case Q_TYPE_QH:
+                                hw = here.qh->hw;
                                 if (same_tt (dev, here.qh->dev)) {
                                         u32             mask;
 
                                         mask = hc32_to_cpu(ehci,
-                                                        here.qh->hw_info2);
+                                                        hw->hw_info2);
                                         /* "knows" no gap is needed */
                                         mask |= mask >> 8;
                                         if (mask & uf_mask)
                                                 break;
                                 }
-                                type = Q_NEXT_TYPE(ehci, here.qh->hw_next);
+                                type = Q_NEXT_TYPE(ehci, hw->hw_next);
                                 here = here.qh->qh_next;
                                 continue;
                         case Q_TYPE_SITD:
@@ -498,7 +517,8 @@ static int qh_link_periodic (struct ehci_hcd *ehci, struct ehci_qh *qh)
 
         dev_dbg (&qh->dev->dev,
                 "link qh%d-%04x/%p start %d [%d/%d us]\n",
-                period, hc32_to_cpup(ehci, &qh->hw_info2) & (QH_CMASK | QH_SMASK),
+                period, hc32_to_cpup(ehci, &qh->hw->hw_info2)
+                        & (QH_CMASK | QH_SMASK),
                 qh, qh->start, qh->usecs, qh->c_usecs);
 
         /* high bandwidth, or otherwise every microframe */
@@ -517,7 +537,7 @@ static int qh_link_periodic (struct ehci_hcd *ehci, struct ehci_qh *qh)
                         if (type == cpu_to_hc32(ehci, Q_TYPE_QH))
                                 break;
                         prev = periodic_next_shadow(ehci, prev, type);
-                        hw_p = &here.qh->hw_next;
+                        hw_p = shadow_next_periodic(ehci, &here, type);
                         here = *prev;
                 }
 
@@ -528,14 +548,14 @@ static int qh_link_periodic (struct ehci_hcd *ehci, struct ehci_qh *qh)
                         if (qh->period > here.qh->period)
                                 break;
                         prev = &here.qh->qh_next;
-                        hw_p = &here.qh->hw_next;
+                        hw_p = &here.qh->hw->hw_next;
                         here = *prev;
                 }
                 /* link in this qh, unless some earlier pass did that */
                 if (qh != here.qh) {
                         qh->qh_next = here;
                         if (here.qh)
-                                qh->hw_next = *hw_p;
+                                qh->hw->hw_next = *hw_p;
                         wmb ();
                         prev->qh = qh;
                         *hw_p = QH_NEXT (ehci, qh->qh_dma);
@@ -581,7 +601,7 @@ static int qh_unlink_periodic(struct ehci_hcd *ehci, struct ehci_qh *qh)
         dev_dbg (&qh->dev->dev,
                 "unlink qh%d-%04x/%p start %d [%d/%d us]\n",
                 qh->period,
-                hc32_to_cpup(ehci, &qh->hw_info2) & (QH_CMASK | QH_SMASK),
+                hc32_to_cpup(ehci, &qh->hw->hw_info2) & (QH_CMASK | QH_SMASK),
                 qh, qh->start, qh->usecs, qh->c_usecs);
 
         /* qh->qh_next still "live" to HC */
@@ -595,7 +615,19 @@ static int qh_unlink_periodic(struct ehci_hcd *ehci, struct ehci_qh *qh)
 
 static void intr_deschedule (struct ehci_hcd *ehci, struct ehci_qh *qh)
 {
-        unsigned        wait;
+        unsigned                wait;
+        struct ehci_qh_hw       *hw = qh->hw;
+        int                     rc;
+
+        /* If the QH isn't linked then there's nothing we can do
+         * unless we were called during a giveback, in which case
+         * qh_completions() has to deal with it.
+         */
+        if (qh->qh_state != QH_STATE_LINKED) {
+                if (qh->qh_state == QH_STATE_COMPLETING)
+                        qh->needs_rescan = 1;
+                return;
+        }
 
         qh_unlink_periodic (ehci, qh);
 
@@ -606,15 +638,33 @@ static void intr_deschedule (struct ehci_hcd *ehci, struct ehci_qh *qh)
          */
         if (list_empty (&qh->qtd_list)
                         || (cpu_to_hc32(ehci, QH_CMASK)
-                                        & qh->hw_info2) != 0)
+                                        & hw->hw_info2) != 0)
                 wait = 2;
         else
                 wait = 55;      /* worst case: 3 * 1024 */
 
         udelay (wait);
         qh->qh_state = QH_STATE_IDLE;
-        qh->hw_next = EHCI_LIST_END(ehci);
+        hw->hw_next = EHCI_LIST_END(ehci);
         wmb ();
+
+        qh_completions(ehci, qh);
+
+        /* reschedule QH iff another request is queued */
+        if (!list_empty(&qh->qtd_list) &&
+                        HC_IS_RUNNING(ehci_to_hcd(ehci)->state)) {
+                rc = qh_schedule(ehci, qh);
+
+                /* An error here likely indicates handshake failure
+                 * or no space left in the schedule.  Neither fault
+                 * should happen often ...
+                 *
+                 * FIXME kill the now-dysfunctional queued urbs
+                 */
+                if (rc != 0)
+                        ehci_err(ehci, "can't reschedule qh %p, err %d\n",
+                                        qh, rc);
+        }
 }
 
 /*-------------------------------------------------------------------------*/
@@ -739,14 +789,15 @@ static int qh_schedule(struct ehci_hcd *ehci, struct ehci_qh *qh)
         unsigned        uframe;
         __hc32          c_mask;
         unsigned        frame;          /* 0..(qh->period - 1), or NO_FRAME */
+        struct ehci_qh_hw       *hw = qh->hw;
 
         qh_refresh(ehci, qh);
-        qh->hw_next = EHCI_LIST_END(ehci);
+        hw->hw_next = EHCI_LIST_END(ehci);
         frame = qh->start;
 
         /* reuse the previous schedule slots, if we can */
         if (frame < qh->period) {
-                uframe = ffs(hc32_to_cpup(ehci, &qh->hw_info2) & QH_SMASK);
+                uframe = ffs(hc32_to_cpup(ehci, &hw->hw_info2) & QH_SMASK);
                 status = check_intr_schedule (ehci, frame, --uframe,
                                 qh, &c_mask);
         } else {
@@ -784,11 +835,11 @@ static int qh_schedule(struct ehci_hcd *ehci, struct ehci_qh *qh)
                 qh->start = frame;
 
                 /* reset S-frame and (maybe) C-frame masks */
-                qh->hw_info2 &= cpu_to_hc32(ehci, ~(QH_CMASK | QH_SMASK));
-                qh->hw_info2 |= qh->period
+                hw->hw_info2 &= cpu_to_hc32(ehci, ~(QH_CMASK | QH_SMASK));
+                hw->hw_info2 |= qh->period
                         ? cpu_to_hc32(ehci, 1 << uframe)
                         : cpu_to_hc32(ehci, QH_SMASK);
-                qh->hw_info2 |= c_mask;
+                hw->hw_info2 |= c_mask;
         } else
                 ehci_dbg (ehci, "reused qh %p schedule\n", qh);
 
@@ -2188,10 +2239,11 @@ restart:
                         case Q_TYPE_QH:
                                 /* handle any completions */
                                 temp.qh = qh_get (q.qh);
-                                type = Q_NEXT_TYPE(ehci, q.qh->hw_next);
+                                type = Q_NEXT_TYPE(ehci, q.qh->hw->hw_next);
                                 q = q.qh->qh_next;
                                 modified = qh_completions (ehci, temp.qh);
-                                if (unlikely (list_empty (&temp.qh->qtd_list)))
+                                if (unlikely(list_empty(&temp.qh->qtd_list) ||
+                                                temp.qh->needs_rescan))
                                         intr_deschedule (ehci, temp.qh);
                                 qh_put (temp.qh);
                                 break;
diff --git a/drivers/usb/host/ehci-w90x900.c b/drivers/usb/host/ehci-w90x900.c
new file mode 100644
index 000000000000..cfa21ea20f82
--- /dev/null
+++ b/drivers/usb/host/ehci-w90x900.c
@@ -0,0 +1,181 @@
+/*
+ * linux/driver/usb/host/ehci-w90x900.c
+ *
+ * Copyright (c) 2008 Nuvoton technology corporation.
+ *
+ * Wan ZongShun <mcuos.com@gmail.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation;version 2 of the License.
+ *
+ */
+
+#include <linux/platform_device.h>
+
+/*ebable phy0 and phy1 for w90p910*/
+#define ENPHY           (0x01<<8)
+#define PHY0_CTR        (0xA4)
+#define PHY1_CTR        (0xA8)
+
+static int __devinit usb_w90x900_probe(const struct hc_driver *driver,
+                      struct platform_device *pdev)
+{
+        struct usb_hcd *hcd;
+        struct ehci_hcd *ehci;
+        struct resource *res;
+        int retval = 0, irq;
+        unsigned long val;
+
+
+        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        if (!res) {
+                retval = -ENXIO;
+                goto err1;
+        }
+
+        hcd = usb_create_hcd(driver, &pdev->dev, "w90x900 EHCI");
+        if (!hcd) {
+                retval = -ENOMEM;
+                goto err1;
+        }
+
+        hcd->rsrc_start = res->start;
+        hcd->rsrc_len = res->end - res->start + 1;
+
+        if (!request_mem_region(hcd->rsrc_start, hcd->rsrc_len, hcd_name)) {
+                retval = -EBUSY;
+                goto err2;
+        }
+
+        hcd->regs = ioremap(hcd->rsrc_start, hcd->rsrc_len);
+        if (hcd->regs == NULL) {
+                retval = -EFAULT;
+                goto err3;
+        }
+
+        ehci = hcd_to_ehci(hcd);
+        ehci->caps = hcd->regs;
+        ehci->regs = hcd->regs +
+                 HC_LENGTH(ehci_readl(ehci, &ehci->caps->hc_capbase));
+
+        /* enable PHY 0,1,the regs only apply to w90p910
+        *  0xA4,0xA8 were offsets of PHY0 and PHY1 controller of
+        *  w90p910 IC relative to ehci->regs.
+        */
+        val = __raw_readl(ehci->regs+PHY0_CTR);
+        val |= ENPHY;
+        __raw_writel(val, ehci->regs+PHY0_CTR);
+
+        val = __raw_readl(ehci->regs+PHY1_CTR);
+        val |= ENPHY;
+        __raw_writel(val, ehci->regs+PHY1_CTR);
+
+        ehci->hcs_params = ehci_readl(ehci, &ehci->caps->hcs_params);
+        ehci->sbrn = 0x20;
+
+        irq = platform_get_irq(pdev, 0);
+        if (irq < 0)
+                goto err4;
+
+        retval = usb_add_hcd(hcd, irq, IRQF_SHARED);
+        if (retval != 0)
+                goto err4;
+
+        ehci_writel(ehci, 1, &ehci->regs->configured_flag);
+
+        return retval;
+err4:
+        iounmap(hcd->regs);
+err3:
+        release_mem_region(hcd->rsrc_start, hcd->rsrc_len);
+err2:
+        usb_put_hcd(hcd);
+err1:
+        return retval;
+}
+
+static
+void usb_w90x900_remove(struct usb_hcd *hcd, struct platform_device *pdev)
+{
+        usb_remove_hcd(hcd);
+        iounmap(hcd->regs);
+        release_mem_region(hcd->rsrc_start, hcd->rsrc_len);
+        usb_put_hcd(hcd);
+}
+
+static const struct hc_driver ehci_w90x900_hc_driver = {
+        .description = hcd_name,
+        .product_desc = "Nuvoton w90x900 EHCI Host Controller",
+        .hcd_priv_size = sizeof(struct ehci_hcd),
+
+        /*
+         * generic hardware linkage
+         */
+        .irq = ehci_irq,
+        .flags = HCD_USB2|HCD_MEMORY,
+
+        /*
+         * basic lifecycle operations
+         */
+        .reset = ehci_init,
+        .start = ehci_run,
+
+        .stop = ehci_stop,
+        .shutdown = ehci_shutdown,
+
+        /*
+         * managing i/o requests and associated device resources
+         */
+        .urb_enqueue = ehci_urb_enqueue,
+        .urb_dequeue = ehci_urb_dequeue,
+        .endpoint_disable = ehci_endpoint_disable,
+
+        /*
+         * scheduling support
+         */
+        .get_frame_number = ehci_get_frame,
+
+        /*
+         * root hub support
+         */
+        .hub_status_data = ehci_hub_status_data,
+        .hub_control = ehci_hub_control,
+#ifdef  CONFIG_PM
+        .bus_suspend = ehci_bus_suspend,
+        .bus_resume = ehci_bus_resume,
+#endif
+        .relinquish_port        = ehci_relinquish_port,
+        .port_handed_over       = ehci_port_handed_over,
+};
+
+static int __devinit ehci_w90x900_probe(struct platform_device *pdev)
+{
+        if (usb_disabled())
+                return -ENODEV;
+
+        return usb_w90x900_probe(&ehci_w90x900_hc_driver, pdev);
+}
+
+static int __devexit ehci_w90x900_remove(struct platform_device *pdev)
+{
+        struct usb_hcd *hcd = platform_get_drvdata(pdev);
+
+        usb_w90x900_remove(hcd, pdev);
+
+        return 0;
+}
+
+static struct platform_driver ehci_hcd_w90x900_driver = {
+        .probe  = ehci_w90x900_probe,
+        .remove = __devexit_p(ehci_w90x900_remove),
+        .driver = {
+                .name = "w90x900-ehci",
+                .owner = THIS_MODULE,
+        },
+};
+
+MODULE_AUTHOR("Wan ZongShun <mcuos.com@gmail.com>");
+MODULE_DESCRIPTION("w90p910 usb ehci driver!");
+MODULE_LICENSE("GPL");
+MODULE_ALIAS("platform:w90p910-ehci");
diff --git a/drivers/usb/host/ehci.h b/drivers/usb/host/ehci.h
index 2bfff30f4704..064e76821ff5 100644
--- a/drivers/usb/host/ehci.h
+++ b/drivers/usb/host/ehci.h
@@ -37,7 +37,7 @@ typedef __u16 __bitwise __hc16;
 #define __hc16  __le16
 #endif
 
-/* statistics can be kept for for tuning/monitoring */
+/* statistics can be kept for tuning/monitoring */
 struct ehci_stats {
         /* irq usage */
         unsigned long           normal;
@@ -126,6 +126,7 @@ struct ehci_hcd {			/* one per controller */
         unsigned                big_endian_mmio:1;
         unsigned                big_endian_desc:1;
         unsigned                has_amcc_usb23:1;
+        unsigned                need_io_watchdog:1;
 
         /* required for usb32 quirk */
         #define OHCI_CTRL_HCFS          (3 << 6)
@@ -135,6 +136,7 @@ struct ehci_hcd {			/* one per controller */
         #define OHCI_HCCTRL_OFFSET      0x4
         #define OHCI_HCCTRL_LEN         0x4
         __hc32                  *ohci_hcctrl_reg;
+        unsigned                has_hostpc:1;
 
         u8                      sbrn;           /* packed release number */
 
@@ -298,8 +300,8 @@ union ehci_shadow {
  * These appear in both the async and (for interrupt) periodic schedules.
  */
 
-struct ehci_qh {
-        /* first part defined by EHCI spec */
+/* first part defined by EHCI spec */
+struct ehci_qh_hw {
         __hc32                  hw_next;        /* see EHCI 3.6.1 */
         __hc32                  hw_info1;       /* see EHCI 3.6.2 */
 #define QH_HEAD         0x00008000
@@ -317,7 +319,10 @@ struct ehci_qh {
         __hc32                  hw_token;
         __hc32                  hw_buf [5];
         __hc32                  hw_buf_hi [5];
+} __attribute__ ((aligned(32)));
 
+struct ehci_qh {
+        struct ehci_qh_hw       *hw;
         /* the rest is HCD-private */
         dma_addr_t              qh_dma;         /* address of qh */
         union ehci_shadow       qh_next;        /* ptr to qh; or periodic */
@@ -336,6 +341,7 @@ struct ehci_qh {
         u32                     refcount;
         unsigned                stamp;
 
+        u8                      needs_rescan;   /* Dequeue during giveback */
         u8                      qh_state;
 #define QH_STATE_LINKED         1               /* HC sees this */
 #define QH_STATE_UNLINK         2               /* HC may still see this */
@@ -357,7 +363,7 @@ struct ehci_qh {
 
         struct usb_device       *dev;           /* access to TT */
         unsigned                clearing_tt:1;  /* Clear-TT-Buf in progress */
-} __attribute__ ((aligned (32)));
+};
 
 /*-------------------------------------------------------------------------*/
 
@@ -544,7 +550,7 @@ static inline unsigned int
 ehci_port_speed(struct ehci_hcd *ehci, unsigned int portsc)
 {
         if (ehci_is_TDI(ehci)) {
-                switch ((portsc>>26)&3) {
+                switch ((portsc >> (ehci->has_hostpc ? 25 : 26)) & 3) {
                 case 0:
                         return 0;
                 case 1:
diff --git a/drivers/usb/host/isp1362-hcd.c b/drivers/usb/host/isp1362-hcd.c
new file mode 100644
index 000000000000..e35d82808bab
--- /dev/null
+++ b/drivers/usb/host/isp1362-hcd.c
@@ -0,0 +1,2909 @@
+/*
+ * ISP1362 HCD (Host Controller Driver) for USB.
+ *
+ * Copyright (C) 2005 Lothar Wassmann <LW@KARO-electronics.de>
+ *
+ * Derived from the SL811 HCD, rewritten for ISP116x.
+ * Copyright (C) 2005 Olav Kongas <ok@artecdesign.ee>
+ *
+ * Portions:
+ * Copyright (C) 2004 Psion Teklogix (for NetBook PRO)
+ * Copyright (C) 2004 David Brownell
+ */
+
+/*
+ * The ISP1362 chip requires a large delay (300ns and 462ns) between
+ * accesses to the address and data register.
+ * The following timing options exist:
+ *
+ * 1. Configure your memory controller to add such delays if it can (the best)
+ * 2. Implement platform-specific delay function possibly
+ *    combined with configuring the memory controller; see
+ *    include/linux/usb_isp1362.h for more info.
+ * 3. Use ndelay (easiest, poorest).
+ *
+ * Use the corresponding macros USE_PLATFORM_DELAY and USE_NDELAY in the
+ * platform specific section of isp1362.h to select the appropriate variant.
+ *
+ * Also note that according to the Philips "ISP1362 Errata" document
+ * Rev 1.00 from 27 May data corruption may occur when the #WR signal
+ * is reasserted (even with #CS deasserted) within 132ns after a
+ * write cycle to any controller register. If the hardware doesn't
+ * implement the recommended fix (gating the #WR with #CS) software
+ * must ensure that no further write cycle (not necessarily to the chip!)
+ * is issued by the CPU within this interval.
+
+ * For PXA25x this can be ensured by using VLIO with the maximum
+ * recovery time (MSCx = 0x7f8c) with a memory clock of 99.53 MHz.
+ */
+
+#ifdef CONFIG_USB_DEBUG
+# define ISP1362_DEBUG
+#else
+# undef ISP1362_DEBUG
+#endif
+
+/*
+ * The PXA255 UDC apparently doesn't handle GET_STATUS, GET_CONFIG and
+ * GET_INTERFACE requests correctly when the SETUP and DATA stages of the
+ * requests are carried out in separate frames. This will delay any SETUP
+ * packets until the start of the next frame so that this situation is
+ * unlikely to occur (and makes usbtest happy running with a PXA255 target
+ * device).
+ */
+#undef BUGGY_PXA2XX_UDC_USBTEST
+
+#undef PTD_TRACE
+#undef URB_TRACE
+#undef VERBOSE
+#undef REGISTERS
+
+/* This enables a memory test on the ISP1362 chip memory to make sure the
+ * chip access timing is correct.
+ */
+#undef CHIP_BUFFER_TEST
+
+#include <linux/module.h>
+#include <linux/moduleparam.h>
+#include <linux/kernel.h>
+#include <linux/delay.h>
+#include <linux/ioport.h>
+#include <linux/sched.h>
+#include <linux/slab.h>
+#include <linux/smp_lock.h>
+#include <linux/errno.h>
+#include <linux/init.h>
+#include <linux/list.h>
+#include <linux/interrupt.h>
+#include <linux/usb.h>
+#include <linux/usb/isp1362.h>
+#include <linux/platform_device.h>
+#include <linux/pm.h>
+#include <linux/io.h>
+#include <linux/bitops.h>
+
+#include <asm/irq.h>
+#include <asm/system.h>
+#include <asm/byteorder.h>
+#include <asm/unaligned.h>
+
+static int dbg_level;
+#ifdef ISP1362_DEBUG
+module_param(dbg_level, int, 0644);
+#else
+module_param(dbg_level, int, 0);
+#define STUB_DEBUG_FILE
+#endif
+
+#include "../core/hcd.h"
+#include "../core/usb.h"
+#include "isp1362.h"
+
+
+#define DRIVER_VERSION  "2005-04-04"
+#define DRIVER_DESC     "ISP1362 USB Host Controller Driver"
+
+MODULE_DESCRIPTION(DRIVER_DESC);
+MODULE_LICENSE("GPL");
+
+static const char hcd_name[] = "isp1362-hcd";
+
+static void isp1362_hc_stop(struct usb_hcd *hcd);
+static int isp1362_hc_start(struct usb_hcd *hcd);
+
+/*-------------------------------------------------------------------------*/
+
+/*
+ * When called from the interrupthandler only isp1362_hcd->irqenb is modified,
+ * since the interrupt handler will write isp1362_hcd->irqenb to HCuPINT upon
+ * completion.
+ * We don't need a 'disable' counterpart, since interrupts will be disabled
+ * only by the interrupt handler.
+ */
+static inline void isp1362_enable_int(struct isp1362_hcd *isp1362_hcd, u16 mask)
+{
+        if ((isp1362_hcd->irqenb | mask) == isp1362_hcd->irqenb)
+                return;
+        if (mask & ~isp1362_hcd->irqenb)
+                isp1362_write_reg16(isp1362_hcd, HCuPINT, mask & ~isp1362_hcd->irqenb);
+        isp1362_hcd->irqenb |= mask;
+        if (isp1362_hcd->irq_active)
+                return;
+        isp1362_write_reg16(isp1362_hcd, HCuPINTENB, isp1362_hcd->irqenb);
+}
+
+/*-------------------------------------------------------------------------*/
+
+static inline struct isp1362_ep_queue *get_ptd_queue(struct isp1362_hcd *isp1362_hcd,
+                                                     u16 offset)
+{
+        struct isp1362_ep_queue *epq = NULL;
+
+        if (offset < isp1362_hcd->istl_queue[1].buf_start)
+                epq = &isp1362_hcd->istl_queue[0];
+        else if (offset < isp1362_hcd->intl_queue.buf_start)
+                epq = &isp1362_hcd->istl_queue[1];
+        else if (offset < isp1362_hcd->atl_queue.buf_start)
+                epq = &isp1362_hcd->intl_queue;
+        else if (offset < isp1362_hcd->atl_queue.buf_start +
+                   isp1362_hcd->atl_queue.buf_size)
+                epq = &isp1362_hcd->atl_queue;
+
+        if (epq)
+                DBG(1, "%s: PTD $%04x is on %s queue\n", __func__, offset, epq->name);
+        else
+                pr_warning("%s: invalid PTD $%04x\n", __func__, offset);
+
+        return epq;
+}
+
+static inline int get_ptd_offset(struct isp1362_ep_queue *epq, u8 index)
+{
+        int offset;
+
+        if (index * epq->blk_size > epq->buf_size) {
+                pr_warning("%s: Bad %s index %d(%d)\n", __func__, epq->name, index,
+                     epq->buf_size / epq->blk_size);
+                return -EINVAL;
+        }
+        offset = epq->buf_start + index * epq->blk_size;
+        DBG(3, "%s: %s PTD[%02x] # %04x\n", __func__, epq->name, index, offset);
+
+        return offset;
+}
+
+/*-------------------------------------------------------------------------*/
+
+static inline u16 max_transfer_size(struct isp1362_ep_queue *epq, size_t size,
+                                    int mps)
+{
+        u16 xfer_size = min_t(size_t, MAX_XFER_SIZE, size);
+
+        xfer_size = min_t(size_t, xfer_size, epq->buf_avail * epq->blk_size - PTD_HEADER_SIZE);
+        if (xfer_size < size && xfer_size % mps)
+                xfer_size -= xfer_size % mps;
+
+        return xfer_size;
+}
+
+static int claim_ptd_buffers(struct isp1362_ep_queue *epq,
+                             struct isp1362_ep *ep, u16 len)
+{
+        int ptd_offset = -EINVAL;
+        int index;
+        int num_ptds = ((len + PTD_HEADER_SIZE - 1) / epq->blk_size) + 1;
+        int found = -1;
+        int last = -1;
+
+        BUG_ON(len > epq->buf_size);
+
+        if (!epq->buf_avail)
+                return -ENOMEM;
+
+        if (ep->num_ptds)
+                pr_err("%s: %s len %d/%d num_ptds %d buf_map %08lx skip_map %08lx\n", __func__,
+                    epq->name, len, epq->blk_size, num_ptds, epq->buf_map, epq->skip_map);
+        BUG_ON(ep->num_ptds != 0);
+
+        for (index = 0; index <= epq->buf_count - num_ptds; index++) {
+                if (test_bit(index, &epq->buf_map))
+                        continue;
+                found = index;
+                for (last = index + 1; last < index + num_ptds; last++) {
+                        if (test_bit(last, &epq->buf_map)) {
+                                found = -1;
+                                break;
+                        }
+                }
+                if (found >= 0)
+                        break;
+        }
+        if (found < 0)
+                return -EOVERFLOW;
+
+        DBG(1, "%s: Found %d PTDs[%d] for %d/%d byte\n", __func__,
+            num_ptds, found, len, (int)(epq->blk_size - PTD_HEADER_SIZE));
+        ptd_offset = get_ptd_offset(epq, found);
+        WARN_ON(ptd_offset < 0);
+        ep->ptd_offset = ptd_offset;
+        ep->num_ptds += num_ptds;
+        epq->buf_avail -= num_ptds;
+        BUG_ON(epq->buf_avail > epq->buf_count);
+        ep->ptd_index = found;
+        for (index = found; index < last; index++)
+                __set_bit(index, &epq->buf_map);
+        DBG(1, "%s: Done %s PTD[%d] $%04x, avail %d count %d claimed %d %08lx:%08lx\n",
+            __func__, epq->name, ep->ptd_index, ep->ptd_offset,
+            epq->buf_avail, epq->buf_count, num_ptds, epq->buf_map, epq->skip_map);
+
+        return found;
+}
+
+static inline void release_ptd_buffers(struct isp1362_ep_queue *epq, struct isp1362_ep *ep)
+{
+        int index = ep->ptd_index;
+        int last = ep->ptd_index + ep->num_ptds;
+
+        if (last > epq->buf_count)
+                pr_err("%s: ep %p req %d len %d %s PTD[%d] $%04x num_ptds %d buf_count %d buf_avail %d buf_map %08lx skip_map %08lx\n",
+                    __func__, ep, ep->num_req, ep->length, epq->name, ep->ptd_index,
+                    ep->ptd_offset, ep->num_ptds, epq->buf_count, epq->buf_avail,
+                    epq->buf_map, epq->skip_map);
+        BUG_ON(last > epq->buf_count);
+
+        for (; index < last; index++) {
+                __clear_bit(index, &epq->buf_map);
+                __set_bit(index, &epq->skip_map);
+        }
+        epq->buf_avail += ep->num_ptds;
+        epq->ptd_count--;
+
+        BUG_ON(epq->buf_avail > epq->buf_count);
+        BUG_ON(epq->ptd_count > epq->buf_count);
+
+        DBG(1, "%s: Done %s PTDs $%04x released %d avail %d count %d\n",
+            __func__, epq->name,
+            ep->ptd_offset, ep->num_ptds, epq->buf_avail, epq->buf_count);
+        DBG(1, "%s: buf_map %08lx skip_map %08lx\n", __func__,
+            epq->buf_map, epq->skip_map);
+
+        ep->num_ptds = 0;
+        ep->ptd_offset = -EINVAL;
+        ep->ptd_index = -EINVAL;
+}
+
+/*-------------------------------------------------------------------------*/
+
+/*
+  Set up PTD's.
+*/
+static void prepare_ptd(struct isp1362_hcd *isp1362_hcd, struct urb *urb,
+                        struct isp1362_ep *ep, struct isp1362_ep_queue *epq,
+                        u16 fno)
+{
+        struct ptd *ptd;
+        int toggle;
+        int dir;
+        u16 len;
+        size_t buf_len = urb->transfer_buffer_length - urb->actual_length;
+
+        DBG(3, "%s: %s ep %p\n", __func__, epq->name, ep);
+
+        ptd = &ep->ptd;
+
+        ep->data = (unsigned char *)urb->transfer_buffer + urb->actual_length;
+
+        switch (ep->nextpid) {
+        case USB_PID_IN:
+                toggle = usb_gettoggle(urb->dev, ep->epnum, 0);
+                dir = PTD_DIR_IN;
+                if (usb_pipecontrol(urb->pipe)) {
+                        len = min_t(size_t, ep->maxpacket, buf_len);
+                } else if (usb_pipeisoc(urb->pipe)) {
+                        len = min_t(size_t, urb->iso_frame_desc[fno].length, MAX_XFER_SIZE);
+                        ep->data = urb->transfer_buffer + urb->iso_frame_desc[fno].offset;
+                } else
+                        len = max_transfer_size(epq, buf_len, ep->maxpacket);
+                DBG(1, "%s: IN    len %d/%d/%d from URB\n", __func__, len, ep->maxpacket,
+                    (int)buf_len);
+                break;
+        case USB_PID_OUT:
+                toggle = usb_gettoggle(urb->dev, ep->epnum, 1);
+                dir = PTD_DIR_OUT;
+                if (usb_pipecontrol(urb->pipe))
+                        len = min_t(size_t, ep->maxpacket, buf_len);
+                else if (usb_pipeisoc(urb->pipe))
+                        len = min_t(size_t, urb->iso_frame_desc[0].length, MAX_XFER_SIZE);
+                else
+                        len = max_transfer_size(epq, buf_len, ep->maxpacket);
+                if (len == 0)
+                        pr_info("%s: Sending ZERO packet: %d\n", __func__,
+                             urb->transfer_flags & URB_ZERO_PACKET);
+                DBG(1, "%s: OUT   len %d/%d/%d from URB\n", __func__, len, ep->maxpacket,
+                    (int)buf_len);
+                break;
+        case USB_PID_SETUP:
+                toggle = 0;
+                dir = PTD_DIR_SETUP;
+                len = sizeof(struct usb_ctrlrequest);
+                DBG(1, "%s: SETUP len %d\n", __func__, len);
+                ep->data = urb->setup_packet;
+                break;
+        case USB_PID_ACK:
+                toggle = 1;
+                len = 0;
+                dir = (urb->transfer_buffer_length && usb_pipein(urb->pipe)) ?
+                        PTD_DIR_OUT : PTD_DIR_IN;
+                DBG(1, "%s: ACK   len %d\n", __func__, len);
+                break;
+        default:
+                toggle = dir = len = 0;
+                pr_err("%s@%d: ep->nextpid %02x\n", __func__, __LINE__, ep->nextpid);
+                BUG_ON(1);
+        }
+
+        ep->length = len;
+        if (!len)
+                ep->data = NULL;
+
+        ptd->count = PTD_CC_MSK | PTD_ACTIVE_MSK | PTD_TOGGLE(toggle);
+        ptd->mps = PTD_MPS(ep->maxpacket) | PTD_SPD(urb->dev->speed == USB_SPEED_LOW) |
+                PTD_EP(ep->epnum);
+        ptd->len = PTD_LEN(len) | PTD_DIR(dir);
+        ptd->faddr = PTD_FA(usb_pipedevice(urb->pipe));
+
+        if (usb_pipeint(urb->pipe)) {
+                ptd->faddr |= PTD_SF_INT(ep->branch);
+                ptd->faddr |= PTD_PR(ep->interval ? __ffs(ep->interval) : 0);
+        }
+        if (usb_pipeisoc(urb->pipe))
+                ptd->faddr |= PTD_SF_ISO(fno);
+
+        DBG(1, "%s: Finished\n", __func__);
+}
+
+static void isp1362_write_ptd(struct isp1362_hcd *isp1362_hcd, struct isp1362_ep *ep,
+                              struct isp1362_ep_queue *epq)
+{
+        struct ptd *ptd = &ep->ptd;
+        int len = PTD_GET_DIR(ptd) == PTD_DIR_IN ? 0 : ep->length;
+
+        _BUG_ON(ep->ptd_offset < 0);
+
+        prefetch(ptd);
+        isp1362_write_buffer(isp1362_hcd, ptd, ep->ptd_offset, PTD_HEADER_SIZE);
+        if (len)
+                isp1362_write_buffer(isp1362_hcd, ep->data,
+                                     ep->ptd_offset + PTD_HEADER_SIZE, len);
+
+        dump_ptd(ptd);
+        dump_ptd_out_data(ptd, ep->data);
+}
+
+static void isp1362_read_ptd(struct isp1362_hcd *isp1362_hcd, struct isp1362_ep *ep,
+                             struct isp1362_ep_queue *epq)
+{
+        struct ptd *ptd = &ep->ptd;
+        int act_len;
+
+        WARN_ON(list_empty(&ep->active));
+        BUG_ON(ep->ptd_offset < 0);
+
+        list_del_init(&ep->active);
+        DBG(1, "%s: ep %p removed from active list %p\n", __func__, ep, &epq->active);
+
+        prefetchw(ptd);
+        isp1362_read_buffer(isp1362_hcd, ptd, ep->ptd_offset, PTD_HEADER_SIZE);
+        dump_ptd(ptd);
+        act_len = PTD_GET_COUNT(ptd);
+        if (PTD_GET_DIR(ptd) != PTD_DIR_IN || act_len == 0)
+                return;
+        if (act_len > ep->length)
+                pr_err("%s: ep %p PTD $%04x act_len %d ep->length %d\n", __func__, ep,
+                         ep->ptd_offset, act_len, ep->length);
+        BUG_ON(act_len > ep->length);
+        /* Only transfer the amount of data that has actually been overwritten
+         * in the chip buffer. We don't want any data that doesn't belong to the
+         * transfer to leak out of the chip to the callers transfer buffer!
+         */
+        prefetchw(ep->data);
+        isp1362_read_buffer(isp1362_hcd, ep->data,
+                            ep->ptd_offset + PTD_HEADER_SIZE, act_len);
+        dump_ptd_in_data(ptd, ep->data);
+}
+
+/*
+ * INT PTDs will stay in the chip until data is available.
+ * This function will remove a PTD from the chip when the URB is dequeued.
+ * Must be called with the spinlock held and IRQs disabled
+ */
+static void remove_ptd(struct isp1362_hcd *isp1362_hcd, struct isp1362_ep *ep)
+
+{
+        int index;
+        struct isp1362_ep_queue *epq;
+
+        DBG(1, "%s: ep %p PTD[%d] $%04x\n", __func__, ep, ep->ptd_index, ep->ptd_offset);
+        BUG_ON(ep->ptd_offset < 0);
+
+        epq = get_ptd_queue(isp1362_hcd, ep->ptd_offset);
+        BUG_ON(!epq);
+
+        /* put ep in remove_list for cleanup */
+        WARN_ON(!list_empty(&ep->remove_list));
+        list_add_tail(&ep->remove_list, &isp1362_hcd->remove_list);
+        /* let SOF interrupt handle the cleanup */
+        isp1362_enable_int(isp1362_hcd, HCuPINT_SOF);
+
+        index = ep->ptd_index;
+        if (index < 0)
+                /* ISO queues don't have SKIP registers */
+                return;
+
+        DBG(1, "%s: Disabling PTD[%02x] $%04x %08lx|%08x\n", __func__,
+            index, ep->ptd_offset, epq->skip_map, 1 << index);
+
+        /* prevent further processing of PTD (will be effective after next SOF) */
+        epq->skip_map |= 1 << index;
+        if (epq == &isp1362_hcd->atl_queue) {
+                DBG(2, "%s: ATLSKIP = %08x -> %08lx\n", __func__,
+                    isp1362_read_reg32(isp1362_hcd, HCATLSKIP), epq->skip_map);
+                isp1362_write_reg32(isp1362_hcd, HCATLSKIP, epq->skip_map);
+                if (~epq->skip_map == 0)
+                        isp1362_clr_mask16(isp1362_hcd, HCBUFSTAT, HCBUFSTAT_ATL_ACTIVE);
+        } else if (epq == &isp1362_hcd->intl_queue) {
+                DBG(2, "%s: INTLSKIP = %08x -> %08lx\n", __func__,
+                    isp1362_read_reg32(isp1362_hcd, HCINTLSKIP), epq->skip_map);
+                isp1362_write_reg32(isp1362_hcd, HCINTLSKIP, epq->skip_map);
+                if (~epq->skip_map == 0)
+                        isp1362_clr_mask16(isp1362_hcd, HCBUFSTAT, HCBUFSTAT_INTL_ACTIVE);
+        }
+}
+
+/*
+  Take done or failed requests out of schedule. Give back
+  processed urbs.
+*/
+static void finish_request(struct isp1362_hcd *isp1362_hcd, struct isp1362_ep *ep,
+                           struct urb *urb, int status)
+     __releases(isp1362_hcd->lock)
+     __acquires(isp1362_hcd->lock)
+{
+        urb->hcpriv = NULL;
+        ep->error_count = 0;
+
+        if (usb_pipecontrol(urb->pipe))
+                ep->nextpid = USB_PID_SETUP;
+
+        URB_DBG("%s: req %d FA %d ep%d%s %s: len %d/%d %s stat %d\n", __func__,
+                ep->num_req, usb_pipedevice(urb->pipe),
+                usb_pipeendpoint(urb->pipe),
+                !usb_pipein(urb->pipe) ? "out" : "in",
+                usb_pipecontrol(urb->pipe) ? "ctrl" :
+                        usb_pipeint(urb->pipe) ? "int" :
+                        usb_pipebulk(urb->pipe) ? "bulk" :
+                        "iso",
+                urb->actual_length, urb->transfer_buffer_length,
+                !(urb->transfer_flags & URB_SHORT_NOT_OK) ?
+                "short_ok" : "", urb->status);
+
+
+        usb_hcd_unlink_urb_from_ep(isp1362_hcd_to_hcd(isp1362_hcd), urb);
+        spin_unlock(&isp1362_hcd->lock);
+        usb_hcd_giveback_urb(isp1362_hcd_to_hcd(isp1362_hcd), urb, status);
+        spin_lock(&isp1362_hcd->lock);
+
+        /* take idle endpoints out of the schedule right away */
+        if (!list_empty(&ep->hep->urb_list))
+                return;
+
+        /* async deschedule */
+        if (!list_empty(&ep->schedule)) {
+                list_del_init(&ep->schedule);
+                return;
+        }
+
+
+        if (ep->interval) {
+                /* periodic deschedule */
+                DBG(1, "deschedule qh%d/%p branch %d load %d bandwidth %d -> %d\n", ep->interval,
+                    ep, ep->branch, ep->load,
+                    isp1362_hcd->load[ep->branch],
+                    isp1362_hcd->load[ep->branch] - ep->load);
+                isp1362_hcd->load[ep->branch] -= ep->load;
+                ep->branch = PERIODIC_SIZE;
+        }
+}
+
+/*
+ * Analyze transfer results, handle partial transfers and errors
+*/
+static void postproc_ep(struct isp1362_hcd *isp1362_hcd, struct isp1362_ep *ep)
+{
+        struct urb *urb = get_urb(ep);
+        struct usb_device *udev;
+        struct ptd *ptd;
+        int short_ok;
+        u16 len;
+        int urbstat = -EINPROGRESS;
+        u8 cc;
+
+        DBG(2, "%s: ep %p req %d\n", __func__, ep, ep->num_req);
+
+        udev = urb->dev;
+        ptd = &ep->ptd;
+        cc = PTD_GET_CC(ptd);
+        if (cc == PTD_NOTACCESSED) {
+                pr_err("%s: req %d PTD %p Untouched by ISP1362\n", __func__,
+                    ep->num_req, ptd);
+                cc = PTD_DEVNOTRESP;
+        }
+
+        short_ok = !(urb->transfer_flags & URB_SHORT_NOT_OK);
+        len = urb->transfer_buffer_length - urb->actual_length;
+
+        /* Data underrun is special. For allowed underrun
+           we clear the error and continue as normal. For
+           forbidden underrun we finish the DATA stage
+           immediately while for control transfer,
+           we do a STATUS stage.
+        */
+        if (cc == PTD_DATAUNDERRUN) {
+                if (short_ok) {
+                        DBG(1, "%s: req %d Allowed data underrun short_%sok %d/%d/%d byte\n",
+                            __func__, ep->num_req, short_ok ? "" : "not_",
+                            PTD_GET_COUNT(ptd), ep->maxpacket, len);
+                        cc = PTD_CC_NOERROR;
+                        urbstat = 0;
+                } else {
+                        DBG(1, "%s: req %d Data Underrun %s nextpid %02x short_%sok %d/%d/%d byte\n",
+                            __func__, ep->num_req,
+                            usb_pipein(urb->pipe) ? "IN" : "OUT", ep->nextpid,
+                            short_ok ? "" : "not_",
+                            PTD_GET_COUNT(ptd), ep->maxpacket, len);
+                        if (usb_pipecontrol(urb->pipe)) {
+                                ep->nextpid = USB_PID_ACK;
+                                /* save the data underrun error code for later and
+                                 * procede with the status stage
+                                 */
+                                urb->actual_length += PTD_GET_COUNT(ptd);
+                                BUG_ON(urb->actual_length > urb->transfer_buffer_length);
+
+                                if (urb->status == -EINPROGRESS)
+                                        urb->status = cc_to_error[PTD_DATAUNDERRUN];
+                        } else {
+                                usb_settoggle(udev, ep->epnum, ep->nextpid == USB_PID_OUT,
+                                              PTD_GET_TOGGLE(ptd));
+                                urbstat = cc_to_error[PTD_DATAUNDERRUN];
+                        }
+                        goto out;
+                }
+        }
+
+        if (cc != PTD_CC_NOERROR) {
+                if (++ep->error_count >= 3 || cc == PTD_CC_STALL || cc == PTD_DATAOVERRUN) {
+                        urbstat = cc_to_error[cc];
+                        DBG(1, "%s: req %d nextpid %02x, status %d, error %d, error_count %d\n",
+                            __func__, ep->num_req, ep->nextpid, urbstat, cc,
+                            ep->error_count);
+                }
+                goto out;
+        }
+
+        switch (ep->nextpid) {
+        case USB_PID_OUT:
+                if (PTD_GET_COUNT(ptd) != ep->length)
+                        pr_err("%s: count=%d len=%d\n", __func__,
+                           PTD_GET_COUNT(ptd), ep->length);
+                BUG_ON(PTD_GET_COUNT(ptd) != ep->length);
+                urb->actual_length += ep->length;
+                BUG_ON(urb->actual_length > urb->transfer_buffer_length);
+                usb_settoggle(udev, ep->epnum, 1, PTD_GET_TOGGLE(ptd));
+                if (urb->actual_length == urb->transfer_buffer_length) {
+                        DBG(3, "%s: req %d xfer complete %d/%d status %d -> 0\n", __func__,
+                            ep->num_req, len, ep->maxpacket, urbstat);
+                        if (usb_pipecontrol(urb->pipe)) {
+                                DBG(3, "%s: req %d %s Wait for ACK\n", __func__,
+                                    ep->num_req,
+                                    usb_pipein(urb->pipe) ? "IN" : "OUT");
+                                ep->nextpid = USB_PID_ACK;
+                        } else {
+                                if (len % ep->maxpacket ||
+                                    !(urb->transfer_flags & URB_ZERO_PACKET)) {
+                                        urbstat = 0;
+                                        DBG(3, "%s: req %d URB %s status %d count %d/%d/%d\n",
+                                            __func__, ep->num_req, usb_pipein(urb->pipe) ? "IN" : "OUT",
+                                            urbstat, len, ep->maxpacket, urb->actual_length);
+                                }
+                        }
+                }
+                break;
+        case USB_PID_IN:
+                len = PTD_GET_COUNT(ptd);
+                BUG_ON(len > ep->length);
+                urb->actual_length += len;
+                BUG_ON(urb->actual_length > urb->transfer_buffer_length);
+                usb_settoggle(udev, ep->epnum, 0, PTD_GET_TOGGLE(ptd));
+                /* if transfer completed or (allowed) data underrun */
+                if ((urb->transfer_buffer_length == urb->actual_length) ||
+                    len % ep->maxpacket) {
+                        DBG(3, "%s: req %d xfer complete %d/%d status %d -> 0\n", __func__,
+                            ep->num_req, len, ep->maxpacket, urbstat);
+                        if (usb_pipecontrol(urb->pipe)) {
+                                DBG(3, "%s: req %d %s Wait for ACK\n", __func__,
+                                    ep->num_req,
+                                    usb_pipein(urb->pipe) ? "IN" : "OUT");
+                                ep->nextpid = USB_PID_ACK;
+                        } else {
+                                urbstat = 0;
+                                DBG(3, "%s: req %d URB %s status %d count %d/%d/%d\n",
+                                    __func__, ep->num_req, usb_pipein(urb->pipe) ? "IN" : "OUT",
+                                    urbstat, len, ep->maxpacket, urb->actual_length);
+                        }
+                }
+                break;
+        case USB_PID_SETUP:
+                if (urb->transfer_buffer_length == urb->actual_length) {
+                        ep->nextpid = USB_PID_ACK;
+                } else if (usb_pipeout(urb->pipe)) {
+                        usb_settoggle(udev, 0, 1, 1);
+                        ep->nextpid = USB_PID_OUT;
+                } else {
+                        usb_settoggle(udev, 0, 0, 1);
+                        ep->nextpid = USB_PID_IN;
+                }
+                break;
+        case USB_PID_ACK:
+                DBG(3, "%s: req %d got ACK %d -> 0\n", __func__, ep->num_req,
+                    urbstat);
+                WARN_ON(urbstat != -EINPROGRESS);
+                urbstat = 0;
+                ep->nextpid = 0;
+                break;
+        default:
+                BUG_ON(1);
+        }
+
+ out:
+        if (urbstat != -EINPROGRESS) {
+                DBG(2, "%s: Finishing ep %p req %d urb %p status %d\n", __func__,
+                    ep, ep->num_req, urb, urbstat);
+                finish_request(isp1362_hcd, ep, urb, urbstat);
+        }
+}
+
+static void finish_unlinks(struct isp1362_hcd *isp1362_hcd)
+{
+        struct isp1362_ep *ep;
+        struct isp1362_ep *tmp;
+
+        list_for_each_entry_safe(ep, tmp, &isp1362_hcd->remove_list, remove_list) {
+                struct isp1362_ep_queue *epq =
+                        get_ptd_queue(isp1362_hcd, ep->ptd_offset);
+                int index = ep->ptd_index;
+
+                BUG_ON(epq == NULL);
+                if (index >= 0) {
+                        DBG(1, "%s: remove PTD[%d] $%04x\n", __func__, index, ep->ptd_offset);
+                        BUG_ON(ep->num_ptds == 0);
+                        release_ptd_buffers(epq, ep);
+                }
+                if (!list_empty(&ep->hep->urb_list)) {
+                        struct urb *urb = get_urb(ep);
+
+                        DBG(1, "%s: Finishing req %d ep %p from remove_list\n", __func__,
+                            ep->num_req, ep);
+                        finish_request(isp1362_hcd, ep, urb, -ESHUTDOWN);
+                }
+                WARN_ON(list_empty(&ep->active));
+                if (!list_empty(&ep->active)) {
+                        list_del_init(&ep->active);
+                        DBG(1, "%s: ep %p removed from active list\n", __func__, ep);
+                }
+                list_del_init(&ep->remove_list);
+                DBG(1, "%s: ep %p removed from remove_list\n", __func__, ep);
+        }
+        DBG(1, "%s: Done\n", __func__);
+}
+
+static inline void enable_atl_transfers(struct isp1362_hcd *isp1362_hcd, int count)
+{
+        if (count > 0) {
+                if (count < isp1362_hcd->atl_queue.ptd_count)
+                        isp1362_write_reg16(isp1362_hcd, HCATLDTC, count);
+                isp1362_enable_int(isp1362_hcd, HCuPINT_ATL);
+                isp1362_write_reg32(isp1362_hcd, HCATLSKIP, isp1362_hcd->atl_queue.skip_map);
+                isp1362_set_mask16(isp1362_hcd, HCBUFSTAT, HCBUFSTAT_ATL_ACTIVE);
+        } else
+                isp1362_enable_int(isp1362_hcd, HCuPINT_SOF);
+}
+
+static inline void enable_intl_transfers(struct isp1362_hcd *isp1362_hcd)
+{
+        isp1362_enable_int(isp1362_hcd, HCuPINT_INTL);
+        isp1362_set_mask16(isp1362_hcd, HCBUFSTAT, HCBUFSTAT_INTL_ACTIVE);
+        isp1362_write_reg32(isp1362_hcd, HCINTLSKIP, isp1362_hcd->intl_queue.skip_map);
+}
+
+static inline void enable_istl_transfers(struct isp1362_hcd *isp1362_hcd, int flip)
+{
+        isp1362_enable_int(isp1362_hcd, flip ? HCuPINT_ISTL1 : HCuPINT_ISTL0);
+        isp1362_set_mask16(isp1362_hcd, HCBUFSTAT, flip ?
+                           HCBUFSTAT_ISTL1_FULL : HCBUFSTAT_ISTL0_FULL);
+}
+
+static int submit_req(struct isp1362_hcd *isp1362_hcd, struct urb *urb,
+                      struct isp1362_ep *ep, struct isp1362_ep_queue *epq)
+{
+        int index = epq->free_ptd;
+
+        prepare_ptd(isp1362_hcd, urb, ep, epq, 0);
+        index = claim_ptd_buffers(epq, ep, ep->length);
+        if (index == -ENOMEM) {
+                DBG(1, "%s: req %d No free %s PTD available: %d, %08lx:%08lx\n", __func__,
+                    ep->num_req, epq->name, ep->num_ptds, epq->buf_map, epq->skip_map);
+                return index;
+        } else if (index == -EOVERFLOW) {
+                DBG(1, "%s: req %d Not enough space for %d byte %s PTD %d %08lx:%08lx\n",
+                    __func__, ep->num_req, ep->length, epq->name, ep->num_ptds,
+                    epq->buf_map, epq->skip_map);
+                return index;
+        } else
+                BUG_ON(index < 0);
+        list_add_tail(&ep->active, &epq->active);
+        DBG(1, "%s: ep %p req %d len %d added to active list %p\n", __func__,
+            ep, ep->num_req, ep->length, &epq->active);
+        DBG(1, "%s: Submitting %s PTD $%04x for ep %p req %d\n", __func__, epq->name,
+            ep->ptd_offset, ep, ep->num_req);
+        isp1362_write_ptd(isp1362_hcd, ep, epq);
+        __clear_bit(ep->ptd_index, &epq->skip_map);
+
+        return 0;
+}
+
+static void start_atl_transfers(struct isp1362_hcd *isp1362_hcd)
+{
+        int ptd_count = 0;
+        struct isp1362_ep_queue *epq = &isp1362_hcd->atl_queue;
+        struct isp1362_ep *ep;
+        int defer = 0;
+
+        if (atomic_read(&epq->finishing)) {
+                DBG(1, "%s: finish_transfers is active for %s\n", __func__, epq->name);
+                return;
+        }
+
+        list_for_each_entry(ep, &isp1362_hcd->async, schedule) {
+                struct urb *urb = get_urb(ep);
+                int ret;
+
+                if (!list_empty(&ep->active)) {
+                        DBG(2, "%s: Skipping active %s ep %p\n", __func__, epq->name, ep);
+                        continue;
+                }
+
+                DBG(1, "%s: Processing %s ep %p req %d\n", __func__, epq->name,
+                    ep, ep->num_req);
+
+                ret = submit_req(isp1362_hcd, urb, ep, epq);
+                if (ret == -ENOMEM) {
+                        defer = 1;
+                        break;
+                } else if (ret == -EOVERFLOW) {
+                        defer = 1;
+                        continue;
+                }
+#ifdef BUGGY_PXA2XX_UDC_USBTEST
+                defer = ep->nextpid == USB_PID_SETUP;
+#endif
+                ptd_count++;
+        }
+
+        /* Avoid starving of endpoints */
+        if (isp1362_hcd->async.next != isp1362_hcd->async.prev) {
+                DBG(2, "%s: Cycling ASYNC schedule %d\n", __func__, ptd_count);
+                list_move(&isp1362_hcd->async, isp1362_hcd->async.next);
+        }
+        if (ptd_count || defer)
+                enable_atl_transfers(isp1362_hcd, defer ? 0 : ptd_count);
+
+        epq->ptd_count += ptd_count;
+        if (epq->ptd_count > epq->stat_maxptds) {
+                epq->stat_maxptds = epq->ptd_count;
+                DBG(0, "%s: max_ptds: %d\n", __func__, epq->stat_maxptds);
+        }
+}
+
+static void start_intl_transfers(struct isp1362_hcd *isp1362_hcd)
+{
+        int ptd_count = 0;
+        struct isp1362_ep_queue *epq = &isp1362_hcd->intl_queue;
+        struct isp1362_ep *ep;
+
+        if (atomic_read(&epq->finishing)) {
+                DBG(1, "%s: finish_transfers is active for %s\n", __func__, epq->name);
+                return;
+        }
+
+        list_for_each_entry(ep, &isp1362_hcd->periodic, schedule) {
+                struct urb *urb = get_urb(ep);
+                int ret;
+
+                if (!list_empty(&ep->active)) {
+                        DBG(1, "%s: Skipping active %s ep %p\n", __func__,
+                            epq->name, ep);
+                        continue;
+                }
+
+                DBG(1, "%s: Processing %s ep %p req %d\n", __func__,
+                    epq->name, ep, ep->num_req);
+                ret = submit_req(isp1362_hcd, urb, ep, epq);
+                if (ret == -ENOMEM)
+                        break;
+                else if (ret == -EOVERFLOW)
+                        continue;
+                ptd_count++;
+        }
+
+        if (ptd_count) {
+                static int last_count;
+
+                if (ptd_count != last_count) {
+                        DBG(0, "%s: ptd_count: %d\n", __func__, ptd_count);
+                        last_count = ptd_count;
+                }
+                enable_intl_transfers(isp1362_hcd);
+        }
+
+        epq->ptd_count += ptd_count;
+        if (epq->ptd_count > epq->stat_maxptds)
+                epq->stat_maxptds = epq->ptd_count;
+}
+
+static inline int next_ptd(struct isp1362_ep_queue *epq, struct isp1362_ep *ep)
+{
+        u16 ptd_offset = ep->ptd_offset;
+        int num_ptds = (ep->length + PTD_HEADER_SIZE + (epq->blk_size - 1)) / epq->blk_size;
+
+        DBG(2, "%s: PTD offset $%04x + %04x => %d * %04x -> $%04x\n", __func__, ptd_offset,
+            ep->length, num_ptds, epq->blk_size, ptd_offset + num_ptds * epq->blk_size);
+
+        ptd_offset += num_ptds * epq->blk_size;
+        if (ptd_offset < epq->buf_start + epq->buf_size)
+                return ptd_offset;
+        else
+                return -ENOMEM;
+}
+
+static void start_iso_transfers(struct isp1362_hcd *isp1362_hcd)
+{
+        int ptd_count = 0;
+        int flip = isp1362_hcd->istl_flip;
+        struct isp1362_ep_queue *epq;
+        int ptd_offset;
+        struct isp1362_ep *ep;
+        struct isp1362_ep *tmp;
+        u16 fno = isp1362_read_reg32(isp1362_hcd, HCFMNUM);
+
+ fill2:
+        epq = &isp1362_hcd->istl_queue[flip];
+        if (atomic_read(&epq->finishing)) {
+                DBG(1, "%s: finish_transfers is active for %s\n", __func__, epq->name);
+                return;
+        }
+
+        if (!list_empty(&epq->active))
+                return;
+
+        ptd_offset = epq->buf_start;
+        list_for_each_entry_safe(ep, tmp, &isp1362_hcd->isoc, schedule) {
+                struct urb *urb = get_urb(ep);
+                s16 diff = fno - (u16)urb->start_frame;
+
+                DBG(1, "%s: Processing %s ep %p\n", __func__, epq->name, ep);
+
+                if (diff > urb->number_of_packets) {
+                        /* time frame for this URB has elapsed */
+                        finish_request(isp1362_hcd, ep, urb, -EOVERFLOW);
+                        continue;
+                } else if (diff < -1) {
+                        /* URB is not due in this frame or the next one.
+                         * Comparing with '-1' instead of '0' accounts for double
+                         * buffering in the ISP1362 which enables us to queue the PTD
+                         * one frame ahead of time
+                         */
+                } else if (diff == -1) {
+                        /* submit PTD's that are due in the next frame */
+                        prepare_ptd(isp1362_hcd, urb, ep, epq, fno);
+                        if (ptd_offset + PTD_HEADER_SIZE + ep->length >
+                            epq->buf_start + epq->buf_size) {
+                                pr_err("%s: Not enough ISO buffer space for %d byte PTD\n",
+                                    __func__, ep->length);
+                                continue;
+                        }
+                        ep->ptd_offset = ptd_offset;
+                        list_add_tail(&ep->active, &epq->active);
+
+                        ptd_offset = next_ptd(epq, ep);
+                        if (ptd_offset < 0) {
+                                pr_warning("%s: req %d No more %s PTD buffers available\n", __func__,
+                                     ep->num_req, epq->name);
+                                break;
+                        }
+                }
+        }
+        list_for_each_entry(ep, &epq->active, active) {
+                if (epq->active.next == &ep->active)
+                        ep->ptd.mps |= PTD_LAST_MSK;
+                isp1362_write_ptd(isp1362_hcd, ep, epq);
+                ptd_count++;
+        }
+
+        if (ptd_count)
+                enable_istl_transfers(isp1362_hcd, flip);
+
+        epq->ptd_count += ptd_count;
+        if (epq->ptd_count > epq->stat_maxptds)
+                epq->stat_maxptds = epq->ptd_count;
+
+        /* check, whether the second ISTL buffer may also be filled */
+        if (!(isp1362_read_reg16(isp1362_hcd, HCBUFSTAT) &
+              (flip ? HCBUFSTAT_ISTL0_FULL : HCBUFSTAT_ISTL1_FULL))) {
+                fno++;
+                ptd_count = 0;
+                flip = 1 - flip;
+                goto fill2;
+        }
+}
+
+static void finish_transfers(struct isp1362_hcd *isp1362_hcd, unsigned long done_map,
+                             struct isp1362_ep_queue *epq)
+{
+        struct isp1362_ep *ep;
+        struct isp1362_ep *tmp;
+
+        if (list_empty(&epq->active)) {
+                DBG(1, "%s: Nothing to do for %s queue\n", __func__, epq->name);
+                return;
+        }
+
+        DBG(1, "%s: Finishing %s transfers %08lx\n", __func__, epq->name, done_map);
+
+        atomic_inc(&epq->finishing);
+        list_for_each_entry_safe(ep, tmp, &epq->active, active) {
+                int index = ep->ptd_index;
+
+                DBG(1, "%s: Checking %s PTD[%02x] $%04x\n", __func__, epq->name,
+                    index, ep->ptd_offset);
+
+                BUG_ON(index < 0);
+                if (__test_and_clear_bit(index, &done_map)) {
+                        isp1362_read_ptd(isp1362_hcd, ep, epq);
+                        epq->free_ptd = index;
+                        BUG_ON(ep->num_ptds == 0);
+                        release_ptd_buffers(epq, ep);
+
+                        DBG(1, "%s: ep %p req %d removed from active list\n", __func__,
+                            ep, ep->num_req);
+                        if (!list_empty(&ep->remove_list)) {
+                                list_del_init(&ep->remove_list);
+                                DBG(1, "%s: ep %p removed from remove list\n", __func__, ep);
+                        }
+                        DBG(1, "%s: Postprocessing %s ep %p req %d\n", __func__, epq->name,
+                            ep, ep->num_req);
+                        postproc_ep(isp1362_hcd, ep);
+                }
+                if (!done_map)
+                        break;
+        }
+        if (done_map)
+                pr_warning("%s: done_map not clear: %08lx:%08lx\n", __func__, done_map,
+                     epq->skip_map);
+        atomic_dec(&epq->finishing);
+}
+
+static void finish_iso_transfers(struct isp1362_hcd *isp1362_hcd, struct isp1362_ep_queue *epq)
+{
+        struct isp1362_ep *ep;
+        struct isp1362_ep *tmp;
+
+        if (list_empty(&epq->active)) {
+                DBG(1, "%s: Nothing to do for %s queue\n", __func__, epq->name);
+                return;
+        }
+
+        DBG(1, "%s: Finishing %s transfers\n", __func__, epq->name);
+
+        atomic_inc(&epq->finishing);
+        list_for_each_entry_safe(ep, tmp, &epq->active, active) {
+                DBG(1, "%s: Checking PTD $%04x\n", __func__, ep->ptd_offset);
+
+                isp1362_read_ptd(isp1362_hcd, ep, epq);
+                DBG(1, "%s: Postprocessing %s ep %p\n", __func__, epq->name, ep);
+                postproc_ep(isp1362_hcd, ep);
+        }
+        WARN_ON(epq->blk_size != 0);
+        atomic_dec(&epq->finishing);
+}
+
+static irqreturn_t isp1362_irq(struct usb_hcd *hcd)
+{
+        int handled = 0;
+        struct isp1362_hcd *isp1362_hcd = hcd_to_isp1362_hcd(hcd);
+        u16 irqstat;
+        u16 svc_mask;
+
+        spin_lock(&isp1362_hcd->lock);
+
+        BUG_ON(isp1362_hcd->irq_active++);
+
+        isp1362_write_reg16(isp1362_hcd, HCuPINTENB, 0);
+
+        irqstat = isp1362_read_reg16(isp1362_hcd, HCuPINT);
+        DBG(3, "%s: got IRQ %04x:%04x\n", __func__, irqstat, isp1362_hcd->irqenb);
+
+        /* only handle interrupts that are currently enabled */
+        irqstat &= isp1362_hcd->irqenb;
+        isp1362_write_reg16(isp1362_hcd, HCuPINT, irqstat);
+        svc_mask = irqstat;
+
+        if (irqstat & HCuPINT_SOF) {
+                isp1362_hcd->irqenb &= ~HCuPINT_SOF;
+                isp1362_hcd->irq_stat[ISP1362_INT_SOF]++;
+                handled = 1;
+                svc_mask &= ~HCuPINT_SOF;
+                DBG(3, "%s: SOF\n", __func__);
+                isp1362_hcd->fmindex = isp1362_read_reg32(isp1362_hcd, HCFMNUM);
+                if (!list_empty(&isp1362_hcd->remove_list))
+                        finish_unlinks(isp1362_hcd);
+                if (!list_empty(&isp1362_hcd->async) && !(irqstat & HCuPINT_ATL)) {
+                        if (list_empty(&isp1362_hcd->atl_queue.active)) {
+                                start_atl_transfers(isp1362_hcd);
+                        } else {
+                                isp1362_enable_int(isp1362_hcd, HCuPINT_ATL);
+                                isp1362_write_reg32(isp1362_hcd, HCATLSKIP,
+                                                    isp1362_hcd->atl_queue.skip_map);
+                                isp1362_set_mask16(isp1362_hcd, HCBUFSTAT, HCBUFSTAT_ATL_ACTIVE);
+                        }
+                }
+        }
+
+        if (irqstat & HCuPINT_ISTL0) {
+                isp1362_hcd->irq_stat[ISP1362_INT_ISTL0]++;
+                handled = 1;
+                svc_mask &= ~HCuPINT_ISTL0;
+                isp1362_clr_mask16(isp1362_hcd, HCBUFSTAT, HCBUFSTAT_ISTL0_FULL);
+                DBG(1, "%s: ISTL0\n", __func__);
+                WARN_ON((int)!!isp1362_hcd->istl_flip);
+                WARN_ON(isp1362_read_reg16(isp1362_hcd, HCBUFSTAT) &
+                        HCBUFSTAT_ISTL0_ACTIVE);
+                WARN_ON(!(isp1362_read_reg16(isp1362_hcd, HCBUFSTAT) &
+                        HCBUFSTAT_ISTL0_DONE));
+                isp1362_hcd->irqenb &= ~HCuPINT_ISTL0;
+        }
+
+        if (irqstat & HCuPINT_ISTL1) {
+                isp1362_hcd->irq_stat[ISP1362_INT_ISTL1]++;
+                handled = 1;
+                svc_mask &= ~HCuPINT_ISTL1;
+                isp1362_clr_mask16(isp1362_hcd, HCBUFSTAT, HCBUFSTAT_ISTL1_FULL);
+                DBG(1, "%s: ISTL1\n", __func__);
+                WARN_ON(!(int)isp1362_hcd->istl_flip);
+                WARN_ON(isp1362_read_reg16(isp1362_hcd, HCBUFSTAT) &
+                        HCBUFSTAT_ISTL1_ACTIVE);
+                WARN_ON(!(isp1362_read_reg16(isp1362_hcd, HCBUFSTAT) &
+                        HCBUFSTAT_ISTL1_DONE));
+                isp1362_hcd->irqenb &= ~HCuPINT_ISTL1;
+        }
+
+        if (irqstat & (HCuPINT_ISTL0 | HCuPINT_ISTL1)) {
+                WARN_ON((irqstat & (HCuPINT_ISTL0 | HCuPINT_ISTL1)) ==
+                        (HCuPINT_ISTL0 | HCuPINT_ISTL1));
+                finish_iso_transfers(isp1362_hcd,
+                                     &isp1362_hcd->istl_queue[isp1362_hcd->istl_flip]);
+                start_iso_transfers(isp1362_hcd);
+                isp1362_hcd->istl_flip = 1 - isp1362_hcd->istl_flip;
+        }
+
+        if (irqstat & HCuPINT_INTL) {
+                u32 done_map = isp1362_read_reg32(isp1362_hcd, HCINTLDONE);
+                u32 skip_map = isp1362_read_reg32(isp1362_hcd, HCINTLSKIP);
+                isp1362_hcd->irq_stat[ISP1362_INT_INTL]++;
+
+                DBG(2, "%s: INTL\n", __func__);
+
+                svc_mask &= ~HCuPINT_INTL;
+
+                isp1362_write_reg32(isp1362_hcd, HCINTLSKIP, skip_map | done_map);
+                if (~(done_map | skip_map) == 0)
+                        /* All PTDs are finished, disable INTL processing entirely */
+                        isp1362_clr_mask16(isp1362_hcd, HCBUFSTAT, HCBUFSTAT_INTL_ACTIVE);
+
+                handled = 1;
+                WARN_ON(!done_map);
+                if (done_map) {
+                        DBG(3, "%s: INTL done_map %08x\n", __func__, done_map);
+                        finish_transfers(isp1362_hcd, done_map, &isp1362_hcd->intl_queue);
+                        start_intl_transfers(isp1362_hcd);
+                }
+        }
+
+        if (irqstat & HCuPINT_ATL) {
+                u32 done_map = isp1362_read_reg32(isp1362_hcd, HCATLDONE);
+                u32 skip_map = isp1362_read_reg32(isp1362_hcd, HCATLSKIP);
+                isp1362_hcd->irq_stat[ISP1362_INT_ATL]++;
+
+                DBG(2, "%s: ATL\n", __func__);
+
+                svc_mask &= ~HCuPINT_ATL;
+
+                isp1362_write_reg32(isp1362_hcd, HCATLSKIP, skip_map | done_map);
+                if (~(done_map | skip_map) == 0)
+                        isp1362_clr_mask16(isp1362_hcd, HCBUFSTAT, HCBUFSTAT_ATL_ACTIVE);
+                if (done_map) {
+                        DBG(3, "%s: ATL done_map %08x\n", __func__, done_map);
+                        finish_transfers(isp1362_hcd, done_map, &isp1362_hcd->atl_queue);
+                        start_atl_transfers(isp1362_hcd);
+                }
+                handled = 1;
+        }
+
+        if (irqstat & HCuPINT_OPR) {
+                u32 intstat = isp1362_read_reg32(isp1362_hcd, HCINTSTAT);
+                isp1362_hcd->irq_stat[ISP1362_INT_OPR]++;
+
+                svc_mask &= ~HCuPINT_OPR;
+                DBG(2, "%s: OPR %08x:%08x\n", __func__, intstat, isp1362_hcd->intenb);
+                intstat &= isp1362_hcd->intenb;
+                if (intstat & OHCI_INTR_UE) {
+                        pr_err("Unrecoverable error\n");
+                        /* FIXME: do here reset or cleanup or whatever */
+                }
+                if (intstat & OHCI_INTR_RHSC) {
+                        isp1362_hcd->rhstatus = isp1362_read_reg32(isp1362_hcd, HCRHSTATUS);
+                        isp1362_hcd->rhport[0] = isp1362_read_reg32(isp1362_hcd, HCRHPORT1);
+                        isp1362_hcd->rhport[1] = isp1362_read_reg32(isp1362_hcd, HCRHPORT2);
+                }
+                if (intstat & OHCI_INTR_RD) {
+                        pr_info("%s: RESUME DETECTED\n", __func__);
+                        isp1362_show_reg(isp1362_hcd, HCCONTROL);
+                        usb_hcd_resume_root_hub(hcd);
+                }
+                isp1362_write_reg32(isp1362_hcd, HCINTSTAT, intstat);
+                irqstat &= ~HCuPINT_OPR;
+                handled = 1;
+        }
+
+        if (irqstat & HCuPINT_SUSP) {
+                isp1362_hcd->irq_stat[ISP1362_INT_SUSP]++;
+                handled = 1;
+                svc_mask &= ~HCuPINT_SUSP;
+
+                pr_info("%s: SUSPEND IRQ\n", __func__);
+        }
+
+        if (irqstat & HCuPINT_CLKRDY) {
+                isp1362_hcd->irq_stat[ISP1362_INT_CLKRDY]++;
+                handled = 1;
+                isp1362_hcd->irqenb &= ~HCuPINT_CLKRDY;
+                svc_mask &= ~HCuPINT_CLKRDY;
+                pr_info("%s: CLKRDY IRQ\n", __func__);
+        }
+
+        if (svc_mask)
+                pr_err("%s: Unserviced interrupt(s) %04x\n", __func__, svc_mask);
+
+        isp1362_write_reg16(isp1362_hcd, HCuPINTENB, isp1362_hcd->irqenb);
+        isp1362_hcd->irq_active--;
+        spin_unlock(&isp1362_hcd->lock);
+
+        return IRQ_RETVAL(handled);
+}
+
+/*-------------------------------------------------------------------------*/
+
+#define MAX_PERIODIC_LOAD       900     /* out of 1000 usec */
+static int balance(struct isp1362_hcd *isp1362_hcd, u16 interval, u16 load)
+{
+        int i, branch = -ENOSPC;
+
+        /* search for the least loaded schedule branch of that interval
+         * which has enough bandwidth left unreserved.
+         */
+        for (i = 0; i < interval; i++) {
+                if (branch < 0 || isp1362_hcd->load[branch] > isp1362_hcd->load[i]) {
+                        int j;
+
+                        for (j = i; j < PERIODIC_SIZE; j += interval) {
+                                if ((isp1362_hcd->load[j] + load) > MAX_PERIODIC_LOAD) {
+                                        pr_err("%s: new load %d load[%02x] %d max %d\n", __func__,
+                                            load, j, isp1362_hcd->load[j], MAX_PERIODIC_LOAD);
+                                        break;
+                                }
+                        }
+                        if (j < PERIODIC_SIZE)
+                                continue;
+                        branch = i;
+                }
+        }
+        return branch;
+}
+
+/* NB! ALL the code above this point runs with isp1362_hcd->lock
+   held, irqs off
+*/
+
+/*-------------------------------------------------------------------------*/
+
+static int isp1362_urb_enqueue(struct usb_hcd *hcd,
+                               struct urb *urb,
+                               gfp_t mem_flags)
+{
+        struct isp1362_hcd *isp1362_hcd = hcd_to_isp1362_hcd(hcd);
+        struct usb_device *udev = urb->dev;
+        unsigned int pipe = urb->pipe;
+        int is_out = !usb_pipein(pipe);
+        int type = usb_pipetype(pipe);
+        int epnum = usb_pipeendpoint(pipe);
+        struct usb_host_endpoint *hep = urb->ep;
+        struct isp1362_ep *ep = NULL;
+        unsigned long flags;
+        int retval = 0;
+
+        DBG(3, "%s: urb %p\n", __func__, urb);
+
+        if (type == PIPE_ISOCHRONOUS) {
+                pr_err("Isochronous transfers not supported\n");
+                return -ENOSPC;
+        }
+
+        URB_DBG("%s: FA %d ep%d%s %s: len %d %s%s\n", __func__,
+                usb_pipedevice(pipe), epnum,
+                is_out ? "out" : "in",
+                usb_pipecontrol(pipe) ? "ctrl" :
+                        usb_pipeint(pipe) ? "int" :
+                        usb_pipebulk(pipe) ? "bulk" :
+                        "iso",
+                urb->transfer_buffer_length,
+                (urb->transfer_flags & URB_ZERO_PACKET) ? "ZERO_PACKET " : "",
+                !(urb->transfer_flags & URB_SHORT_NOT_OK) ?
+                "short_ok" : "");
+
+        /* avoid all allocations within spinlocks: request or endpoint */
+        if (!hep->hcpriv) {
+                ep = kcalloc(1, sizeof *ep, mem_flags);
+                if (!ep)
+                        return -ENOMEM;
+        }
+        spin_lock_irqsave(&isp1362_hcd->lock, flags);
+
+        /* don't submit to a dead or disabled port */
+        if (!((isp1362_hcd->rhport[0] | isp1362_hcd->rhport[1]) &
+              (1 << USB_PORT_FEAT_ENABLE)) ||
+            !HC_IS_RUNNING(hcd->state)) {
+                kfree(ep);
+                retval = -ENODEV;
+                goto fail_not_linked;
+        }
+
+        retval = usb_hcd_link_urb_to_ep(hcd, urb);
+        if (retval) {
+                kfree(ep);
+                goto fail_not_linked;
+        }
+
+        if (hep->hcpriv) {
+                ep = hep->hcpriv;
+        } else {
+                INIT_LIST_HEAD(&ep->schedule);
+                INIT_LIST_HEAD(&ep->active);
+                INIT_LIST_HEAD(&ep->remove_list);
+                ep->udev = usb_get_dev(udev);
+                ep->hep = hep;
+                ep->epnum = epnum;
+                ep->maxpacket = usb_maxpacket(udev, urb->pipe, is_out);
+                ep->ptd_offset = -EINVAL;
+                ep->ptd_index = -EINVAL;
+                usb_settoggle(udev, epnum, is_out, 0);
+
+                if (type == PIPE_CONTROL)
+                        ep->nextpid = USB_PID_SETUP;
+                else if (is_out)
+                        ep->nextpid = USB_PID_OUT;
+                else
+                        ep->nextpid = USB_PID_IN;
+
+                switch (type) {
+                case PIPE_ISOCHRONOUS:
+                case PIPE_INTERRUPT:
+                        if (urb->interval > PERIODIC_SIZE)
+                                urb->interval = PERIODIC_SIZE;
+                        ep->interval = urb->interval;
+                        ep->branch = PERIODIC_SIZE;
+                        ep->load = usb_calc_bus_time(udev->speed, !is_out,
+                                                     (type == PIPE_ISOCHRONOUS),
+                                                     usb_maxpacket(udev, pipe, is_out)) / 1000;
+                        break;
+                }
+                hep->hcpriv = ep;
+        }
+        ep->num_req = isp1362_hcd->req_serial++;
+
+        /* maybe put endpoint into schedule */
+        switch (type) {
+        case PIPE_CONTROL:
+        case PIPE_BULK:
+                if (list_empty(&ep->schedule)) {
+                        DBG(1, "%s: Adding ep %p req %d to async schedule\n",
+                                __func__, ep, ep->num_req);
+                        list_add_tail(&ep->schedule, &isp1362_hcd->async);
+                }
+                break;
+        case PIPE_ISOCHRONOUS:
+        case PIPE_INTERRUPT:
+                urb->interval = ep->interval;
+
+                /* urb submitted for already existing EP */
+                if (ep->branch < PERIODIC_SIZE)
+                        break;
+
+                retval = balance(isp1362_hcd, ep->interval, ep->load);
+                if (retval < 0) {
+                        pr_err("%s: balance returned %d\n", __func__, retval);
+                        goto fail;
+                }
+                ep->branch = retval;
+                retval = 0;
+                isp1362_hcd->fmindex = isp1362_read_reg32(isp1362_hcd, HCFMNUM);
+                DBG(1, "%s: Current frame %04x branch %02x start_frame %04x(%04x)\n",
+                    __func__, isp1362_hcd->fmindex, ep->branch,
+                    ((isp1362_hcd->fmindex + PERIODIC_SIZE - 1) &
+                     ~(PERIODIC_SIZE - 1)) + ep->branch,
+                    (isp1362_hcd->fmindex & (PERIODIC_SIZE - 1)) + ep->branch);
+
+                if (list_empty(&ep->schedule)) {
+                        if (type == PIPE_ISOCHRONOUS) {
+                                u16 frame = isp1362_hcd->fmindex;
+
+                                frame += max_t(u16, 8, ep->interval);
+                                frame &= ~(ep->interval - 1);
+                                frame |= ep->branch;
+                                if (frame_before(frame, isp1362_hcd->fmindex))
+                                        frame += ep->interval;
+                                urb->start_frame = frame;
+
+                                DBG(1, "%s: Adding ep %p to isoc schedule\n", __func__, ep);
+                                list_add_tail(&ep->schedule, &isp1362_hcd->isoc);
+                        } else {
+                                DBG(1, "%s: Adding ep %p to periodic schedule\n", __func__, ep);
+                                list_add_tail(&ep->schedule, &isp1362_hcd->periodic);
+                        }
+                } else
+                        DBG(1, "%s: ep %p already scheduled\n", __func__, ep);
+
+                DBG(2, "%s: load %d bandwidth %d -> %d\n", __func__,
+                    ep->load / ep->interval, isp1362_hcd->load[ep->branch],
+                    isp1362_hcd->load[ep->branch] + ep->load);
+                isp1362_hcd->load[ep->branch] += ep->load;
+        }
+
+        urb->hcpriv = hep;
+        ALIGNSTAT(isp1362_hcd, urb->transfer_buffer);
+
+        switch (type) {
+        case PIPE_CONTROL:
+        case PIPE_BULK:
+                start_atl_transfers(isp1362_hcd);
+                break;
+        case PIPE_INTERRUPT:
+                start_intl_transfers(isp1362_hcd);
+                break;
+        case PIPE_ISOCHRONOUS:
+                start_iso_transfers(isp1362_hcd);
+                break;
+        default:
+                BUG();
+        }
+ fail:
+        if (retval)
+                usb_hcd_unlink_urb_from_ep(hcd, urb);
+
+
+ fail_not_linked:
+        spin_unlock_irqrestore(&isp1362_hcd->lock, flags);
+        if (retval)
+                DBG(0, "%s: urb %p failed with %d\n", __func__, urb, retval);
+        return retval;
+}
+
+static int isp1362_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status)
+{
+        struct isp1362_hcd *isp1362_hcd = hcd_to_isp1362_hcd(hcd);
+        struct usb_host_endpoint *hep;
+        unsigned long flags;
+        struct isp1362_ep *ep;
+        int retval = 0;
+
+        DBG(3, "%s: urb %p\n", __func__, urb);
+
+        spin_lock_irqsave(&isp1362_hcd->lock, flags);
+        retval = usb_hcd_check_unlink_urb(hcd, urb, status);
+        if (retval)
+                goto done;
+
+        hep = urb->hcpriv;
+
+        if (!hep) {
+                spin_unlock_irqrestore(&isp1362_hcd->lock, flags);
+                return -EIDRM;
+        }
+
+        ep = hep->hcpriv;
+        if (ep) {
+                /* In front of queue? */
+                if (ep->hep->urb_list.next == &urb->urb_list) {
+                        if (!list_empty(&ep->active)) {
+                                DBG(1, "%s: urb %p ep %p req %d active PTD[%d] $%04x\n", __func__,
+                                    urb, ep, ep->num_req, ep->ptd_index, ep->ptd_offset);
+                                /* disable processing and queue PTD for removal */
+                                remove_ptd(isp1362_hcd, ep);
+                                urb = NULL;
+                        }
+                }
+                if (urb) {
+                        DBG(1, "%s: Finishing ep %p req %d\n", __func__, ep,
+                            ep->num_req);
+                        finish_request(isp1362_hcd, ep, urb, status);
+                } else
+                        DBG(1, "%s: urb %p active; wait4irq\n", __func__, urb);
+        } else {
+                pr_warning("%s: No EP in URB %p\n", __func__, urb);
+                retval = -EINVAL;
+        }
+done:
+        spin_unlock_irqrestore(&isp1362_hcd->lock, flags);
+
+        DBG(3, "%s: exit\n", __func__);
+
+        return retval;
+}
+
+static void isp1362_endpoint_disable(struct usb_hcd *hcd, struct usb_host_endpoint *hep)
+{
+        struct isp1362_ep *ep = hep->hcpriv;
+        struct isp1362_hcd *isp1362_hcd = hcd_to_isp1362_hcd(hcd);
+        unsigned long flags;
+
+        DBG(1, "%s: ep %p\n", __func__, ep);
+        if (!ep)
+                return;
+        spin_lock_irqsave(&isp1362_hcd->lock, flags);
+        if (!list_empty(&hep->urb_list)) {
+                if (!list_empty(&ep->active) && list_empty(&ep->remove_list)) {
+                        DBG(1, "%s: Removing ep %p req %d PTD[%d] $%04x\n", __func__,
+                            ep, ep->num_req, ep->ptd_index, ep->ptd_offset);
+                        remove_ptd(isp1362_hcd, ep);
+                        pr_info("%s: Waiting for Interrupt to clean up\n", __func__);
+                }
+        }
+        spin_unlock_irqrestore(&isp1362_hcd->lock, flags);
+        /* Wait for interrupt to clear out active list */
+        while (!list_empty(&ep->active))
+                msleep(1);
+
+        DBG(1, "%s: Freeing EP %p\n", __func__, ep);
+
+        usb_put_dev(ep->udev);
+        kfree(ep);
+        hep->hcpriv = NULL;
+}
+
+static int isp1362_get_frame(struct usb_hcd *hcd)
+{
+        struct isp1362_hcd *isp1362_hcd = hcd_to_isp1362_hcd(hcd);
+        u32 fmnum;
+        unsigned long flags;
+
+        spin_lock_irqsave(&isp1362_hcd->lock, flags);
+        fmnum = isp1362_read_reg32(isp1362_hcd, HCFMNUM);
+        spin_unlock_irqrestore(&isp1362_hcd->lock, flags);
+
+        return (int)fmnum;
+}
+
+/*-------------------------------------------------------------------------*/
+
+/* Adapted from ohci-hub.c */
+static int isp1362_hub_status_data(struct usb_hcd *hcd, char *buf)
+{
+        struct isp1362_hcd *isp1362_hcd = hcd_to_isp1362_hcd(hcd);
+        int ports, i, changed = 0;
+        unsigned long flags;
+
+        if (!HC_IS_RUNNING(hcd->state))
+                return -ESHUTDOWN;
+
+        /* Report no status change now, if we are scheduled to be
+           called later */
+        if (timer_pending(&hcd->rh_timer))
+                return 0;
+
+        ports = isp1362_hcd->rhdesca & RH_A_NDP;
+        BUG_ON(ports > 2);
+
+        spin_lock_irqsave(&isp1362_hcd->lock, flags);
+        /* init status */
+        if (isp1362_hcd->rhstatus & (RH_HS_LPSC | RH_HS_OCIC))
+                buf[0] = changed = 1;
+        else
+                buf[0] = 0;
+
+        for (i = 0; i < ports; i++) {
+                u32 status = isp1362_hcd->rhport[i];
+
+                if (status & (RH_PS_CSC | RH_PS_PESC | RH_PS_PSSC |
+                              RH_PS_OCIC | RH_PS_PRSC)) {
+                        changed = 1;
+                        buf[0] |= 1 << (i + 1);
+                        continue;
+                }
+
+                if (!(status & RH_PS_CCS))
+                        continue;
+        }
+        spin_unlock_irqrestore(&isp1362_hcd->lock, flags);
+        return changed;
+}
+
+static void isp1362_hub_descriptor(struct isp1362_hcd *isp1362_hcd,
+                                   struct usb_hub_descriptor *desc)
+{
+        u32 reg = isp1362_hcd->rhdesca;
+
+        DBG(3, "%s: enter\n", __func__);
+
+        desc->bDescriptorType = 0x29;
+        desc->bDescLength = 9;
+        desc->bHubContrCurrent = 0;
+        desc->bNbrPorts = reg & 0x3;
+        /* Power switching, device type, overcurrent. */
+        desc->wHubCharacteristics = cpu_to_le16((reg >> 8) & 0x1f);
+        DBG(0, "%s: hubcharacteristics = %02x\n", __func__, cpu_to_le16((reg >> 8) & 0x1f));
+        desc->bPwrOn2PwrGood = (reg >> 24) & 0xff;
+        /* two bitmaps:  ports removable, and legacy PortPwrCtrlMask */
+        desc->bitmap[0] = desc->bNbrPorts == 1 ? 1 << 1 : 3 << 1;
+        desc->bitmap[1] = ~0;
+
+        DBG(3, "%s: exit\n", __func__);
+}
+
+/* Adapted from ohci-hub.c */
+static int isp1362_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
+                               u16 wIndex, char *buf, u16 wLength)
+{
+        struct isp1362_hcd *isp1362_hcd = hcd_to_isp1362_hcd(hcd);
+        int retval = 0;
+        unsigned long flags;
+        unsigned long t1;
+        int ports = isp1362_hcd->rhdesca & RH_A_NDP;
+        u32 tmp = 0;
+
+        switch (typeReq) {
+        case ClearHubFeature:
+                DBG(0, "ClearHubFeature: ");
+                switch (wValue) {
+                case C_HUB_OVER_CURRENT:
+                        _DBG(0, "C_HUB_OVER_CURRENT\n");
+                        spin_lock_irqsave(&isp1362_hcd->lock, flags);
+                        isp1362_write_reg32(isp1362_hcd, HCRHSTATUS, RH_HS_OCIC);
+                        spin_unlock_irqrestore(&isp1362_hcd->lock, flags);
+                case C_HUB_LOCAL_POWER:
+                        _DBG(0, "C_HUB_LOCAL_POWER\n");
+                        break;
+                default:
+                        goto error;
+                }
+                break;
+        case SetHubFeature:
+                DBG(0, "SetHubFeature: ");
+                switch (wValue) {
+                case C_HUB_OVER_CURRENT:
+                case C_HUB_LOCAL_POWER:
+                        _DBG(0, "C_HUB_OVER_CURRENT or C_HUB_LOCAL_POWER\n");
+                        break;
+                default:
+                        goto error;
+                }
+                break;
+        case GetHubDescriptor:
+                DBG(0, "GetHubDescriptor\n");
+                isp1362_hub_descriptor(isp1362_hcd, (struct usb_hub_descriptor *)buf);
+                break;
+        case GetHubStatus:
+                DBG(0, "GetHubStatus\n");
+                put_unaligned(cpu_to_le32(0), (__le32 *) buf);
+                break;
+        case GetPortStatus:
+#ifndef VERBOSE
+                DBG(0, "GetPortStatus\n");
+#endif
+                if (!wIndex || wIndex > ports)
+                        goto error;
+                tmp = isp1362_hcd->rhport[--wIndex];
+                put_unaligned(cpu_to_le32(tmp), (__le32 *) buf);
+                break;
+        case ClearPortFeature:
+                DBG(0, "ClearPortFeature: ");
+                if (!wIndex || wIndex > ports)
+                        goto error;
+                wIndex--;
+
+                switch (wValue) {
+                case USB_PORT_FEAT_ENABLE:
+                        _DBG(0, "USB_PORT_FEAT_ENABLE\n");
+                        tmp = RH_PS_CCS;
+                        break;
+                case USB_PORT_FEAT_C_ENABLE:
+                        _DBG(0, "USB_PORT_FEAT_C_ENABLE\n");
+                        tmp = RH_PS_PESC;
+                        break;
+                case USB_PORT_FEAT_SUSPEND:
+                        _DBG(0, "USB_PORT_FEAT_SUSPEND\n");
+                        tmp = RH_PS_POCI;
+                        break;
+                case USB_PORT_FEAT_C_SUSPEND:
+                        _DBG(0, "USB_PORT_FEAT_C_SUSPEND\n");
+                        tmp = RH_PS_PSSC;
+                        break;
+                case USB_PORT_FEAT_POWER:
+                        _DBG(0, "USB_PORT_FEAT_POWER\n");
+                        tmp = RH_PS_LSDA;
+
+                        break;
+                case USB_PORT_FEAT_C_CONNECTION:
+                        _DBG(0, "USB_PORT_FEAT_C_CONNECTION\n");
+                        tmp = RH_PS_CSC;
+                        break;
+                case USB_PORT_FEAT_C_OVER_CURRENT:
+                        _DBG(0, "USB_PORT_FEAT_C_OVER_CURRENT\n");
+                        tmp = RH_PS_OCIC;
+                        break;
+                case USB_PORT_FEAT_C_RESET:
+                        _DBG(0, "USB_PORT_FEAT_C_RESET\n");
+                        tmp = RH_PS_PRSC;
+                        break;
+                default:
+                        goto error;
+                }
+
+                spin_lock_irqsave(&isp1362_hcd->lock, flags);
+                isp1362_write_reg32(isp1362_hcd, HCRHPORT1 + wIndex, tmp);
+                isp1362_hcd->rhport[wIndex] =
+                        isp1362_read_reg32(isp1362_hcd, HCRHPORT1 + wIndex);
+                spin_unlock_irqrestore(&isp1362_hcd->lock, flags);
+                break;
+        case SetPortFeature:
+                DBG(0, "SetPortFeature: ");
+                if (!wIndex || wIndex > ports)
+                        goto error;
+                wIndex--;
+                switch (wValue) {
+                case USB_PORT_FEAT_SUSPEND:
+                        _DBG(0, "USB_PORT_FEAT_SUSPEND\n");
+#ifdef  CONFIG_USB_OTG
+                        if (ohci->hcd.self.otg_port == (wIndex + 1) &&
+                            ohci->hcd.self.b_hnp_enable) {
+                                start_hnp(ohci);
+                                break;
+                        }
+#endif
+                        spin_lock_irqsave(&isp1362_hcd->lock, flags);
+                        isp1362_write_reg32(isp1362_hcd, HCRHPORT1 + wIndex, RH_PS_PSS);
+                        isp1362_hcd->rhport[wIndex] =
+                                isp1362_read_reg32(isp1362_hcd, HCRHPORT1 + wIndex);
+                        spin_unlock_irqrestore(&isp1362_hcd->lock, flags);
+                        break;
+                case USB_PORT_FEAT_POWER:
+                        _DBG(0, "USB_PORT_FEAT_POWER\n");
+                        spin_lock_irqsave(&isp1362_hcd->lock, flags);
+                        isp1362_write_reg32(isp1362_hcd, HCRHPORT1 + wIndex, RH_PS_PPS);
+                        isp1362_hcd->rhport[wIndex] =
+                                isp1362_read_reg32(isp1362_hcd, HCRHPORT1 + wIndex);
+                        spin_unlock_irqrestore(&isp1362_hcd->lock, flags);
+                        break;
+                case USB_PORT_FEAT_RESET:
+                        _DBG(0, "USB_PORT_FEAT_RESET\n");
+                        spin_lock_irqsave(&isp1362_hcd->lock, flags);
+
+                        t1 = jiffies + msecs_to_jiffies(USB_RESET_WIDTH);
+                        while (time_before(jiffies, t1)) {
+                                /* spin until any current reset finishes */
+                                for (;;) {
+                                        tmp = isp1362_read_reg32(isp1362_hcd, HCRHPORT1 + wIndex);
+                                        if (!(tmp & RH_PS_PRS))
+                                                break;
+                                        udelay(500);
+                                }
+                                if (!(tmp & RH_PS_CCS))
+                                        break;
+                                /* Reset lasts 10ms (claims datasheet) */
+                                isp1362_write_reg32(isp1362_hcd, HCRHPORT1 + wIndex, (RH_PS_PRS));
+
+                                spin_unlock_irqrestore(&isp1362_hcd->lock, flags);
+                                msleep(10);
+                                spin_lock_irqsave(&isp1362_hcd->lock, flags);
+                        }
+
+                        isp1362_hcd->rhport[wIndex] = isp1362_read_reg32(isp1362_hcd,
+                                                                         HCRHPORT1 + wIndex);
+                        spin_unlock_irqrestore(&isp1362_hcd->lock, flags);
+                        break;
+                default:
+                        goto error;
+                }
+                break;
+
+        default:
+ error:
+                /* "protocol stall" on error */
+                _DBG(0, "PROTOCOL STALL\n");
+                retval = -EPIPE;
+        }
+
+        return retval;
+}
+
+#ifdef  CONFIG_PM
+static int isp1362_bus_suspend(struct usb_hcd *hcd)
+{
+        int status = 0;
+        struct isp1362_hcd *isp1362_hcd = hcd_to_isp1362_hcd(hcd);
+        unsigned long flags;
+
+        if (time_before(jiffies, isp1362_hcd->next_statechange))
+                msleep(5);
+
+        spin_lock_irqsave(&isp1362_hcd->lock, flags);
+
+        isp1362_hcd->hc_control = isp1362_read_reg32(isp1362_hcd, HCCONTROL);
+        switch (isp1362_hcd->hc_control & OHCI_CTRL_HCFS) {
+        case OHCI_USB_RESUME:
+                DBG(0, "%s: resume/suspend?\n", __func__);
+                isp1362_hcd->hc_control &= ~OHCI_CTRL_HCFS;
+                isp1362_hcd->hc_control |= OHCI_USB_RESET;
+                isp1362_write_reg32(isp1362_hcd, HCCONTROL, isp1362_hcd->hc_control);
+                /* FALL THROUGH */
+        case OHCI_USB_RESET:
+                status = -EBUSY;
+                pr_warning("%s: needs reinit!\n", __func__);
+                goto done;
+        case OHCI_USB_SUSPEND:
+                pr_warning("%s: already suspended?\n", __func__);
+                goto done;
+        }
+        DBG(0, "%s: suspend root hub\n", __func__);
+
+        /* First stop any processing */
+        hcd->state = HC_STATE_QUIESCING;
+        if (!list_empty(&isp1362_hcd->atl_queue.active) ||
+            !list_empty(&isp1362_hcd->intl_queue.active) ||
+            !list_empty(&isp1362_hcd->istl_queue[0] .active) ||
+            !list_empty(&isp1362_hcd->istl_queue[1] .active)) {
+                int limit;
+
+                isp1362_write_reg32(isp1362_hcd, HCATLSKIP, ~0);
+                isp1362_write_reg32(isp1362_hcd, HCINTLSKIP, ~0);
+                isp1362_write_reg16(isp1362_hcd, HCBUFSTAT, 0);
+                isp1362_write_reg16(isp1362_hcd, HCuPINTENB, 0);
+                isp1362_write_reg32(isp1362_hcd, HCINTSTAT, OHCI_INTR_SF);
+
+                DBG(0, "%s: stopping schedules ...\n", __func__);
+                limit = 2000;
+                while (limit > 0) {
+                        udelay(250);
+                        limit -= 250;
+                        if (isp1362_read_reg32(isp1362_hcd, HCINTSTAT) & OHCI_INTR_SF)
+                                break;
+                }
+                mdelay(7);
+                if (isp1362_read_reg16(isp1362_hcd, HCuPINT) & HCuPINT_ATL) {
+                        u32 done_map = isp1362_read_reg32(isp1362_hcd, HCATLDONE);
+                        finish_transfers(isp1362_hcd, done_map, &isp1362_hcd->atl_queue);
+                }
+                if (isp1362_read_reg16(isp1362_hcd, HCuPINT) & HCuPINT_INTL) {
+                        u32 done_map = isp1362_read_reg32(isp1362_hcd, HCINTLDONE);
+                        finish_transfers(isp1362_hcd, done_map, &isp1362_hcd->intl_queue);
+                }
+                if (isp1362_read_reg16(isp1362_hcd, HCuPINT) & HCuPINT_ISTL0)
+                        finish_iso_transfers(isp1362_hcd, &isp1362_hcd->istl_queue[0]);
+                if (isp1362_read_reg16(isp1362_hcd, HCuPINT) & HCuPINT_ISTL1)
+                        finish_iso_transfers(isp1362_hcd, &isp1362_hcd->istl_queue[1]);
+        }
+        DBG(0, "%s: HCINTSTAT: %08x\n", __func__,
+                    isp1362_read_reg32(isp1362_hcd, HCINTSTAT));
+        isp1362_write_reg32(isp1362_hcd, HCINTSTAT,
+                            isp1362_read_reg32(isp1362_hcd, HCINTSTAT));
+
+        /* Suspend hub */
+        isp1362_hcd->hc_control = OHCI_USB_SUSPEND;
+        isp1362_show_reg(isp1362_hcd, HCCONTROL);
+        isp1362_write_reg32(isp1362_hcd, HCCONTROL, isp1362_hcd->hc_control);
+        isp1362_show_reg(isp1362_hcd, HCCONTROL);
+
+#if 1
+        isp1362_hcd->hc_control = isp1362_read_reg32(isp1362_hcd, HCCONTROL);
+        if ((isp1362_hcd->hc_control & OHCI_CTRL_HCFS) != OHCI_USB_SUSPEND) {
+                pr_err("%s: controller won't suspend %08x\n", __func__,
+                    isp1362_hcd->hc_control);
+                status = -EBUSY;
+        } else
+#endif
+        {
+                /* no resumes until devices finish suspending */
+                isp1362_hcd->next_statechange = jiffies + msecs_to_jiffies(5);
+        }
+done:
+        if (status == 0) {
+                hcd->state = HC_STATE_SUSPENDED;
+                DBG(0, "%s: HCD suspended: %08x\n", __func__,
+                    isp1362_read_reg32(isp1362_hcd, HCCONTROL));
+        }
+        spin_unlock_irqrestore(&isp1362_hcd->lock, flags);
+        return status;
+}
+
+static int isp1362_bus_resume(struct usb_hcd *hcd)
+{
+        struct isp1362_hcd *isp1362_hcd = hcd_to_isp1362_hcd(hcd);
+        u32 port;
+        unsigned long flags;
+        int status = -EINPROGRESS;
+
+        if (time_before(jiffies, isp1362_hcd->next_statechange))
+                msleep(5);
+
+        spin_lock_irqsave(&isp1362_hcd->lock, flags);
+        isp1362_hcd->hc_control = isp1362_read_reg32(isp1362_hcd, HCCONTROL);
+        pr_info("%s: HCCONTROL: %08x\n", __func__, isp1362_hcd->hc_control);
+        if (hcd->state == HC_STATE_RESUMING) {
+                pr_warning("%s: duplicate resume\n", __func__);
+                status = 0;
+        } else
+                switch (isp1362_hcd->hc_control & OHCI_CTRL_HCFS) {
+                case OHCI_USB_SUSPEND:
+                        DBG(0, "%s: resume root hub\n", __func__);
+                        isp1362_hcd->hc_control &= ~OHCI_CTRL_HCFS;
+                        isp1362_hcd->hc_control |= OHCI_USB_RESUME;
+                        isp1362_write_reg32(isp1362_hcd, HCCONTROL, isp1362_hcd->hc_control);
+                        break;
+                case OHCI_USB_RESUME:
+                        /* HCFS changes sometime after INTR_RD */
+                        DBG(0, "%s: remote wakeup\n", __func__);
+                        break;
+                case OHCI_USB_OPER:
+                        DBG(0, "%s: odd resume\n", __func__);
+                        status = 0;
+                        hcd->self.root_hub->dev.power.power_state = PMSG_ON;
+                        break;
+                default:                /* RESET, we lost power */
+                        DBG(0, "%s: root hub hardware reset\n", __func__);
+                        status = -EBUSY;
+                }
+        spin_unlock_irqrestore(&isp1362_hcd->lock, flags);
+        if (status == -EBUSY) {
+                DBG(0, "%s: Restarting HC\n", __func__);
+                isp1362_hc_stop(hcd);
+                return isp1362_hc_start(hcd);
+        }
+        if (status != -EINPROGRESS)
+                return status;
+        spin_lock_irqsave(&isp1362_hcd->lock, flags);
+        port = isp1362_read_reg32(isp1362_hcd, HCRHDESCA) & RH_A_NDP;
+        while (port--) {
+                u32 stat = isp1362_read_reg32(isp1362_hcd, HCRHPORT1 + port);
+
+                /* force global, not selective, resume */
+                if (!(stat & RH_PS_PSS)) {
+                        DBG(0, "%s: Not Resuming RH port %d\n", __func__, port);
+                        continue;
+                }
+                DBG(0, "%s: Resuming RH port %d\n", __func__, port);
+                isp1362_write_reg32(isp1362_hcd, HCRHPORT1 + port, RH_PS_POCI);
+        }
+        spin_unlock_irqrestore(&isp1362_hcd->lock, flags);
+
+        /* Some controllers (lucent) need extra-long delays */
+        hcd->state = HC_STATE_RESUMING;
+        mdelay(20 /* usb 11.5.1.10 */ + 15);
+
+        isp1362_hcd->hc_control = OHCI_USB_OPER;
+        spin_lock_irqsave(&isp1362_hcd->lock, flags);
+        isp1362_show_reg(isp1362_hcd, HCCONTROL);
+        isp1362_write_reg32(isp1362_hcd, HCCONTROL, isp1362_hcd->hc_control);
+        spin_unlock_irqrestore(&isp1362_hcd->lock, flags);
+        /* TRSMRCY */
+        msleep(10);
+
+        /* keep it alive for ~5x suspend + resume costs */
+        isp1362_hcd->next_statechange = jiffies + msecs_to_jiffies(250);
+
+        hcd->self.root_hub->dev.power.power_state = PMSG_ON;
+        hcd->state = HC_STATE_RUNNING;
+        return 0;
+}
+#else
+#define isp1362_bus_suspend     NULL
+#define isp1362_bus_resume      NULL
+#endif
+
+/*-------------------------------------------------------------------------*/
+
+#ifdef STUB_DEBUG_FILE
+
+static inline void create_debug_file(struct isp1362_hcd *isp1362_hcd)
+{
+}
+static inline void remove_debug_file(struct isp1362_hcd *isp1362_hcd)
+{
+}
+
+#else
+
+#include <linux/proc_fs.h>
+#include <linux/seq_file.h>
+
+static void dump_irq(struct seq_file *s, char *label, u16 mask)
+{
+        seq_printf(s, "%-15s %04x%s%s%s%s%s%s\n", label, mask,
+                   mask & HCuPINT_CLKRDY ? " clkrdy" : "",
+                   mask & HCuPINT_SUSP ? " susp" : "",
+                   mask & HCuPINT_OPR ? " opr" : "",
+                   mask & HCuPINT_EOT ? " eot" : "",
+                   mask & HCuPINT_ATL ? " atl" : "",
+                   mask & HCuPINT_SOF ? " sof" : "");
+}
+
+static void dump_int(struct seq_file *s, char *label, u32 mask)
+{
+        seq_printf(s, "%-15s %08x%s%s%s%s%s%s%s\n", label, mask,
+                   mask & OHCI_INTR_MIE ? " MIE" : "",
+                   mask & OHCI_INTR_RHSC ? " rhsc" : "",
+                   mask & OHCI_INTR_FNO ? " fno" : "",
+                   mask & OHCI_INTR_UE ? " ue" : "",
+                   mask & OHCI_INTR_RD ? " rd" : "",
+                   mask & OHCI_INTR_SF ? " sof" : "",
+                   mask & OHCI_INTR_SO ? " so" : "");
+}
+
+static void dump_ctrl(struct seq_file *s, char *label, u32 mask)
+{
+        seq_printf(s, "%-15s %08x%s%s%s\n", label, mask,
+                   mask & OHCI_CTRL_RWC ? " rwc" : "",
+                   mask & OHCI_CTRL_RWE ? " rwe" : "",
+                   ({
+                           char *hcfs;
+                           switch (mask & OHCI_CTRL_HCFS) {
+                           case OHCI_USB_OPER:
+                                   hcfs = " oper";
+                                   break;
+                           case OHCI_USB_RESET:
+                                   hcfs = " reset";
+                                   break;
+                           case OHCI_USB_RESUME:
+                                   hcfs = " resume";
+                                   break;
+                           case OHCI_USB_SUSPEND:
+                                   hcfs = " suspend";
+                                   break;
+                           default:
+                                   hcfs = " ?";
+                           }
+                           hcfs;
+                   }));
+}
+
+static void dump_regs(struct seq_file *s, struct isp1362_hcd *isp1362_hcd)
+{
+        seq_printf(s, "HCREVISION [%02x] %08x\n", ISP1362_REG_NO(ISP1362_REG_HCREVISION),
+                   isp1362_read_reg32(isp1362_hcd, HCREVISION));
+        seq_printf(s, "HCCONTROL  [%02x] %08x\n", ISP1362_REG_NO(ISP1362_REG_HCCONTROL),
+                   isp1362_read_reg32(isp1362_hcd, HCCONTROL));
+        seq_printf(s, "HCCMDSTAT  [%02x] %08x\n", ISP1362_REG_NO(ISP1362_REG_HCCMDSTAT),
+                   isp1362_read_reg32(isp1362_hcd, HCCMDSTAT));
+        seq_printf(s, "HCINTSTAT  [%02x] %08x\n", ISP1362_REG_NO(ISP1362_REG_HCINTSTAT),
+                   isp1362_read_reg32(isp1362_hcd, HCINTSTAT));
+        seq_printf(s, "HCINTENB   [%02x] %08x\n", ISP1362_REG_NO(ISP1362_REG_HCINTENB),
+                   isp1362_read_reg32(isp1362_hcd, HCINTENB));
+        seq_printf(s, "HCFMINTVL  [%02x] %08x\n", ISP1362_REG_NO(ISP1362_REG_HCFMINTVL),
+                   isp1362_read_reg32(isp1362_hcd, HCFMINTVL));
+        seq_printf(s, "HCFMREM    [%02x] %08x\n", ISP1362_REG_NO(ISP1362_REG_HCFMREM),
+                   isp1362_read_reg32(isp1362_hcd, HCFMREM));
+        seq_printf(s, "HCFMNUM    [%02x] %08x\n", ISP1362_REG_NO(ISP1362_REG_HCFMNUM),
+                   isp1362_read_reg32(isp1362_hcd, HCFMNUM));
+        seq_printf(s, "HCLSTHRESH [%02x] %08x\n", ISP1362_REG_NO(ISP1362_REG_HCLSTHRESH),
+                   isp1362_read_reg32(isp1362_hcd, HCLSTHRESH));
+        seq_printf(s, "HCRHDESCA  [%02x] %08x\n", ISP1362_REG_NO(ISP1362_REG_HCRHDESCA),
+                   isp1362_read_reg32(isp1362_hcd, HCRHDESCA));
+        seq_printf(s, "HCRHDESCB  [%02x] %08x\n", ISP1362_REG_NO(ISP1362_REG_HCRHDESCB),
+                   isp1362_read_reg32(isp1362_hcd, HCRHDESCB));
+        seq_printf(s, "HCRHSTATUS [%02x] %08x\n", ISP1362_REG_NO(ISP1362_REG_HCRHSTATUS),
+                   isp1362_read_reg32(isp1362_hcd, HCRHSTATUS));
+        seq_printf(s, "HCRHPORT1  [%02x] %08x\n", ISP1362_REG_NO(ISP1362_REG_HCRHPORT1),
+                   isp1362_read_reg32(isp1362_hcd, HCRHPORT1));
+        seq_printf(s, "HCRHPORT2  [%02x] %08x\n", ISP1362_REG_NO(ISP1362_REG_HCRHPORT2),
+                   isp1362_read_reg32(isp1362_hcd, HCRHPORT2));
+        seq_printf(s, "\n");
+        seq_printf(s, "HCHWCFG    [%02x]     %04x\n", ISP1362_REG_NO(ISP1362_REG_HCHWCFG),
+                   isp1362_read_reg16(isp1362_hcd, HCHWCFG));
+        seq_printf(s, "HCDMACFG   [%02x]     %04x\n", ISP1362_REG_NO(ISP1362_REG_HCDMACFG),
+                   isp1362_read_reg16(isp1362_hcd, HCDMACFG));
+        seq_printf(s, "HCXFERCTR  [%02x]     %04x\n", ISP1362_REG_NO(ISP1362_REG_HCXFERCTR),
+                   isp1362_read_reg16(isp1362_hcd, HCXFERCTR));
+        seq_printf(s, "HCuPINT    [%02x]     %04x\n", ISP1362_REG_NO(ISP1362_REG_HCuPINT),
+                   isp1362_read_reg16(isp1362_hcd, HCuPINT));
+        seq_printf(s, "HCuPINTENB [%02x]     %04x\n", ISP1362_REG_NO(ISP1362_REG_HCuPINTENB),
+                   isp1362_read_reg16(isp1362_hcd, HCuPINTENB));
+        seq_printf(s, "HCCHIPID   [%02x]     %04x\n", ISP1362_REG_NO(ISP1362_REG_HCCHIPID),
+                   isp1362_read_reg16(isp1362_hcd, HCCHIPID));
+        seq_printf(s, "HCSCRATCH  [%02x]     %04x\n", ISP1362_REG_NO(ISP1362_REG_HCSCRATCH),
+                   isp1362_read_reg16(isp1362_hcd, HCSCRATCH));
+        seq_printf(s, "HCBUFSTAT  [%02x]     %04x\n", ISP1362_REG_NO(ISP1362_REG_HCBUFSTAT),
+                   isp1362_read_reg16(isp1362_hcd, HCBUFSTAT));
+        seq_printf(s, "HCDIRADDR  [%02x] %08x\n", ISP1362_REG_NO(ISP1362_REG_HCDIRADDR),
+                   isp1362_read_reg32(isp1362_hcd, HCDIRADDR));
+#if 0
+        seq_printf(s, "HCDIRDATA  [%02x]     %04x\n", ISP1362_REG_NO(HCDIRDATA),
+                   isp1362_read_reg16(isp1362_hcd, HCDIRDATA));
+#endif
+        seq_printf(s, "HCISTLBUFSZ[%02x]     %04x\n", ISP1362_REG_NO(ISP1362_REG_HCISTLBUFSZ),
+                   isp1362_read_reg16(isp1362_hcd, HCISTLBUFSZ));
+        seq_printf(s, "HCISTLRATE [%02x]     %04x\n", ISP1362_REG_NO(ISP1362_REG_HCISTLRATE),
+                   isp1362_read_reg16(isp1362_hcd, HCISTLRATE));
+        seq_printf(s, "\n");
+        seq_printf(s, "HCINTLBUFSZ[%02x]     %04x\n", ISP1362_REG_NO(ISP1362_REG_HCINTLBUFSZ),
+                   isp1362_read_reg16(isp1362_hcd, HCINTLBUFSZ));
+        seq_printf(s, "HCINTLBLKSZ[%02x]     %04x\n", ISP1362_REG_NO(ISP1362_REG_HCINTLBLKSZ),
+                   isp1362_read_reg16(isp1362_hcd, HCINTLBLKSZ));
+        seq_printf(s, "HCINTLDONE [%02x] %08x\n", ISP1362_REG_NO(ISP1362_REG_HCINTLDONE),
+                   isp1362_read_reg32(isp1362_hcd, HCINTLDONE));
+        seq_printf(s, "HCINTLSKIP [%02x] %08x\n", ISP1362_REG_NO(ISP1362_REG_HCINTLSKIP),
+                   isp1362_read_reg32(isp1362_hcd, HCINTLSKIP));
+        seq_printf(s, "HCINTLLAST [%02x] %08x\n", ISP1362_REG_NO(ISP1362_REG_HCINTLLAST),
+                   isp1362_read_reg32(isp1362_hcd, HCINTLLAST));
+        seq_printf(s, "HCINTLCURR [%02x]     %04x\n", ISP1362_REG_NO(ISP1362_REG_HCINTLCURR),
+                   isp1362_read_reg16(isp1362_hcd, HCINTLCURR));
+        seq_printf(s, "\n");
+        seq_printf(s, "HCATLBUFSZ [%02x]     %04x\n", ISP1362_REG_NO(ISP1362_REG_HCATLBUFSZ),
+                   isp1362_read_reg16(isp1362_hcd, HCATLBUFSZ));
+        seq_printf(s, "HCATLBLKSZ [%02x]     %04x\n", ISP1362_REG_NO(ISP1362_REG_HCATLBLKSZ),
+                   isp1362_read_reg16(isp1362_hcd, HCATLBLKSZ));
+#if 0
+        seq_printf(s, "HCATLDONE  [%02x] %08x\n", ISP1362_REG_NO(ISP1362_REG_HCATLDONE),
+                   isp1362_read_reg32(isp1362_hcd, HCATLDONE));
+#endif
+        seq_printf(s, "HCATLSKIP  [%02x] %08x\n", ISP1362_REG_NO(ISP1362_REG_HCATLSKIP),
+                   isp1362_read_reg32(isp1362_hcd, HCATLSKIP));
+        seq_printf(s, "HCATLLAST  [%02x] %08x\n", ISP1362_REG_NO(ISP1362_REG_HCATLLAST),
+                   isp1362_read_reg32(isp1362_hcd, HCATLLAST));
+        seq_printf(s, "HCATLCURR  [%02x]     %04x\n", ISP1362_REG_NO(ISP1362_REG_HCATLCURR),
+                   isp1362_read_reg16(isp1362_hcd, HCATLCURR));
+        seq_printf(s, "\n");
+        seq_printf(s, "HCATLDTC   [%02x]     %04x\n", ISP1362_REG_NO(ISP1362_REG_HCATLDTC),
+                   isp1362_read_reg16(isp1362_hcd, HCATLDTC));
+        seq_printf(s, "HCATLDTCTO [%02x]     %04x\n", ISP1362_REG_NO(ISP1362_REG_HCATLDTCTO),
+                   isp1362_read_reg16(isp1362_hcd, HCATLDTCTO));
+}
+
+static int proc_isp1362_show(struct seq_file *s, void *unused)
+{
+        struct isp1362_hcd *isp1362_hcd = s->private;
+        struct isp1362_ep *ep;
+        int i;
+
+        seq_printf(s, "%s\n%s version %s\n",
+                   isp1362_hcd_to_hcd(isp1362_hcd)->product_desc, hcd_name, DRIVER_VERSION);
+
+        /* collect statistics to help estimate potential win for
+         * DMA engines that care about alignment (PXA)
+         */
+        seq_printf(s, "alignment:  16b/%ld 8b/%ld 4b/%ld 2b/%ld 1b/%ld\n",
+                   isp1362_hcd->stat16, isp1362_hcd->stat8, isp1362_hcd->stat4,
+                   isp1362_hcd->stat2, isp1362_hcd->stat1);
+        seq_printf(s, "max # ptds in ATL  fifo: %d\n", isp1362_hcd->atl_queue.stat_maxptds);
+        seq_printf(s, "max # ptds in INTL fifo: %d\n", isp1362_hcd->intl_queue.stat_maxptds);
+        seq_printf(s, "max # ptds in ISTL fifo: %d\n",
+                   max(isp1362_hcd->istl_queue[0] .stat_maxptds,
+                       isp1362_hcd->istl_queue[1] .stat_maxptds));
+
+        /* FIXME: don't show the following in suspended state */
+        spin_lock_irq(&isp1362_hcd->lock);
+
+        dump_irq(s, "hc_irq_enable", isp1362_read_reg16(isp1362_hcd, HCuPINTENB));
+        dump_irq(s, "hc_irq_status", isp1362_read_reg16(isp1362_hcd, HCuPINT));
+        dump_int(s, "ohci_int_enable", isp1362_read_reg32(isp1362_hcd, HCINTENB));
+        dump_int(s, "ohci_int_status", isp1362_read_reg32(isp1362_hcd, HCINTSTAT));
+        dump_ctrl(s, "ohci_control", isp1362_read_reg32(isp1362_hcd, HCCONTROL));
+
+        for (i = 0; i < NUM_ISP1362_IRQS; i++)
+                if (isp1362_hcd->irq_stat[i])
+                        seq_printf(s, "%-15s: %d\n",
+                                   ISP1362_INT_NAME(i), isp1362_hcd->irq_stat[i]);
+
+        dump_regs(s, isp1362_hcd);
+        list_for_each_entry(ep, &isp1362_hcd->async, schedule) {
+                struct urb *urb;
+
+                seq_printf(s, "%p, ep%d%s, maxpacket %d:\n", ep, ep->epnum,
+                           ({
+                                   char *s;
+                                   switch (ep->nextpid) {
+                                   case USB_PID_IN:
+                                           s = "in";
+                                           break;
+                                   case USB_PID_OUT:
+                                           s = "out";
+                                           break;
+                                   case USB_PID_SETUP:
+                                           s = "setup";
+                                           break;
+                                   case USB_PID_ACK:
+                                           s = "status";
+                                           break;
+                                   default:
+                                           s = "?";
+                                           break;
+                                   };
+                                   s;}), ep->maxpacket) ;
+                list_for_each_entry(urb, &ep->hep->urb_list, urb_list) {
+                        seq_printf(s, "  urb%p, %d/%d\n", urb,
+                                   urb->actual_length,
+                                   urb->transfer_buffer_length);
+                }
+        }
+        if (!list_empty(&isp1362_hcd->async))
+                seq_printf(s, "\n");
+        dump_ptd_queue(&isp1362_hcd->atl_queue);
+
+        seq_printf(s, "periodic size= %d\n", PERIODIC_SIZE);
+
+        list_for_each_entry(ep, &isp1362_hcd->periodic, schedule) {
+                seq_printf(s, "branch:%2d load:%3d PTD[%d] $%04x:\n", ep->branch,
+                           isp1362_hcd->load[ep->branch], ep->ptd_index, ep->ptd_offset);
+
+                seq_printf(s, "   %d/%p (%sdev%d ep%d%s max %d)\n",
+                           ep->interval, ep,
+                           (ep->udev->speed == USB_SPEED_FULL) ? "" : "ls ",
+                           ep->udev->devnum, ep->epnum,
+                           (ep->epnum == 0) ? "" :
+                           ((ep->nextpid == USB_PID_IN) ?
+                            "in" : "out"), ep->maxpacket);
+        }
+        dump_ptd_queue(&isp1362_hcd->intl_queue);
+
+        seq_printf(s, "ISO:\n");
+
+        list_for_each_entry(ep, &isp1362_hcd->isoc, schedule) {
+                seq_printf(s, "   %d/%p (%sdev%d ep%d%s max %d)\n",
+                           ep->interval, ep,
+                           (ep->udev->speed == USB_SPEED_FULL) ? "" : "ls ",
+                           ep->udev->devnum, ep->epnum,
+                           (ep->epnum == 0) ? "" :
+                           ((ep->nextpid == USB_PID_IN) ?
+                            "in" : "out"), ep->maxpacket);
+        }
+
+        spin_unlock_irq(&isp1362_hcd->lock);
+        seq_printf(s, "\n");
+
+        return 0;
+}
+
+static int proc_isp1362_open(struct inode *inode, struct file *file)
+{
+        return single_open(file, proc_isp1362_show, PDE(inode)->data);
+}
+
+static const struct file_operations proc_ops = {
+        .open = proc_isp1362_open,
+        .read = seq_read,
+        .llseek = seq_lseek,
+        .release = single_release,
+};
+
+/* expect just one isp1362_hcd per system */
+static const char proc_filename[] = "driver/isp1362";
+
+static void create_debug_file(struct isp1362_hcd *isp1362_hcd)
+{
+        struct proc_dir_entry *pde;
+
+        pde = create_proc_entry(proc_filename, 0, NULL);
+        if (pde == NULL) {
+                pr_warning("%s: Failed to create debug file '%s'\n", __func__, proc_filename);
+                return;
+        }
+
+        pde->proc_fops = &proc_ops;
+        pde->data = isp1362_hcd;
+        isp1362_hcd->pde = pde;
+}
+
+static void remove_debug_file(struct isp1362_hcd *isp1362_hcd)
+{
+        if (isp1362_hcd->pde)
+                remove_proc_entry(proc_filename, 0);
+}
+
+#endif
+
+/*-------------------------------------------------------------------------*/
+
+static void isp1362_sw_reset(struct isp1362_hcd *isp1362_hcd)
+{
+        int tmp = 20;
+        unsigned long flags;
+
+        spin_lock_irqsave(&isp1362_hcd->lock, flags);
+
+        isp1362_write_reg16(isp1362_hcd, HCSWRES, HCSWRES_MAGIC);
+        isp1362_write_reg32(isp1362_hcd, HCCMDSTAT, OHCI_HCR);
+        while (--tmp) {
+                mdelay(1);
+                if (!(isp1362_read_reg32(isp1362_hcd, HCCMDSTAT) & OHCI_HCR))
+                        break;
+        }
+        if (!tmp)
+                pr_err("Software reset timeout\n");
+        spin_unlock_irqrestore(&isp1362_hcd->lock, flags);
+}
+
+static int isp1362_mem_config(struct usb_hcd *hcd)
+{
+        struct isp1362_hcd *isp1362_hcd = hcd_to_isp1362_hcd(hcd);
+        unsigned long flags;
+        u32 total;
+        u16 istl_size = ISP1362_ISTL_BUFSIZE;
+        u16 intl_blksize = ISP1362_INTL_BLKSIZE + PTD_HEADER_SIZE;
+        u16 intl_size = ISP1362_INTL_BUFFERS * intl_blksize;
+        u16 atl_blksize = ISP1362_ATL_BLKSIZE + PTD_HEADER_SIZE;
+        u16 atl_buffers = (ISP1362_BUF_SIZE - (istl_size + intl_size)) / atl_blksize;
+        u16 atl_size;
+        int i;
+
+        WARN_ON(istl_size & 3);
+        WARN_ON(atl_blksize & 3);
+        WARN_ON(intl_blksize & 3);
+        WARN_ON(atl_blksize < PTD_HEADER_SIZE);
+        WARN_ON(intl_blksize < PTD_HEADER_SIZE);
+
+        BUG_ON((unsigned)ISP1362_INTL_BUFFERS > 32);
+        if (atl_buffers > 32)
+                atl_buffers = 32;
+        atl_size = atl_buffers * atl_blksize;
+        total = atl_size + intl_size + istl_size;
+        dev_info(hcd->self.controller, "ISP1362 Memory usage:\n");
+        dev_info(hcd->self.controller, "  ISTL:    2 * %4d:     %4d @ $%04x:$%04x\n",
+                 istl_size / 2, istl_size, 0, istl_size / 2);
+        dev_info(hcd->self.controller, "  INTL: %4d * (%3u+8):  %4d @ $%04x\n",
+                 ISP1362_INTL_BUFFERS, intl_blksize - PTD_HEADER_SIZE,
+                 intl_size, istl_size);
+        dev_info(hcd->self.controller, "  ATL : %4d * (%3u+8):  %4d @ $%04x\n",
+                 atl_buffers, atl_blksize - PTD_HEADER_SIZE,
+                 atl_size, istl_size + intl_size);
+        dev_info(hcd->self.controller, "  USED/FREE:   %4d      %4d\n", total,
+                 ISP1362_BUF_SIZE - total);
+
+        if (total > ISP1362_BUF_SIZE) {
+                dev_err(hcd->self.controller, "%s: Memory requested: %d, available %d\n",
+                        __func__, total, ISP1362_BUF_SIZE);
+                return -ENOMEM;
+        }
+
+        total = istl_size + intl_size + atl_size;
+        spin_lock_irqsave(&isp1362_hcd->lock, flags);
+
+        for (i = 0; i < 2; i++) {
+                isp1362_hcd->istl_queue[i].buf_start = i * istl_size / 2,
+                isp1362_hcd->istl_queue[i].buf_size = istl_size / 2;
+                isp1362_hcd->istl_queue[i].blk_size = 4;
+                INIT_LIST_HEAD(&isp1362_hcd->istl_queue[i].active);
+                snprintf(isp1362_hcd->istl_queue[i].name,
+                         sizeof(isp1362_hcd->istl_queue[i].name), "ISTL%d", i);
+                DBG(3, "%s: %5s buf $%04x %d\n", __func__,
+                     isp1362_hcd->istl_queue[i].name,
+                     isp1362_hcd->istl_queue[i].buf_start,
+                     isp1362_hcd->istl_queue[i].buf_size);
+        }
+        isp1362_write_reg16(isp1362_hcd, HCISTLBUFSZ, istl_size / 2);
+
+        isp1362_hcd->intl_queue.buf_start = istl_size;
+        isp1362_hcd->intl_queue.buf_size = intl_size;
+        isp1362_hcd->intl_queue.buf_count = ISP1362_INTL_BUFFERS;
+        isp1362_hcd->intl_queue.blk_size = intl_blksize;
+        isp1362_hcd->intl_queue.buf_avail = isp1362_hcd->intl_queue.buf_count;
+        isp1362_hcd->intl_queue.skip_map = ~0;
+        INIT_LIST_HEAD(&isp1362_hcd->intl_queue.active);
+
+        isp1362_write_reg16(isp1362_hcd, HCINTLBUFSZ,
+                            isp1362_hcd->intl_queue.buf_size);
+        isp1362_write_reg16(isp1362_hcd, HCINTLBLKSZ,
+                            isp1362_hcd->intl_queue.blk_size - PTD_HEADER_SIZE);
+        isp1362_write_reg32(isp1362_hcd, HCINTLSKIP, ~0);
+        isp1362_write_reg32(isp1362_hcd, HCINTLLAST,
+                            1 << (ISP1362_INTL_BUFFERS - 1));
+
+        isp1362_hcd->atl_queue.buf_start = istl_size + intl_size;
+        isp1362_hcd->atl_queue.buf_size = atl_size;
+        isp1362_hcd->atl_queue.buf_count = atl_buffers;
+        isp1362_hcd->atl_queue.blk_size = atl_blksize;
+        isp1362_hcd->atl_queue.buf_avail = isp1362_hcd->atl_queue.buf_count;
+        isp1362_hcd->atl_queue.skip_map = ~0;
+        INIT_LIST_HEAD(&isp1362_hcd->atl_queue.active);
+
+        isp1362_write_reg16(isp1362_hcd, HCATLBUFSZ,
+                            isp1362_hcd->atl_queue.buf_size);
+        isp1362_write_reg16(isp1362_hcd, HCATLBLKSZ,
+                            isp1362_hcd->atl_queue.blk_size - PTD_HEADER_SIZE);
+        isp1362_write_reg32(isp1362_hcd, HCATLSKIP, ~0);
+        isp1362_write_reg32(isp1362_hcd, HCATLLAST,
+                            1 << (atl_buffers - 1));
+
+        snprintf(isp1362_hcd->atl_queue.name,
+                 sizeof(isp1362_hcd->atl_queue.name), "ATL");
+        snprintf(isp1362_hcd->intl_queue.name,
+                 sizeof(isp1362_hcd->intl_queue.name), "INTL");
+        DBG(3, "%s: %5s buf $%04x %2d * %4d = %4d\n", __func__,
+             isp1362_hcd->intl_queue.name,
+             isp1362_hcd->intl_queue.buf_start,
+             ISP1362_INTL_BUFFERS, isp1362_hcd->intl_queue.blk_size,
+             isp1362_hcd->intl_queue.buf_size);
+        DBG(3, "%s: %5s buf $%04x %2d * %4d = %4d\n", __func__,
+             isp1362_hcd->atl_queue.name,
+             isp1362_hcd->atl_queue.buf_start,
+             atl_buffers, isp1362_hcd->atl_queue.blk_size,
+             isp1362_hcd->atl_queue.buf_size);
+
+        spin_unlock_irqrestore(&isp1362_hcd->lock, flags);
+
+        return 0;
+}
+
+static int isp1362_hc_reset(struct usb_hcd *hcd)
+{
+        int ret = 0;
+        struct isp1362_hcd *isp1362_hcd = hcd_to_isp1362_hcd(hcd);
+        unsigned long t;
+        unsigned long timeout = 100;
+        unsigned long flags;
+        int clkrdy = 0;
+
+        pr_info("%s:\n", __func__);
+
+        if (isp1362_hcd->board && isp1362_hcd->board->reset) {
+                isp1362_hcd->board->reset(hcd->self.controller, 1);
+                msleep(20);
+                if (isp1362_hcd->board->clock)
+                        isp1362_hcd->board->clock(hcd->self.controller, 1);
+                isp1362_hcd->board->reset(hcd->self.controller, 0);
+        } else
+                isp1362_sw_reset(isp1362_hcd);
+
+        /* chip has been reset. First we need to see a clock */
+        t = jiffies + msecs_to_jiffies(timeout);
+        while (!clkrdy && time_before_eq(jiffies, t)) {
+                spin_lock_irqsave(&isp1362_hcd->lock, flags);
+                clkrdy = isp1362_read_reg16(isp1362_hcd, HCuPINT) & HCuPINT_CLKRDY;
+                spin_unlock_irqrestore(&isp1362_hcd->lock, flags);
+                if (!clkrdy)
+                        msleep(4);
+        }
+
+        spin_lock_irqsave(&isp1362_hcd->lock, flags);
+        isp1362_write_reg16(isp1362_hcd, HCuPINT, HCuPINT_CLKRDY);
+        spin_unlock_irqrestore(&isp1362_hcd->lock, flags);
+        if (!clkrdy) {
+                pr_err("Clock not ready after %lums\n", timeout);
+                ret = -ENODEV;
+        }
+        return ret;
+}
+
+static void isp1362_hc_stop(struct usb_hcd *hcd)
+{
+        struct isp1362_hcd *isp1362_hcd = hcd_to_isp1362_hcd(hcd);
+        unsigned long flags;
+        u32 tmp;
+
+        pr_info("%s:\n", __func__);
+
+        del_timer_sync(&hcd->rh_timer);
+
+        spin_lock_irqsave(&isp1362_hcd->lock, flags);
+
+        isp1362_write_reg16(isp1362_hcd, HCuPINTENB, 0);
+
+        /* Switch off power for all ports */
+        tmp = isp1362_read_reg32(isp1362_hcd, HCRHDESCA);
+        tmp &= ~(RH_A_NPS | RH_A_PSM);
+        isp1362_write_reg32(isp1362_hcd, HCRHDESCA, tmp);
+        isp1362_write_reg32(isp1362_hcd, HCRHSTATUS, RH_HS_LPS);
+
+        /* Reset the chip */
+        if (isp1362_hcd->board && isp1362_hcd->board->reset)
+                isp1362_hcd->board->reset(hcd->self.controller, 1);
+        else
+                isp1362_sw_reset(isp1362_hcd);
+
+        if (isp1362_hcd->board && isp1362_hcd->board->clock)
+                isp1362_hcd->board->clock(hcd->self.controller, 0);
+
+        spin_unlock_irqrestore(&isp1362_hcd->lock, flags);
+}
+
+#ifdef CHIP_BUFFER_TEST
+static int isp1362_chip_test(struct isp1362_hcd *isp1362_hcd)
+{
+        int ret = 0;
+        u16 *ref;
+        unsigned long flags;
+
+        ref = kmalloc(2 * ISP1362_BUF_SIZE, GFP_KERNEL);
+        if (ref) {
+                int offset;
+                u16 *tst = &ref[ISP1362_BUF_SIZE / 2];
+
+                for (offset = 0; offset < ISP1362_BUF_SIZE / 2; offset++) {
+                        ref[offset] = ~offset;
+                        tst[offset] = offset;
+                }
+
+                for (offset = 0; offset < 4; offset++) {
+                        int j;
+
+                        for (j = 0; j < 8; j++) {
+                                spin_lock_irqsave(&isp1362_hcd->lock, flags);
+                                isp1362_write_buffer(isp1362_hcd, (u8 *)ref + offset, 0, j);
+                                isp1362_read_buffer(isp1362_hcd, (u8 *)tst + offset, 0, j);
+                                spin_unlock_irqrestore(&isp1362_hcd->lock, flags);
+
+                                if (memcmp(ref, tst, j)) {
+                                        ret = -ENODEV;
+                                        pr_err("%s: memory check with %d byte offset %d failed\n",
+                                            __func__, j, offset);
+                                        dump_data((u8 *)ref + offset, j);
+                                        dump_data((u8 *)tst + offset, j);
+                                }
+                        }
+                }
+
+                spin_lock_irqsave(&isp1362_hcd->lock, flags);
+                isp1362_write_buffer(isp1362_hcd, ref, 0, ISP1362_BUF_SIZE);
+                isp1362_read_buffer(isp1362_hcd, tst, 0, ISP1362_BUF_SIZE);
+                spin_unlock_irqrestore(&isp1362_hcd->lock, flags);
+
+                if (memcmp(ref, tst, ISP1362_BUF_SIZE)) {
+                        ret = -ENODEV;
+                        pr_err("%s: memory check failed\n", __func__);
+                        dump_data((u8 *)tst, ISP1362_BUF_SIZE / 2);
+                }
+
+                for (offset = 0; offset < 256; offset++) {
+                        int test_size = 0;
+
+                        yield();
+
+                        memset(tst, 0, ISP1362_BUF_SIZE);
+                        spin_lock_irqsave(&isp1362_hcd->lock, flags);
+                        isp1362_write_buffer(isp1362_hcd, tst, 0, ISP1362_BUF_SIZE);
+                        isp1362_read_buffer(isp1362_hcd, tst, 0, ISP1362_BUF_SIZE);
+                        spin_unlock_irqrestore(&isp1362_hcd->lock, flags);
+                        if (memcmp(tst, tst + (ISP1362_BUF_SIZE / (2 * sizeof(*tst))),
+                                   ISP1362_BUF_SIZE / 2)) {
+                                pr_err("%s: Failed to clear buffer\n", __func__);
+                                dump_data((u8 *)tst, ISP1362_BUF_SIZE);
+                                break;
+                        }
+                        spin_lock_irqsave(&isp1362_hcd->lock, flags);
+                        isp1362_write_buffer(isp1362_hcd, ref, offset * 2, PTD_HEADER_SIZE);
+                        isp1362_write_buffer(isp1362_hcd, ref + PTD_HEADER_SIZE / sizeof(*ref),
+                                             offset * 2 + PTD_HEADER_SIZE, test_size);
+                        isp1362_read_buffer(isp1362_hcd, tst, offset * 2,
+                                            PTD_HEADER_SIZE + test_size);
+                        spin_unlock_irqrestore(&isp1362_hcd->lock, flags);
+                        if (memcmp(ref, tst, PTD_HEADER_SIZE + test_size)) {
+                                dump_data(((u8 *)ref) + offset, PTD_HEADER_SIZE + test_size);
+                                dump_data((u8 *)tst, PTD_HEADER_SIZE + test_size);
+                                spin_lock_irqsave(&isp1362_hcd->lock, flags);
+                                isp1362_read_buffer(isp1362_hcd, tst, offset * 2,
+                                                    PTD_HEADER_SIZE + test_size);
+                                spin_unlock_irqrestore(&isp1362_hcd->lock, flags);
+                                if (memcmp(ref, tst, PTD_HEADER_SIZE + test_size)) {
+                                        ret = -ENODEV;
+                                        pr_err("%s: memory check with offset %02x failed\n",
+                                            __func__, offset);
+                                        break;
+                                }
+                                pr_warning("%s: memory check with offset %02x ok after second read\n",
+                                     __func__, offset);
+                        }
+                }
+                kfree(ref);
+        }
+        return ret;
+}
+#endif
+
+static int isp1362_hc_start(struct usb_hcd *hcd)
+{
+        int ret;
+        struct isp1362_hcd *isp1362_hcd = hcd_to_isp1362_hcd(hcd);
+        struct isp1362_platform_data *board = isp1362_hcd->board;
+        u16 hwcfg;
+        u16 chipid;
+        unsigned long flags;
+
+        pr_info("%s:\n", __func__);
+
+        spin_lock_irqsave(&isp1362_hcd->lock, flags);
+        chipid = isp1362_read_reg16(isp1362_hcd, HCCHIPID);
+        spin_unlock_irqrestore(&isp1362_hcd->lock, flags);
+
+        if ((chipid & HCCHIPID_MASK) != HCCHIPID_MAGIC) {
+                pr_err("%s: Invalid chip ID %04x\n", __func__, chipid);
+                return -ENODEV;
+        }
+
+#ifdef CHIP_BUFFER_TEST
+        ret = isp1362_chip_test(isp1362_hcd);
+        if (ret)
+                return -ENODEV;
+#endif
+        spin_lock_irqsave(&isp1362_hcd->lock, flags);
+        /* clear interrupt status and disable all interrupt sources */
+        isp1362_write_reg16(isp1362_hcd, HCuPINT, 0xff);
+        isp1362_write_reg16(isp1362_hcd, HCuPINTENB, 0);
+
+        /* HW conf */
+        hwcfg = HCHWCFG_INT_ENABLE | HCHWCFG_DBWIDTH(1);
+        if (board->sel15Kres)
+                hwcfg |= HCHWCFG_PULLDOWN_DS2 |
+                        ((MAX_ROOT_PORTS > 1) ? HCHWCFG_PULLDOWN_DS1 : 0);
+        if (board->clknotstop)
+                hwcfg |= HCHWCFG_CLKNOTSTOP;
+        if (board->oc_enable)
+                hwcfg |= HCHWCFG_ANALOG_OC;
+        if (board->int_act_high)
+                hwcfg |= HCHWCFG_INT_POL;
+        if (board->int_edge_triggered)
+                hwcfg |= HCHWCFG_INT_TRIGGER;
+        if (board->dreq_act_high)
+                hwcfg |= HCHWCFG_DREQ_POL;
+        if (board->dack_act_high)
+                hwcfg |= HCHWCFG_DACK_POL;
+        isp1362_write_reg16(isp1362_hcd, HCHWCFG, hwcfg);
+        isp1362_show_reg(isp1362_hcd, HCHWCFG);
+        isp1362_write_reg16(isp1362_hcd, HCDMACFG, 0);
+        spin_unlock_irqrestore(&isp1362_hcd->lock, flags);
+
+        ret = isp1362_mem_config(hcd);
+        if (ret)
+                return ret;
+
+        spin_lock_irqsave(&isp1362_hcd->lock, flags);
+
+        /* Root hub conf */
+        isp1362_hcd->rhdesca = 0;
+        if (board->no_power_switching)
+                isp1362_hcd->rhdesca |= RH_A_NPS;
+        if (board->power_switching_mode)
+                isp1362_hcd->rhdesca |= RH_A_PSM;
+        if (board->potpg)
+                isp1362_hcd->rhdesca |= (board->potpg << 24) & RH_A_POTPGT;
+        else
+                isp1362_hcd->rhdesca |= (25 << 24) & RH_A_POTPGT;
+
+        isp1362_write_reg32(isp1362_hcd, HCRHDESCA, isp1362_hcd->rhdesca & ~RH_A_OCPM);
+        isp1362_write_reg32(isp1362_hcd, HCRHDESCA, isp1362_hcd->rhdesca | RH_A_OCPM);
+        isp1362_hcd->rhdesca = isp1362_read_reg32(isp1362_hcd, HCRHDESCA);
+
+        isp1362_hcd->rhdescb = RH_B_PPCM;
+        isp1362_write_reg32(isp1362_hcd, HCRHDESCB, isp1362_hcd->rhdescb);
+        isp1362_hcd->rhdescb = isp1362_read_reg32(isp1362_hcd, HCRHDESCB);
+
+        isp1362_read_reg32(isp1362_hcd, HCFMINTVL);
+        isp1362_write_reg32(isp1362_hcd, HCFMINTVL, (FSMP(FI) << 16) | FI);
+        isp1362_write_reg32(isp1362_hcd, HCLSTHRESH, LSTHRESH);
+
+        spin_unlock_irqrestore(&isp1362_hcd->lock, flags);
+
+        isp1362_hcd->hc_control = OHCI_USB_OPER;
+        hcd->state = HC_STATE_RUNNING;
+
+        spin_lock_irqsave(&isp1362_hcd->lock, flags);
+        /* Set up interrupts */
+        isp1362_hcd->intenb = OHCI_INTR_MIE | OHCI_INTR_RHSC | OHCI_INTR_UE;
+        isp1362_hcd->intenb |= OHCI_INTR_RD;
+        isp1362_hcd->irqenb = HCuPINT_OPR | HCuPINT_SUSP;
+        isp1362_write_reg32(isp1362_hcd, HCINTENB, isp1362_hcd->intenb);
+        isp1362_write_reg16(isp1362_hcd, HCuPINTENB, isp1362_hcd->irqenb);
+
+        /* Go operational */
+        isp1362_write_reg32(isp1362_hcd, HCCONTROL, isp1362_hcd->hc_control);
+        /* enable global power */
+        isp1362_write_reg32(isp1362_hcd, HCRHSTATUS, RH_HS_LPSC | RH_HS_DRWE);
+
+        spin_unlock_irqrestore(&isp1362_hcd->lock, flags);
+
+        return 0;
+}
+
+/*-------------------------------------------------------------------------*/
+
+static struct hc_driver isp1362_hc_driver = {
+        .description =          hcd_name,
+        .product_desc =         "ISP1362 Host Controller",
+        .hcd_priv_size =        sizeof(struct isp1362_hcd),
+
+        .irq =                  isp1362_irq,
+        .flags =                HCD_USB11 | HCD_MEMORY,
+
+        .reset =                isp1362_hc_reset,
+        .start =                isp1362_hc_start,
+        .stop =                 isp1362_hc_stop,
+
+        .urb_enqueue =          isp1362_urb_enqueue,
+        .urb_dequeue =          isp1362_urb_dequeue,
+        .endpoint_disable =     isp1362_endpoint_disable,
+
+        .get_frame_number =     isp1362_get_frame,
+
+        .hub_status_data =      isp1362_hub_status_data,
+        .hub_control =          isp1362_hub_control,
+        .bus_suspend =          isp1362_bus_suspend,
+        .bus_resume =           isp1362_bus_resume,
+};
+
+/*-------------------------------------------------------------------------*/
+
+#define resource_len(r) (((r)->end - (r)->start) + 1)
+
+static int __devexit isp1362_remove(struct platform_device *pdev)
+{
+        struct usb_hcd *hcd = platform_get_drvdata(pdev);
+        struct isp1362_hcd *isp1362_hcd = hcd_to_isp1362_hcd(hcd);
+        struct resource *res;
+
+        remove_debug_file(isp1362_hcd);
+        DBG(0, "%s: Removing HCD\n", __func__);
+        usb_remove_hcd(hcd);
+
+        DBG(0, "%s: Unmapping data_reg @ %08x\n", __func__,
+            (u32)isp1362_hcd->data_reg);
+        iounmap(isp1362_hcd->data_reg);
+
+        DBG(0, "%s: Unmapping addr_reg @ %08x\n", __func__,
+            (u32)isp1362_hcd->addr_reg);
+        iounmap(isp1362_hcd->addr_reg);
+
+        res = platform_get_resource(pdev, IORESOURCE_MEM, 1);
+        DBG(0, "%s: release mem_region: %08lx\n", __func__, (long unsigned int)res->start);
+        if (res)
+                release_mem_region(res->start, resource_len(res));
+
+        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        DBG(0, "%s: release mem_region: %08lx\n", __func__, (long unsigned int)res->start);
+        if (res)
+                release_mem_region(res->start, resource_len(res));
+
+        DBG(0, "%s: put_hcd\n", __func__);
+        usb_put_hcd(hcd);
+        DBG(0, "%s: Done\n", __func__);
+
+        return 0;
+}
+
+static int __init isp1362_probe(struct platform_device *pdev)
+{
+        struct usb_hcd *hcd;
+        struct isp1362_hcd *isp1362_hcd;
+        struct resource *addr, *data;
+        void __iomem *addr_reg;
+        void __iomem *data_reg;
+        int irq;
+        int retval = 0;
+
+        /* basic sanity checks first.  board-specific init logic should
+         * have initialized this the three resources and probably board
+         * specific platform_data.  we don't probe for IRQs, and do only
+         * minimal sanity checking.
+         */
+        if (pdev->num_resources < 3) {
+                retval = -ENODEV;
+                goto err1;
+        }
+
+        data = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        addr = platform_get_resource(pdev, IORESOURCE_MEM, 1);
+        irq = platform_get_irq(pdev, 0);
+        if (!addr || !data || irq < 0) {
+                retval = -ENODEV;
+                goto err1;
+        }
+
+#ifdef CONFIG_USB_HCD_DMA
+        if (pdev->dev.dma_mask) {
+                struct resource *dma_res = platform_get_resource(pdev, IORESOURCE_MEM, 2);
+
+                if (!dma_res) {
+                        retval = -ENODEV;
+                        goto err1;
+                }
+                isp1362_hcd->data_dma = dma_res->start;
+                isp1362_hcd->max_dma_size = resource_len(dma_res);
+        }
+#else
+        if (pdev->dev.dma_mask) {
+                DBG(1, "won't do DMA");
+                retval = -ENODEV;
+                goto err1;
+        }
+#endif
+
+        if (!request_mem_region(addr->start, resource_len(addr), hcd_name)) {
+                retval = -EBUSY;
+                goto err1;
+        }
+        addr_reg = ioremap(addr->start, resource_len(addr));
+        if (addr_reg == NULL) {
+                retval = -ENOMEM;
+                goto err2;
+        }
+
+        if (!request_mem_region(data->start, resource_len(data), hcd_name)) {
+                retval = -EBUSY;
+                goto err3;
+        }
+        data_reg = ioremap(data->start, resource_len(data));
+        if (data_reg == NULL) {
+                retval = -ENOMEM;
+                goto err4;
+        }
+
+        /* allocate and initialize hcd */
+        hcd = usb_create_hcd(&isp1362_hc_driver, &pdev->dev, dev_name(&pdev->dev));
+        if (!hcd) {
+                retval = -ENOMEM;
+                goto err5;
+        }
+        hcd->rsrc_start = data->start;
+        isp1362_hcd = hcd_to_isp1362_hcd(hcd);
+        isp1362_hcd->data_reg = data_reg;
+        isp1362_hcd->addr_reg = addr_reg;
+
+        isp1362_hcd->next_statechange = jiffies;
+        spin_lock_init(&isp1362_hcd->lock);
+        INIT_LIST_HEAD(&isp1362_hcd->async);
+        INIT_LIST_HEAD(&isp1362_hcd->periodic);
+        INIT_LIST_HEAD(&isp1362_hcd->isoc);
+        INIT_LIST_HEAD(&isp1362_hcd->remove_list);
+        isp1362_hcd->board = pdev->dev.platform_data;
+#if USE_PLATFORM_DELAY
+        if (!isp1362_hcd->board->delay) {
+                dev_err(hcd->self.controller, "No platform delay function given\n");
+                retval = -ENODEV;
+                goto err6;
+        }
+#endif
+
+#ifdef CONFIG_ARM
+        if (isp1362_hcd->board)
+                set_irq_type(irq, isp1362_hcd->board->int_act_high ? IRQT_RISING : IRQT_FALLING);
+#endif
+
+        retval = usb_add_hcd(hcd, irq, IRQF_TRIGGER_LOW | IRQF_DISABLED | IRQF_SHARED);
+        if (retval != 0)
+                goto err6;
+        pr_info("%s, irq %d\n", hcd->product_desc, irq);
+
+        create_debug_file(isp1362_hcd);
+
+        return 0;
+
+ err6:
+        DBG(0, "%s: Freeing dev %08x\n", __func__, (u32)isp1362_hcd);
+        usb_put_hcd(hcd);
+ err5:
+        DBG(0, "%s: Unmapping data_reg @ %08x\n", __func__, (u32)data_reg);
+        iounmap(data_reg);
+ err4:
+        DBG(0, "%s: Releasing mem region %08lx\n", __func__, (long unsigned int)data->start);
+        release_mem_region(data->start, resource_len(data));
+ err3:
+        DBG(0, "%s: Unmapping addr_reg @ %08x\n", __func__, (u32)addr_reg);
+        iounmap(addr_reg);
+ err2:
+        DBG(0, "%s: Releasing mem region %08lx\n", __func__, (long unsigned int)addr->start);
+        release_mem_region(addr->start, resource_len(addr));
+ err1:
+        pr_err("%s: init error, %d\n", __func__, retval);
+
+        return retval;
+}
+
+#ifdef  CONFIG_PM
+static int isp1362_suspend(struct platform_device *pdev, pm_message_t state)
+{
+        struct usb_hcd *hcd = platform_get_drvdata(pdev);
+        struct isp1362_hcd *isp1362_hcd = hcd_to_isp1362_hcd(hcd);
+        unsigned long flags;
+        int retval = 0;
+
+        DBG(0, "%s: Suspending device\n", __func__);
+
+        if (state.event == PM_EVENT_FREEZE) {
+                DBG(0, "%s: Suspending root hub\n", __func__);
+                retval = isp1362_bus_suspend(hcd);
+        } else {
+                DBG(0, "%s: Suspending RH ports\n", __func__);
+                spin_lock_irqsave(&isp1362_hcd->lock, flags);
+                isp1362_write_reg32(isp1362_hcd, HCRHSTATUS, RH_HS_LPS);
+                spin_unlock_irqrestore(&isp1362_hcd->lock, flags);
+        }
+        if (retval == 0)
+                pdev->dev.power.power_state = state;
+        return retval;
+}
+
+static int isp1362_resume(struct platform_device *pdev)
+{
+        struct usb_hcd *hcd = platform_get_drvdata(pdev);
+        struct isp1362_hcd *isp1362_hcd = hcd_to_isp1362_hcd(hcd);
+        unsigned long flags;
+
+        DBG(0, "%s: Resuming\n", __func__);
+
+        if (pdev->dev.power.power_state.event == PM_EVENT_SUSPEND) {
+                DBG(0, "%s: Resume RH ports\n", __func__);
+                spin_lock_irqsave(&isp1362_hcd->lock, flags);
+                isp1362_write_reg32(isp1362_hcd, HCRHSTATUS, RH_HS_LPSC);
+                spin_unlock_irqrestore(&isp1362_hcd->lock, flags);
+                return 0;
+        }
+
+        pdev->dev.power.power_state = PMSG_ON;
+
+        return isp1362_bus_resume(isp1362_hcd_to_hcd(isp1362_hcd));
+}
+#else
+#define isp1362_suspend NULL
+#define isp1362_resume  NULL
+#endif
+
+static struct platform_driver isp1362_driver = {
+        .probe = isp1362_probe,
+        .remove = __devexit_p(isp1362_remove),
+
+        .suspend = isp1362_suspend,
+        .resume = isp1362_resume,
+        .driver = {
+                .name = (char *)hcd_name,
+                .owner = THIS_MODULE,
+        },
+};
+
+/*-------------------------------------------------------------------------*/
+
+static int __init isp1362_init(void)
+{
+        if (usb_disabled())
+                return -ENODEV;
+        pr_info("driver %s, %s\n", hcd_name, DRIVER_VERSION);
+        return platform_driver_register(&isp1362_driver);
+}
+module_init(isp1362_init);
+
+static void __exit isp1362_cleanup(void)
+{
+        platform_driver_unregister(&isp1362_driver);
+}
+module_exit(isp1362_cleanup);
diff --git a/drivers/usb/host/isp1362.h b/drivers/usb/host/isp1362.h
new file mode 100644
index 000000000000..fe60f62a32f3
--- /dev/null
+++ b/drivers/usb/host/isp1362.h
@@ -0,0 +1,1079 @@
+/*
+ * ISP1362 HCD (Host Controller Driver) for USB.
+ *
+ * COPYRIGHT (C) by L. Wassmann <LW@KARO-electronics.de>
+ */
+
+/* ------------------------------------------------------------------------- */
+/*
+ * Platform specific compile time options
+ */
+#if defined(CONFIG_ARCH_KARO)
+#include <asm/arch/hardware.h>
+#include <asm/arch/pxa-regs.h>
+#include <asm/arch/karo.h>
+
+#define USE_32BIT               1
+
+
+/* These options are mutually eclusive */
+#define USE_PLATFORM_DELAY      1
+#define USE_NDELAY              0
+/*
+ * MAX_ROOT_PORTS: Number of downstream ports
+ *
+ * The chip has two USB ports, one of which can be configured as
+ * an USB device port, so the value of this constant is implementation
+ * specific.
+ */
+#define MAX_ROOT_PORTS          2
+#define DUMMY_DELAY_ACCESS do {} while (0)
+
+/* insert platform specific definitions for other machines here */
+#elif defined(CONFIG_BLACKFIN)
+
+#include <linux/io.h>
+#define USE_32BIT               0
+#define MAX_ROOT_PORTS          2
+#define USE_PLATFORM_DELAY      0
+#define USE_NDELAY              1
+
+#define DUMMY_DELAY_ACCESS \
+        do { \
+                bfin_read16(ASYNC_BANK0_BASE); \
+                bfin_read16(ASYNC_BANK0_BASE); \
+                bfin_read16(ASYNC_BANK0_BASE); \
+        } while (0)
+
+#undef insw
+#undef outsw
+
+#define insw  delayed_insw
+#define outsw  delayed_outsw
+
+static inline void delayed_outsw(unsigned int addr, void *buf, int len)
+{
+        unsigned short *bp = (unsigned short *)buf;
+        while (len--) {
+                DUMMY_DELAY_ACCESS;
+                outw(*bp++, addr);
+        }
+}
+
+static inline void delayed_insw(unsigned int addr, void *buf, int len)
+{
+        unsigned short *bp = (unsigned short *)buf;
+        while (len--) {
+                DUMMY_DELAY_ACCESS;
+                *bp++ = inw((void *)addr);
+        }
+}
+
+#else
+
+#define MAX_ROOT_PORTS          2
+
+#define USE_32BIT               0
+
+/* These options are mutually eclusive */
+#define USE_PLATFORM_DELAY      0
+#define USE_NDELAY              0
+
+#define DUMMY_DELAY_ACCESS do {} while (0)
+
+#endif
+
+
+/* ------------------------------------------------------------------------- */
+
+#define USB_RESET_WIDTH                 50
+#define MAX_XFER_SIZE                   1023
+
+/* Buffer sizes */
+#define ISP1362_BUF_SIZE                4096
+#define ISP1362_ISTL_BUFSIZE            512
+#define ISP1362_INTL_BLKSIZE            64
+#define ISP1362_INTL_BUFFERS            16
+#define ISP1362_ATL_BLKSIZE             64
+
+#define ISP1362_REG_WRITE_OFFSET        0x80
+
+#ifdef ISP1362_DEBUG
+typedef const unsigned int isp1362_reg_t;
+
+#define REG_WIDTH_16                    0x000
+#define REG_WIDTH_32                    0x100
+#define REG_WIDTH_MASK                  0x100
+#define REG_NO_MASK                     0x0ff
+
+#define REG_ACCESS_R                    0x200
+#define REG_ACCESS_W                    0x400
+#define REG_ACCESS_RW                   0x600
+#define REG_ACCESS_MASK                 0x600
+
+#define ISP1362_REG_NO(r)               ((r) & REG_NO_MASK)
+
+#define _BUG_ON(x)      BUG_ON(x)
+#define _WARN_ON(x)     WARN_ON(x)
+
+#define ISP1362_REG(name, addr, width, rw) \
+static isp1362_reg_t ISP1362_REG_##name = ((addr) | (width) | (rw))
+
+#define REG_ACCESS_TEST(r)   BUG_ON(((r) & ISP1362_REG_WRITE_OFFSET) && !((r) & REG_ACCESS_W))
+#define REG_WIDTH_TEST(r, w) BUG_ON(((r) & REG_WIDTH_MASK) != (w))
+#else
+typedef const unsigned char isp1362_reg_t;
+#define ISP1362_REG_NO(r)               (r)
+#define _BUG_ON(x)                      do {} while (0)
+#define _WARN_ON(x)                     do {} while (0)
+
+#define ISP1362_REG(name, addr, width, rw) \
+static isp1362_reg_t ISP1362_REG_##name = addr
+
+#define REG_ACCESS_TEST(r)              do {} while (0)
+#define REG_WIDTH_TEST(r, w)            do {} while (0)
+#endif
+
+/* OHCI compatible registers */
+/*
+ * Note: Some of the ISP1362 'OHCI' registers implement only
+ * a subset of the bits defined in the OHCI spec.
+ *
+ * Bitmasks for the individual bits of these registers are defined in "ohci.h"
+ */
+ISP1362_REG(HCREVISION, 0x00,   REG_WIDTH_32,   REG_ACCESS_R);
+ISP1362_REG(HCCONTROL,  0x01,   REG_WIDTH_32,   REG_ACCESS_RW);
+ISP1362_REG(HCCMDSTAT,  0x02,   REG_WIDTH_32,   REG_ACCESS_RW);
+ISP1362_REG(HCINTSTAT,  0x03,   REG_WIDTH_32,   REG_ACCESS_RW);
+ISP1362_REG(HCINTENB,   0x04,   REG_WIDTH_32,   REG_ACCESS_RW);
+ISP1362_REG(HCINTDIS,   0x05,   REG_WIDTH_32,   REG_ACCESS_RW);
+ISP1362_REG(HCFMINTVL,  0x0d,   REG_WIDTH_32,   REG_ACCESS_RW);
+ISP1362_REG(HCFMREM,    0x0e,   REG_WIDTH_32,   REG_ACCESS_RW);
+ISP1362_REG(HCFMNUM,    0x0f,   REG_WIDTH_32,   REG_ACCESS_RW);
+ISP1362_REG(HCLSTHRESH, 0x11,   REG_WIDTH_32,   REG_ACCESS_RW);
+ISP1362_REG(HCRHDESCA,  0x12,   REG_WIDTH_32,   REG_ACCESS_RW);
+ISP1362_REG(HCRHDESCB,  0x13,   REG_WIDTH_32,   REG_ACCESS_RW);
+ISP1362_REG(HCRHSTATUS, 0x14,   REG_WIDTH_32,   REG_ACCESS_RW);
+ISP1362_REG(HCRHPORT1,  0x15,   REG_WIDTH_32,   REG_ACCESS_RW);
+ISP1362_REG(HCRHPORT2,  0x16,   REG_WIDTH_32,   REG_ACCESS_RW);
+
+/* Philips ISP1362 specific registers */
+ISP1362_REG(HCHWCFG,    0x20,   REG_WIDTH_16,   REG_ACCESS_RW);
+#define HCHWCFG_DISABLE_SUSPEND (1 << 15)
+#define HCHWCFG_GLOBAL_PWRDOWN  (1 << 14)
+#define HCHWCFG_PULLDOWN_DS2    (1 << 13)
+#define HCHWCFG_PULLDOWN_DS1    (1 << 12)
+#define HCHWCFG_CLKNOTSTOP      (1 << 11)
+#define HCHWCFG_ANALOG_OC       (1 << 10)
+#define HCHWCFG_ONEINT          (1 << 9)
+#define HCHWCFG_DACK_MODE       (1 << 8)
+#define HCHWCFG_ONEDMA          (1 << 7)
+#define HCHWCFG_DACK_POL        (1 << 6)
+#define HCHWCFG_DREQ_POL        (1 << 5)
+#define HCHWCFG_DBWIDTH_MASK    (0x03 << 3)
+#define HCHWCFG_DBWIDTH(n)      (((n) << 3) & HCHWCFG_DBWIDTH_MASK)
+#define HCHWCFG_INT_POL         (1 << 2)
+#define HCHWCFG_INT_TRIGGER     (1 << 1)
+#define HCHWCFG_INT_ENABLE      (1 << 0)
+
+ISP1362_REG(HCDMACFG,   0x21,   REG_WIDTH_16,   REG_ACCESS_RW);
+#define HCDMACFG_CTR_ENABLE     (1 << 7)
+#define HCDMACFG_BURST_LEN_MASK (0x03 << 5)
+#define HCDMACFG_BURST_LEN(n)   (((n) << 5) & HCDMACFG_BURST_LEN_MASK)
+#define HCDMACFG_BURST_LEN_1    HCDMACFG_BURST_LEN(0)
+#define HCDMACFG_BURST_LEN_4    HCDMACFG_BURST_LEN(1)
+#define HCDMACFG_BURST_LEN_8    HCDMACFG_BURST_LEN(2)
+#define HCDMACFG_DMA_ENABLE     (1 << 4)
+#define HCDMACFG_BUF_TYPE_MASK  (0x07 << 1)
+#define HCDMACFG_BUF_TYPE(n)    (((n) << 1) & HCDMACFG_BUF_TYPE_MASK)
+#define HCDMACFG_BUF_ISTL0      HCDMACFG_BUF_TYPE(0)
+#define HCDMACFG_BUF_ISTL1      HCDMACFG_BUF_TYPE(1)
+#define HCDMACFG_BUF_INTL       HCDMACFG_BUF_TYPE(2)
+#define HCDMACFG_BUF_ATL        HCDMACFG_BUF_TYPE(3)
+#define HCDMACFG_BUF_DIRECT     HCDMACFG_BUF_TYPE(4)
+#define HCDMACFG_DMA_RW_SELECT  (1 << 0)
+
+ISP1362_REG(HCXFERCTR,  0x22,   REG_WIDTH_16,   REG_ACCESS_RW);
+
+ISP1362_REG(HCuPINT,    0x24,   REG_WIDTH_16,   REG_ACCESS_RW);
+#define HCuPINT_SOF             (1 << 0)
+#define HCuPINT_ISTL0           (1 << 1)
+#define HCuPINT_ISTL1           (1 << 2)
+#define HCuPINT_EOT             (1 << 3)
+#define HCuPINT_OPR             (1 << 4)
+#define HCuPINT_SUSP            (1 << 5)
+#define HCuPINT_CLKRDY          (1 << 6)
+#define HCuPINT_INTL            (1 << 7)
+#define HCuPINT_ATL             (1 << 8)
+#define HCuPINT_OTG             (1 << 9)
+
+ISP1362_REG(HCuPINTENB, 0x25,   REG_WIDTH_16,   REG_ACCESS_RW);
+/* same bit definitions apply as for HCuPINT */
+
+ISP1362_REG(HCCHIPID,   0x27,   REG_WIDTH_16,   REG_ACCESS_R);
+#define HCCHIPID_MASK           0xff00
+#define HCCHIPID_MAGIC          0x3600
+
+ISP1362_REG(HCSCRATCH,  0x28,   REG_WIDTH_16,   REG_ACCESS_RW);
+
+ISP1362_REG(HCSWRES,    0x29,   REG_WIDTH_16,   REG_ACCESS_W);
+#define HCSWRES_MAGIC           0x00f6
+
+ISP1362_REG(HCBUFSTAT,  0x2c,   REG_WIDTH_16,   REG_ACCESS_RW);
+#define HCBUFSTAT_ISTL0_FULL    (1 << 0)
+#define HCBUFSTAT_ISTL1_FULL    (1 << 1)
+#define HCBUFSTAT_INTL_ACTIVE   (1 << 2)
+#define HCBUFSTAT_ATL_ACTIVE    (1 << 3)
+#define HCBUFSTAT_RESET_HWPP    (1 << 4)
+#define HCBUFSTAT_ISTL0_ACTIVE  (1 << 5)
+#define HCBUFSTAT_ISTL1_ACTIVE  (1 << 6)
+#define HCBUFSTAT_ISTL0_DONE    (1 << 8)
+#define HCBUFSTAT_ISTL1_DONE    (1 << 9)
+#define HCBUFSTAT_PAIRED_PTDPP  (1 << 10)
+
+ISP1362_REG(HCDIRADDR,  0x32,   REG_WIDTH_32,   REG_ACCESS_RW);
+#define HCDIRADDR_ADDR_MASK     0x0000ffff
+#define HCDIRADDR_ADDR(n)       (((n) << 0) & HCDIRADDR_ADDR_MASK)
+#define HCDIRADDR_COUNT_MASK    0xffff0000
+#define HCDIRADDR_COUNT(n)      (((n) << 16) & HCDIRADDR_COUNT_MASK)
+ISP1362_REG(HCDIRDATA,  0x45,   REG_WIDTH_16,   REG_ACCESS_RW);
+
+ISP1362_REG(HCISTLBUFSZ, 0x30,  REG_WIDTH_16,   REG_ACCESS_RW);
+ISP1362_REG(HCISTL0PORT, 0x40,  REG_WIDTH_16,   REG_ACCESS_RW);
+ISP1362_REG(HCISTL1PORT, 0x42,  REG_WIDTH_16,   REG_ACCESS_RW);
+ISP1362_REG(HCISTLRATE, 0x47,   REG_WIDTH_16,   REG_ACCESS_RW);
+
+ISP1362_REG(HCINTLBUFSZ, 0x33,  REG_WIDTH_16,   REG_ACCESS_RW);
+ISP1362_REG(HCINTLPORT, 0x43,   REG_WIDTH_16,   REG_ACCESS_RW);
+ISP1362_REG(HCINTLBLKSZ, 0x53,  REG_WIDTH_16,   REG_ACCESS_RW);
+ISP1362_REG(HCINTLDONE, 0x17,   REG_WIDTH_32,   REG_ACCESS_R);
+ISP1362_REG(HCINTLSKIP, 0x18,   REG_WIDTH_32,   REG_ACCESS_RW);
+ISP1362_REG(HCINTLLAST, 0x19,   REG_WIDTH_32,   REG_ACCESS_RW);
+ISP1362_REG(HCINTLCURR, 0x1a,   REG_WIDTH_16,   REG_ACCESS_R);
+
+ISP1362_REG(HCATLBUFSZ, 0x34,   REG_WIDTH_16,   REG_ACCESS_RW);
+ISP1362_REG(HCATLPORT,  0x44,   REG_WIDTH_16,   REG_ACCESS_RW);
+ISP1362_REG(HCATLBLKSZ, 0x54,   REG_WIDTH_16,   REG_ACCESS_RW);
+ISP1362_REG(HCATLDONE,  0x1b,   REG_WIDTH_32,   REG_ACCESS_R);
+ISP1362_REG(HCATLSKIP,  0x1c,   REG_WIDTH_32,   REG_ACCESS_RW);
+ISP1362_REG(HCATLLAST,  0x1d,   REG_WIDTH_32,   REG_ACCESS_RW);
+ISP1362_REG(HCATLCURR,  0x1e,   REG_WIDTH_16,   REG_ACCESS_R);
+
+ISP1362_REG(HCATLDTC,   0x51,   REG_WIDTH_16,   REG_ACCESS_RW);
+ISP1362_REG(HCATLDTCTO, 0x52,   REG_WIDTH_16,   REG_ACCESS_RW);
+
+
+ISP1362_REG(OTGCONTROL, 0x62,   REG_WIDTH_16,   REG_ACCESS_RW);
+ISP1362_REG(OTGSTATUS,  0x67,   REG_WIDTH_16,   REG_ACCESS_R);
+ISP1362_REG(OTGINT,     0x68,   REG_WIDTH_16,   REG_ACCESS_RW);
+ISP1362_REG(OTGINTENB,  0x69,   REG_WIDTH_16,   REG_ACCESS_RW);
+ISP1362_REG(OTGTIMER,   0x6A,   REG_WIDTH_16,   REG_ACCESS_RW);
+ISP1362_REG(OTGALTTMR,  0x6C,   REG_WIDTH_16,   REG_ACCESS_RW);
+
+/* Philips transfer descriptor, cpu-endian */
+struct ptd {
+        u16 count;
+#define PTD_COUNT_MSK   (0x3ff << 0)
+#define PTD_TOGGLE_MSK  (1 << 10)
+#define PTD_ACTIVE_MSK  (1 << 11)
+#define PTD_CC_MSK      (0xf << 12)
+        u16 mps;
+#define PTD_MPS_MSK     (0x3ff << 0)
+#define PTD_SPD_MSK     (1 << 10)
+#define PTD_LAST_MSK    (1 << 11)
+#define PTD_EP_MSK      (0xf << 12)
+        u16 len;
+#define PTD_LEN_MSK     (0x3ff << 0)
+#define PTD_DIR_MSK     (3 << 10)
+#define PTD_DIR_SETUP   (0)
+#define PTD_DIR_OUT     (1)
+#define PTD_DIR_IN      (2)
+        u16 faddr;
+#define PTD_FA_MSK      (0x7f << 0)
+/* PTD Byte 7: [StartingFrame (if ISO PTD) | StartingFrame[0..4], PollingRate[0..2] (if INT PTD)] */
+#define PTD_SF_ISO_MSK  (0xff << 8)
+#define PTD_SF_INT_MSK  (0x1f << 8)
+#define PTD_PR_MSK      (0x07 << 13)
+} __attribute__ ((packed, aligned(2)));
+#define PTD_HEADER_SIZE sizeof(struct ptd)
+
+/* ------------------------------------------------------------------------- */
+/* Copied from ohci.h: */
+/*
+ * Hardware transfer status codes -- CC from PTD
+ */
+#define PTD_CC_NOERROR      0x00
+#define PTD_CC_CRC          0x01
+#define PTD_CC_BITSTUFFING  0x02
+#define PTD_CC_DATATOGGLEM  0x03
+#define PTD_CC_STALL        0x04
+#define PTD_DEVNOTRESP      0x05
+#define PTD_PIDCHECKFAIL    0x06
+#define PTD_UNEXPECTEDPID   0x07
+#define PTD_DATAOVERRUN     0x08
+#define PTD_DATAUNDERRUN    0x09
+    /* 0x0A, 0x0B reserved for hardware */
+#define PTD_BUFFEROVERRUN   0x0C
+#define PTD_BUFFERUNDERRUN  0x0D
+    /* 0x0E, 0x0F reserved for HCD */
+#define PTD_NOTACCESSED     0x0F
+
+
+/* map OHCI TD status codes (CC) to errno values */
+static const int cc_to_error[16] = {
+        /* No  Error  */               0,
+        /* CRC Error  */               -EILSEQ,
+        /* Bit Stuff  */               -EPROTO,
+        /* Data Togg  */               -EILSEQ,
+        /* Stall      */               -EPIPE,
+        /* DevNotResp */               -ETIMEDOUT,
+        /* PIDCheck   */               -EPROTO,
+        /* UnExpPID   */               -EPROTO,
+        /* DataOver   */               -EOVERFLOW,
+        /* DataUnder  */               -EREMOTEIO,
+        /* (for hw)   */               -EIO,
+        /* (for hw)   */               -EIO,
+        /* BufferOver */               -ECOMM,
+        /* BuffUnder  */               -ENOSR,
+        /* (for HCD)  */               -EALREADY,
+        /* (for HCD)  */               -EALREADY
+};
+
+
+/*
+ * HcControl (control) register masks
+ */
+#define OHCI_CTRL_HCFS  (3 << 6)        /* host controller functional state */
+#define OHCI_CTRL_RWC   (1 << 9)        /* remote wakeup connected */
+#define OHCI_CTRL_RWE   (1 << 10)       /* remote wakeup enable */
+
+/* pre-shifted values for HCFS */
+#       define OHCI_USB_RESET   (0 << 6)
+#       define OHCI_USB_RESUME  (1 << 6)
+#       define OHCI_USB_OPER    (2 << 6)
+#       define OHCI_USB_SUSPEND (3 << 6)
+
+/*
+ * HcCommandStatus (cmdstatus) register masks
+ */
+#define OHCI_HCR        (1 << 0)        /* host controller reset */
+#define OHCI_SOC        (3 << 16)       /* scheduling overrun count */
+
+/*
+ * masks used with interrupt registers:
+ * HcInterruptStatus (intrstatus)
+ * HcInterruptEnable (intrenable)
+ * HcInterruptDisable (intrdisable)
+ */
+#define OHCI_INTR_SO    (1 << 0)        /* scheduling overrun */
+#define OHCI_INTR_WDH   (1 << 1)        /* writeback of done_head */
+#define OHCI_INTR_SF    (1 << 2)        /* start frame */
+#define OHCI_INTR_RD    (1 << 3)        /* resume detect */
+#define OHCI_INTR_UE    (1 << 4)        /* unrecoverable error */
+#define OHCI_INTR_FNO   (1 << 5)        /* frame number overflow */
+#define OHCI_INTR_RHSC  (1 << 6)        /* root hub status change */
+#define OHCI_INTR_OC    (1 << 30)       /* ownership change */
+#define OHCI_INTR_MIE   (1 << 31)       /* master interrupt enable */
+
+/* roothub.portstatus [i] bits */
+#define RH_PS_CCS            0x00000001         /* current connect status */
+#define RH_PS_PES            0x00000002         /* port enable status*/
+#define RH_PS_PSS            0x00000004         /* port suspend status */
+#define RH_PS_POCI           0x00000008         /* port over current indicator */
+#define RH_PS_PRS            0x00000010         /* port reset status */
+#define RH_PS_PPS            0x00000100         /* port power status */
+#define RH_PS_LSDA           0x00000200         /* low speed device attached */
+#define RH_PS_CSC            0x00010000         /* connect status change */
+#define RH_PS_PESC           0x00020000         /* port enable status change */
+#define RH_PS_PSSC           0x00040000         /* port suspend status change */
+#define RH_PS_OCIC           0x00080000         /* over current indicator change */
+#define RH_PS_PRSC           0x00100000         /* port reset status change */
+
+/* roothub.status bits */
+#define RH_HS_LPS            0x00000001         /* local power status */
+#define RH_HS_OCI            0x00000002         /* over current indicator */
+#define RH_HS_DRWE           0x00008000         /* device remote wakeup enable */
+#define RH_HS_LPSC           0x00010000         /* local power status change */
+#define RH_HS_OCIC           0x00020000         /* over current indicator change */
+#define RH_HS_CRWE           0x80000000         /* clear remote wakeup enable */
+
+/* roothub.b masks */
+#define RH_B_DR         0x0000ffff              /* device removable flags */
+#define RH_B_PPCM       0xffff0000              /* port power control mask */
+
+/* roothub.a masks */
+#define RH_A_NDP        (0xff << 0)             /* number of downstream ports */
+#define RH_A_PSM        (1 << 8)                /* power switching mode */
+#define RH_A_NPS        (1 << 9)                /* no power switching */
+#define RH_A_DT         (1 << 10)               /* device type (mbz) */
+#define RH_A_OCPM       (1 << 11)               /* over current protection mode */
+#define RH_A_NOCP       (1 << 12)               /* no over current protection */
+#define RH_A_POTPGT     (0xff << 24)            /* power on to power good time */
+
+#define FI                      0x2edf          /* 12000 bits per frame (-1) */
+#define FSMP(fi)                (0x7fff & ((6 * ((fi) - 210)) / 7))
+#define LSTHRESH                0x628           /* lowspeed bit threshold */
+
+/* ------------------------------------------------------------------------- */
+
+/* PTD accessor macros. */
+#define PTD_GET_COUNT(p)        (((p)->count & PTD_COUNT_MSK) >> 0)
+#define PTD_COUNT(v)            (((v) << 0) & PTD_COUNT_MSK)
+#define PTD_GET_TOGGLE(p)       (((p)->count & PTD_TOGGLE_MSK) >> 10)
+#define PTD_TOGGLE(v)           (((v) << 10) & PTD_TOGGLE_MSK)
+#define PTD_GET_ACTIVE(p)       (((p)->count & PTD_ACTIVE_MSK) >> 11)
+#define PTD_ACTIVE(v)           (((v) << 11) & PTD_ACTIVE_MSK)
+#define PTD_GET_CC(p)           (((p)->count & PTD_CC_MSK) >> 12)
+#define PTD_CC(v)               (((v) << 12) & PTD_CC_MSK)
+#define PTD_GET_MPS(p)          (((p)->mps & PTD_MPS_MSK) >> 0)
+#define PTD_MPS(v)              (((v) << 0) & PTD_MPS_MSK)
+#define PTD_GET_SPD(p)          (((p)->mps & PTD_SPD_MSK) >> 10)
+#define PTD_SPD(v)              (((v) << 10) & PTD_SPD_MSK)
+#define PTD_GET_LAST(p)         (((p)->mps & PTD_LAST_MSK) >> 11)
+#define PTD_LAST(v)             (((v) << 11) & PTD_LAST_MSK)
+#define PTD_GET_EP(p)           (((p)->mps & PTD_EP_MSK) >> 12)
+#define PTD_EP(v)               (((v) << 12) & PTD_EP_MSK)
+#define PTD_GET_LEN(p)          (((p)->len & PTD_LEN_MSK) >> 0)
+#define PTD_LEN(v)              (((v) << 0) & PTD_LEN_MSK)
+#define PTD_GET_DIR(p)          (((p)->len & PTD_DIR_MSK) >> 10)
+#define PTD_DIR(v)              (((v) << 10) & PTD_DIR_MSK)
+#define PTD_GET_FA(p)           (((p)->faddr & PTD_FA_MSK) >> 0)
+#define PTD_FA(v)               (((v) << 0) & PTD_FA_MSK)
+#define PTD_GET_SF_INT(p)       (((p)->faddr & PTD_SF_INT_MSK) >> 8)
+#define PTD_SF_INT(v)           (((v) << 8) & PTD_SF_INT_MSK)
+#define PTD_GET_SF_ISO(p)       (((p)->faddr & PTD_SF_ISO_MSK) >> 8)
+#define PTD_SF_ISO(v)           (((v) << 8) & PTD_SF_ISO_MSK)
+#define PTD_GET_PR(p)           (((p)->faddr & PTD_PR_MSK) >> 13)
+#define PTD_PR(v)               (((v) << 13) & PTD_PR_MSK)
+
+#define LOG2_PERIODIC_SIZE      5       /* arbitrary; this matches OHCI */
+#define PERIODIC_SIZE           (1 << LOG2_PERIODIC_SIZE)
+
+struct isp1362_ep {
+        struct usb_host_endpoint *hep;
+        struct usb_device       *udev;
+
+        /* philips transfer descriptor */
+        struct ptd              ptd;
+
+        u8                      maxpacket;
+        u8                      epnum;
+        u8                      nextpid;
+        u16                     error_count;
+        u16                     length;         /* of current packet */
+        s16                     ptd_offset;     /* buffer offset in ISP1362 where
+                                                   PTD has been stored
+                                                   (for access thru HCDIRDATA) */
+        int                     ptd_index;
+        int num_ptds;
+        void                    *data;          /* to databuf */
+        /* queue of active EPs (the ones transmitted to the chip) */
+        struct list_head        active;
+
+        /* periodic schedule */
+        u8                      branch;
+        u16                     interval;
+        u16                     load;
+        u16                     last_iso;
+
+        /* async schedule */
+        struct list_head        schedule;       /* list of all EPs that need processing */
+        struct list_head        remove_list;
+        int                     num_req;
+};
+
+struct isp1362_ep_queue {
+        struct list_head        active;         /* list of PTDs currently processed by HC */
+        atomic_t                finishing;
+        unsigned long           buf_map;
+        unsigned long           skip_map;
+        int                     free_ptd;
+        u16                     buf_start;
+        u16                     buf_size;
+        u16                     blk_size;       /* PTD buffer block size for ATL and INTL */
+        u8                      buf_count;
+        u8                      buf_avail;
+        char                    name[16];
+
+        /* for statistical tracking */
+        u8                      stat_maxptds;   /* Max # of ptds seen simultaneously in fifo */
+        u8                      ptd_count;      /* number of ptds submitted to this queue */
+};
+
+struct isp1362_hcd {
+        spinlock_t              lock;
+        void __iomem            *addr_reg;
+        void __iomem            *data_reg;
+
+        struct isp1362_platform_data *board;
+
+        struct proc_dir_entry   *pde;
+        unsigned long           stat1, stat2, stat4, stat8, stat16;
+
+        /* HC registers */
+        u32                     intenb;         /* "OHCI" interrupts */
+        u16                     irqenb;         /* uP interrupts */
+
+        /* Root hub registers */
+        u32                     rhdesca;
+        u32                     rhdescb;
+        u32                     rhstatus;
+        u32                     rhport[MAX_ROOT_PORTS];
+        unsigned long           next_statechange;
+
+        /* HC control reg shadow copy */
+        u32                     hc_control;
+
+        /* async schedule: control, bulk */
+        struct list_head        async;
+
+        /* periodic schedule: int */
+        u16                     load[PERIODIC_SIZE];
+        struct list_head        periodic;
+        u16                     fmindex;
+
+        /* periodic schedule: isochronous */
+        struct list_head        isoc;
+        int                     istl_flip:1;
+        int                     irq_active:1;
+
+        /* Schedules for the current frame */
+        struct isp1362_ep_queue atl_queue;
+        struct isp1362_ep_queue intl_queue;
+        struct isp1362_ep_queue istl_queue[2];
+
+        /* list of PTDs retrieved from HC */
+        struct list_head        remove_list;
+        enum {
+                ISP1362_INT_SOF,
+                ISP1362_INT_ISTL0,
+                ISP1362_INT_ISTL1,
+                ISP1362_INT_EOT,
+                ISP1362_INT_OPR,
+                ISP1362_INT_SUSP,
+                ISP1362_INT_CLKRDY,
+                ISP1362_INT_INTL,
+                ISP1362_INT_ATL,
+                ISP1362_INT_OTG,
+                NUM_ISP1362_IRQS
+        } IRQ_NAMES;
+        unsigned int            irq_stat[NUM_ISP1362_IRQS];
+        int                     req_serial;
+};
+
+static inline const char *ISP1362_INT_NAME(int n)
+{
+        switch (n) {
+        case ISP1362_INT_SOF:    return "SOF";
+        case ISP1362_INT_ISTL0:  return "ISTL0";
+        case ISP1362_INT_ISTL1:  return "ISTL1";
+        case ISP1362_INT_EOT:    return "EOT";
+        case ISP1362_INT_OPR:    return "OPR";
+        case ISP1362_INT_SUSP:   return "SUSP";
+        case ISP1362_INT_CLKRDY: return "CLKRDY";
+        case ISP1362_INT_INTL:   return "INTL";
+        case ISP1362_INT_ATL:    return "ATL";
+        case ISP1362_INT_OTG:    return "OTG";
+        default:                 return "unknown";
+        }
+}
+
+static inline void ALIGNSTAT(struct isp1362_hcd *isp1362_hcd, void *ptr)
+{
+        unsigned p = (unsigned)ptr;
+        if (!(p & 0xf))
+                isp1362_hcd->stat16++;
+        else if (!(p & 0x7))
+                isp1362_hcd->stat8++;
+        else if (!(p & 0x3))
+                isp1362_hcd->stat4++;
+        else if (!(p & 0x1))
+                isp1362_hcd->stat2++;
+        else
+                isp1362_hcd->stat1++;
+}
+
+static inline struct isp1362_hcd *hcd_to_isp1362_hcd(struct usb_hcd *hcd)
+{
+        return (struct isp1362_hcd *) (hcd->hcd_priv);
+}
+
+static inline struct usb_hcd *isp1362_hcd_to_hcd(struct isp1362_hcd *isp1362_hcd)
+{
+        return container_of((void *)isp1362_hcd, struct usb_hcd, hcd_priv);
+}
+
+#define frame_before(f1, f2)    ((s16)((u16)f1 - (u16)f2) < 0)
+
+/*
+ * ISP1362 HW Interface
+ */
+
+#ifdef ISP1362_DEBUG
+#define DBG(level, fmt...) \
+        do { \
+                if (dbg_level > level) \
+                        pr_debug(fmt); \
+        } while (0)
+#define _DBG(level, fmt...)     \
+        do { \
+                if (dbg_level > level) \
+                        printk(fmt); \
+        } while (0)
+#else
+#define DBG(fmt...)             do {} while (0)
+#define _DBG DBG
+#endif
+
+#ifdef VERBOSE
+#    define VDBG(fmt...)        DBG(3, fmt)
+#else
+#    define VDBG(fmt...)        do {} while (0)
+#endif
+
+#ifdef REGISTERS
+#    define RDBG(fmt...)        DBG(1, fmt)
+#else
+#    define RDBG(fmt...)        do {} while (0)
+#endif
+
+#ifdef URB_TRACE
+#define URB_DBG(fmt...)         DBG(0, fmt)
+#else
+#define URB_DBG(fmt...)         do {} while (0)
+#endif
+
+
+#if USE_PLATFORM_DELAY
+#if USE_NDELAY
+#error USE_PLATFORM_DELAY and USE_NDELAY defined simultaneously.
+#endif
+#define isp1362_delay(h, d)     (h)->board->delay(isp1362_hcd_to_hcd(h)->self.controller, d)
+#elif USE_NDELAY
+#define isp1362_delay(h, d)     ndelay(d)
+#else
+#define isp1362_delay(h, d)     do {} while (0)
+#endif
+
+#define get_urb(ep) ({                                                  \
+        BUG_ON(list_empty(&ep->hep->urb_list));                         \
+        container_of(ep->hep->urb_list.next, struct urb, urb_list);     \
+})
+
+/* basic access functions for ISP1362 chip registers */
+/* NOTE: The contents of the address pointer register cannot be read back! The driver must ensure,
+ * that all register accesses are performed with interrupts disabled, since the interrupt
+ * handler has no way of restoring the previous state.
+ */
+static void isp1362_write_addr(struct isp1362_hcd *isp1362_hcd, isp1362_reg_t reg)
+{
+        /*_BUG_ON((reg & ISP1362_REG_WRITE_OFFSET) && !(reg & REG_ACCESS_W));*/
+        REG_ACCESS_TEST(reg);
+        _BUG_ON(!irqs_disabled());
+        DUMMY_DELAY_ACCESS;
+        writew(ISP1362_REG_NO(reg), isp1362_hcd->addr_reg);
+        DUMMY_DELAY_ACCESS;
+        isp1362_delay(isp1362_hcd, 1);
+}
+
+static void isp1362_write_data16(struct isp1362_hcd *isp1362_hcd, u16 val)
+{
+        _BUG_ON(!irqs_disabled());
+        DUMMY_DELAY_ACCESS;
+        writew(val, isp1362_hcd->data_reg);
+}
+
+static u16 isp1362_read_data16(struct isp1362_hcd *isp1362_hcd)
+{
+        u16 val;
+
+        _BUG_ON(!irqs_disabled());
+        DUMMY_DELAY_ACCESS;
+        val = readw(isp1362_hcd->data_reg);
+
+        return val;
+}
+
+static void isp1362_write_data32(struct isp1362_hcd *isp1362_hcd, u32 val)
+{
+        _BUG_ON(!irqs_disabled());
+#if USE_32BIT
+        DUMMY_DELAY_ACCESS;
+        writel(val, isp1362_hcd->data_reg);
+#else
+        DUMMY_DELAY_ACCESS;
+        writew((u16)val, isp1362_hcd->data_reg);
+        DUMMY_DELAY_ACCESS;
+        writew(val >> 16, isp1362_hcd->data_reg);
+#endif
+}
+
+static u32 isp1362_read_data32(struct isp1362_hcd *isp1362_hcd)
+{
+        u32 val;
+
+        _BUG_ON(!irqs_disabled());
+#if USE_32BIT
+        DUMMY_DELAY_ACCESS;
+        val = readl(isp1362_hcd->data_reg);
+#else
+        DUMMY_DELAY_ACCESS;
+        val = (u32)readw(isp1362_hcd->data_reg);
+        DUMMY_DELAY_ACCESS;
+        val |= (u32)readw(isp1362_hcd->data_reg) << 16;
+#endif
+        return val;
+}
+
+/* use readsw/writesw to access the fifo whenever possible */
+/* assume HCDIRDATA or XFERCTR & addr_reg have been set up */
+static void isp1362_read_fifo(struct isp1362_hcd *isp1362_hcd, void *buf, u16 len)
+{
+        u8 *dp = buf;
+        u16 data;
+
+        if (!len)
+                return;
+
+        _BUG_ON(!irqs_disabled());
+
+        RDBG("%s: Reading %d byte from fifo to mem @ %p\n", __func__, len, buf);
+#if USE_32BIT
+        if (len >= 4) {
+                RDBG("%s: Using readsl for %d dwords\n", __func__, len >> 2);
+                readsl(isp1362_hcd->data_reg, dp, len >> 2);
+                dp += len & ~3;
+                len &= 3;
+        }
+#endif
+        if (len >= 2) {
+                RDBG("%s: Using readsw for %d words\n", __func__, len >> 1);
+                insw((unsigned long)isp1362_hcd->data_reg, dp, len >> 1);
+                dp += len & ~1;
+                len &= 1;
+        }
+
+        BUG_ON(len & ~1);
+        if (len > 0) {
+                data = isp1362_read_data16(isp1362_hcd);
+                RDBG("%s: Reading trailing byte %02x to mem @ %08x\n", __func__,
+                     (u8)data, (u32)dp);
+                *dp = (u8)data;
+        }
+}
+
+static void isp1362_write_fifo(struct isp1362_hcd *isp1362_hcd, void *buf, u16 len)
+{
+        u8 *dp = buf;
+        u16 data;
+
+        if (!len)
+                return;
+
+        if ((unsigned)dp & 0x1) {
+                /* not aligned */
+                for (; len > 1; len -= 2) {
+                        data = *dp++;
+                        data |= *dp++ << 8;
+                        isp1362_write_data16(isp1362_hcd, data);
+                }
+                if (len)
+                        isp1362_write_data16(isp1362_hcd, *dp);
+                return;
+        }
+
+        _BUG_ON(!irqs_disabled());
+
+        RDBG("%s: Writing %d byte to fifo from memory @%p\n", __func__, len, buf);
+#if USE_32BIT
+        if (len >= 4) {
+                RDBG("%s: Using writesl for %d dwords\n", __func__, len >> 2);
+                writesl(isp1362_hcd->data_reg, dp, len >> 2);
+                dp += len & ~3;
+                len &= 3;
+        }
+#endif
+        if (len >= 2) {
+                RDBG("%s: Using writesw for %d words\n", __func__, len >> 1);
+                outsw((unsigned long)isp1362_hcd->data_reg, dp, len >> 1);
+                dp += len & ~1;
+                len &= 1;
+        }
+
+        BUG_ON(len & ~1);
+        if (len > 0) {
+                /* finally write any trailing byte; we don't need to care
+                 * about the high byte of the last word written
+                 */
+                data = (u16)*dp;
+                RDBG("%s: Sending trailing byte %02x from mem @ %08x\n", __func__,
+                        data, (u32)dp);
+                isp1362_write_data16(isp1362_hcd, data);
+        }
+}
+
+#define isp1362_read_reg16(d, r)                ({                      \
+        u16 __v;                                                        \
+        REG_WIDTH_TEST(ISP1362_REG_##r, REG_WIDTH_16);                  \
+        isp1362_write_addr(d, ISP1362_REG_##r);                         \
+        __v = isp1362_read_data16(d);                                   \
+        RDBG("%s: Read %04x from %s[%02x]\n", __func__, __v, #r,        \
+             ISP1362_REG_NO(ISP1362_REG_##r));                          \
+        __v;                                                            \
+})
+
+#define isp1362_read_reg32(d, r)                ({                      \
+        u32 __v;                                                        \
+        REG_WIDTH_TEST(ISP1362_REG_##r, REG_WIDTH_32);                  \
+        isp1362_write_addr(d, ISP1362_REG_##r);                         \
+        __v = isp1362_read_data32(d);                                   \
+        RDBG("%s: Read %08x from %s[%02x]\n", __func__, __v, #r,        \
+             ISP1362_REG_NO(ISP1362_REG_##r));                          \
+        __v;                                                            \
+})
+
+#define isp1362_write_reg16(d, r, v)    {                                       \
+        REG_WIDTH_TEST(ISP1362_REG_##r, REG_WIDTH_16);                          \
+        isp1362_write_addr(d, (ISP1362_REG_##r) | ISP1362_REG_WRITE_OFFSET);    \
+        isp1362_write_data16(d, (u16)(v));                                      \
+        RDBG("%s: Wrote %04x to %s[%02x]\n", __func__, (u16)(v), #r,    \
+             ISP1362_REG_NO(ISP1362_REG_##r));                                  \
+}
+
+#define isp1362_write_reg32(d, r, v)    {                                       \
+        REG_WIDTH_TEST(ISP1362_REG_##r, REG_WIDTH_32);                          \
+        isp1362_write_addr(d, (ISP1362_REG_##r) | ISP1362_REG_WRITE_OFFSET);    \
+        isp1362_write_data32(d, (u32)(v));                                      \
+        RDBG("%s: Wrote %08x to %s[%02x]\n", __func__, (u32)(v), #r,    \
+             ISP1362_REG_NO(ISP1362_REG_##r));                                  \
+}
+
+#define isp1362_set_mask16(d, r, m) {                   \
+        u16 __v;                                        \
+        __v = isp1362_read_reg16(d, r);                 \
+        if ((__v | m) != __v)                           \
+                isp1362_write_reg16(d, r, __v | m);     \
+}
+
+#define isp1362_clr_mask16(d, r, m) {                   \
+        u16 __v;                                        \
+        __v = isp1362_read_reg16(d, r);                 \
+        if ((__v & ~m) != __v)                  \
+                isp1362_write_reg16(d, r, __v & ~m);    \
+}
+
+#define isp1362_set_mask32(d, r, m) {                   \
+        u32 __v;                                        \
+        __v = isp1362_read_reg32(d, r);                 \
+        if ((__v | m) != __v)                           \
+                isp1362_write_reg32(d, r, __v | m);     \
+}
+
+#define isp1362_clr_mask32(d, r, m) {                   \
+        u32 __v;                                        \
+        __v = isp1362_read_reg32(d, r);                 \
+        if ((__v & ~m) != __v)                  \
+                isp1362_write_reg32(d, r, __v & ~m);    \
+}
+
+#ifdef ISP1362_DEBUG
+#define isp1362_show_reg(d, r) {                                                                \
+        if ((ISP1362_REG_##r & REG_WIDTH_MASK) == REG_WIDTH_32)                 \
+                DBG(0, "%-12s[%02x]: %08x\n", #r,                                       \
+                        ISP1362_REG_NO(ISP1362_REG_##r), isp1362_read_reg32(d, r));     \
+        else                                                                    \
+                DBG(0, "%-12s[%02x]:     %04x\n", #r,                                   \
+                        ISP1362_REG_NO(ISP1362_REG_##r), isp1362_read_reg16(d, r));     \
+}
+#else
+#define isp1362_show_reg(d, r)  do {} while (0)
+#endif
+
+static void __attribute__((__unused__)) isp1362_show_regs(struct isp1362_hcd *isp1362_hcd)
+{
+        isp1362_show_reg(isp1362_hcd, HCREVISION);
+        isp1362_show_reg(isp1362_hcd, HCCONTROL);
+        isp1362_show_reg(isp1362_hcd, HCCMDSTAT);
+        isp1362_show_reg(isp1362_hcd, HCINTSTAT);
+        isp1362_show_reg(isp1362_hcd, HCINTENB);
+        isp1362_show_reg(isp1362_hcd, HCFMINTVL);
+        isp1362_show_reg(isp1362_hcd, HCFMREM);
+        isp1362_show_reg(isp1362_hcd, HCFMNUM);
+        isp1362_show_reg(isp1362_hcd, HCLSTHRESH);
+        isp1362_show_reg(isp1362_hcd, HCRHDESCA);
+        isp1362_show_reg(isp1362_hcd, HCRHDESCB);
+        isp1362_show_reg(isp1362_hcd, HCRHSTATUS);
+        isp1362_show_reg(isp1362_hcd, HCRHPORT1);
+        isp1362_show_reg(isp1362_hcd, HCRHPORT2);
+
+        isp1362_show_reg(isp1362_hcd, HCHWCFG);
+        isp1362_show_reg(isp1362_hcd, HCDMACFG);
+        isp1362_show_reg(isp1362_hcd, HCXFERCTR);
+        isp1362_show_reg(isp1362_hcd, HCuPINT);
+
+        if (in_interrupt())
+                DBG(0, "%-12s[%02x]:     %04x\n", "HCuPINTENB",
+                         ISP1362_REG_NO(ISP1362_REG_HCuPINTENB), isp1362_hcd->irqenb);
+        else
+                isp1362_show_reg(isp1362_hcd, HCuPINTENB);
+        isp1362_show_reg(isp1362_hcd, HCCHIPID);
+        isp1362_show_reg(isp1362_hcd, HCSCRATCH);
+        isp1362_show_reg(isp1362_hcd, HCBUFSTAT);
+        isp1362_show_reg(isp1362_hcd, HCDIRADDR);
+        /* Access would advance fifo
+         * isp1362_show_reg(isp1362_hcd, HCDIRDATA);
+         */
+        isp1362_show_reg(isp1362_hcd, HCISTLBUFSZ);
+        isp1362_show_reg(isp1362_hcd, HCISTLRATE);
+        isp1362_show_reg(isp1362_hcd, HCINTLBUFSZ);
+        isp1362_show_reg(isp1362_hcd, HCINTLBLKSZ);
+        isp1362_show_reg(isp1362_hcd, HCINTLDONE);
+        isp1362_show_reg(isp1362_hcd, HCINTLSKIP);
+        isp1362_show_reg(isp1362_hcd, HCINTLLAST);
+        isp1362_show_reg(isp1362_hcd, HCINTLCURR);
+        isp1362_show_reg(isp1362_hcd, HCATLBUFSZ);
+        isp1362_show_reg(isp1362_hcd, HCATLBLKSZ);
+        /* only valid after ATL_DONE interrupt
+         * isp1362_show_reg(isp1362_hcd, HCATLDONE);
+         */
+        isp1362_show_reg(isp1362_hcd, HCATLSKIP);
+        isp1362_show_reg(isp1362_hcd, HCATLLAST);
+        isp1362_show_reg(isp1362_hcd, HCATLCURR);
+        isp1362_show_reg(isp1362_hcd, HCATLDTC);
+        isp1362_show_reg(isp1362_hcd, HCATLDTCTO);
+}
+
+static void isp1362_write_diraddr(struct isp1362_hcd *isp1362_hcd, u16 offset, u16 len)
+{
+        _BUG_ON(offset & 1);
+        _BUG_ON(offset >= ISP1362_BUF_SIZE);
+        _BUG_ON(len > ISP1362_BUF_SIZE);
+        _BUG_ON(offset + len > ISP1362_BUF_SIZE);
+        len = (len + 1) & ~1;
+
+        isp1362_clr_mask16(isp1362_hcd, HCDMACFG, HCDMACFG_CTR_ENABLE);
+        isp1362_write_reg32(isp1362_hcd, HCDIRADDR,
+                            HCDIRADDR_ADDR(offset) | HCDIRADDR_COUNT(len));
+}
+
+static void isp1362_read_buffer(struct isp1362_hcd *isp1362_hcd, void *buf, u16 offset, int len)
+{
+        _BUG_ON(offset & 1);
+
+        isp1362_write_diraddr(isp1362_hcd, offset, len);
+
+        DBG(3, "%s: Reading %d byte from buffer @%04x to memory @ %08x\n", __func__,
+            len, offset, (u32)buf);
+
+        isp1362_write_reg16(isp1362_hcd, HCuPINT, HCuPINT_EOT);
+        _WARN_ON((isp1362_read_reg16(isp1362_hcd, HCuPINT) & HCuPINT_EOT));
+
+        isp1362_write_addr(isp1362_hcd, ISP1362_REG_HCDIRDATA);
+
+        isp1362_read_fifo(isp1362_hcd, buf, len);
+        _WARN_ON(!(isp1362_read_reg16(isp1362_hcd, HCuPINT) & HCuPINT_EOT));
+        isp1362_write_reg16(isp1362_hcd, HCuPINT, HCuPINT_EOT);
+        _WARN_ON((isp1362_read_reg16(isp1362_hcd, HCuPINT) & HCuPINT_EOT));
+}
+
+static void isp1362_write_buffer(struct isp1362_hcd *isp1362_hcd, void *buf, u16 offset, int len)
+{
+        _BUG_ON(offset & 1);
+
+        isp1362_write_diraddr(isp1362_hcd, offset, len);
+
+        DBG(3, "%s: Writing %d byte to buffer @%04x from memory @ %08x\n", __func__,
+            len, offset, (u32)buf);
+
+        isp1362_write_reg16(isp1362_hcd, HCuPINT, HCuPINT_EOT);
+        _WARN_ON((isp1362_read_reg16(isp1362_hcd, HCuPINT) & HCuPINT_EOT));
+
+        isp1362_write_addr(isp1362_hcd, ISP1362_REG_HCDIRDATA | ISP1362_REG_WRITE_OFFSET);
+        isp1362_write_fifo(isp1362_hcd, buf, len);
+
+        _WARN_ON(!(isp1362_read_reg16(isp1362_hcd, HCuPINT) & HCuPINT_EOT));
+        isp1362_write_reg16(isp1362_hcd, HCuPINT, HCuPINT_EOT);
+        _WARN_ON((isp1362_read_reg16(isp1362_hcd, HCuPINT) & HCuPINT_EOT));
+}
+
+static void __attribute__((unused)) dump_data(char *buf, int len)
+{
+        if (dbg_level > 0) {
+                int k;
+                int lf = 0;
+
+                for (k = 0; k < len; ++k) {
+                        if (!lf)
+                                DBG(0, "%04x:", k);
+                        printk(" %02x", ((u8 *) buf)[k]);
+                        lf = 1;
+                        if (!k)
+                                continue;
+                        if (k % 16 == 15) {
+                                printk("\n");
+                                lf = 0;
+                                continue;
+                        }
+                        if (k % 8 == 7)
+                                printk(" ");
+                        if (k % 4 == 3)
+                                printk(" ");
+                }
+                if (lf)
+                        printk("\n");
+        }
+}
+
+#if defined(ISP1362_DEBUG) && defined(PTD_TRACE)
+
+static void dump_ptd(struct ptd *ptd)
+{
+        DBG(0, "EP %p: CC=%x EP=%d DIR=%x CNT=%d LEN=%d MPS=%d TGL=%x ACT=%x FA=%d SPD=%x SF=%x PR=%x LST=%x\n",
+            container_of(ptd, struct isp1362_ep, ptd),
+            PTD_GET_CC(ptd), PTD_GET_EP(ptd), PTD_GET_DIR(ptd),
+            PTD_GET_COUNT(ptd), PTD_GET_LEN(ptd), PTD_GET_MPS(ptd),
+            PTD_GET_TOGGLE(ptd), PTD_GET_ACTIVE(ptd), PTD_GET_FA(ptd),
+            PTD_GET_SPD(ptd), PTD_GET_SF_INT(ptd), PTD_GET_PR(ptd), PTD_GET_LAST(ptd));
+        DBG(0, "  %04x %04x %04x %04x\n", ptd->count, ptd->mps, ptd->len, ptd->faddr);
+}
+
+static void dump_ptd_out_data(struct ptd *ptd, u8 *buf)
+{
+        if (dbg_level > 0) {
+                if (PTD_GET_DIR(ptd) != PTD_DIR_IN && PTD_GET_LEN(ptd)) {
+                        DBG(0, "--out->\n");
+                        dump_data(buf, PTD_GET_LEN(ptd));
+                }
+        }
+}
+
+static void dump_ptd_in_data(struct ptd *ptd, u8 *buf)
+{
+        if (dbg_level > 0) {
+                if (PTD_GET_DIR(ptd) == PTD_DIR_IN && PTD_GET_COUNT(ptd)) {
+                        DBG(0, "<--in--\n");
+                        dump_data(buf, PTD_GET_COUNT(ptd));
+                }
+                DBG(0, "-----\n");
+        }
+}
+
+static void dump_ptd_queue(struct isp1362_ep_queue *epq)
+{
+        struct isp1362_ep *ep;
+        int dbg = dbg_level;
+
+        dbg_level = 1;
+        list_for_each_entry(ep, &epq->active, active) {
+                dump_ptd(&ep->ptd);
+                dump_data(ep->data, ep->length);
+        }
+        dbg_level = dbg;
+}
+#else
+#define dump_ptd(ptd)                   do {} while (0)
+#define dump_ptd_in_data(ptd, buf)      do {} while (0)
+#define dump_ptd_out_data(ptd, buf)     do {} while (0)
+#define dump_ptd_data(ptd, buf)         do {} while (0)
+#define dump_ptd_queue(epq)             do {} while (0)
+#endif
diff --git a/drivers/usb/host/isp1760-hcd.c b/drivers/usb/host/isp1760-hcd.c
index 15438469f21a..9600a58299db 100644
--- a/drivers/usb/host/isp1760-hcd.c
+++ b/drivers/usb/host/isp1760-hcd.c
@@ -386,6 +386,10 @@ static int isp1760_hc_setup(struct usb_hcd *hcd)
                 hwmode |= HW_DACK_POL_HIGH;
         if (priv->devflags & ISP1760_FLAG_DREQ_POL_HIGH)
                 hwmode |= HW_DREQ_POL_HIGH;
+        if (priv->devflags & ISP1760_FLAG_INTR_POL_HIGH)
+                hwmode |= HW_INTR_HIGH_ACT;
+        if (priv->devflags & ISP1760_FLAG_INTR_EDGE_TRIG)
+                hwmode |= HW_INTR_EDGE_TRIG;
 
         /*
          * We have to set this first in case we're in 16-bit mode.
diff --git a/drivers/usb/host/isp1760-hcd.h b/drivers/usb/host/isp1760-hcd.h
index 462f4943cb1b..6931ef5c9650 100644
--- a/drivers/usb/host/isp1760-hcd.h
+++ b/drivers/usb/host/isp1760-hcd.h
@@ -142,6 +142,8 @@ typedef void (packet_enqueue)(struct usb_hcd *hcd, struct isp1760_qh *qh,
 #define ISP1760_FLAG_DACK_POL_HIGH      0x00000010 /* DACK active high */
 #define ISP1760_FLAG_DREQ_POL_HIGH      0x00000020 /* DREQ active high */
 #define ISP1760_FLAG_ISP1761            0x00000040 /* Chip is ISP1761 */
+#define ISP1760_FLAG_INTR_POL_HIGH      0x00000080 /* Interrupt polarity active high */
+#define ISP1760_FLAG_INTR_EDGE_TRIG     0x00000100 /* Interrupt edge triggered */
 
 /* chip memory management */
 struct memory_chunk {
diff --git a/drivers/usb/host/isp1760-if.c b/drivers/usb/host/isp1760-if.c
index d4feebfc63bd..1c9f977a5c9c 100644
--- a/drivers/usb/host/isp1760-if.c
+++ b/drivers/usb/host/isp1760-if.c
@@ -3,6 +3,7 @@
  * Currently there is support for
  * - OpenFirmware
  * - PCI
+ * - PDEV (generic platform device centralized driver model)
  *
  * (c) 2007 Sebastian Siewior <bigeasy@linutronix.de>
  *
@@ -11,6 +12,7 @@
 #include <linux/usb.h>
 #include <linux/io.h>
 #include <linux/platform_device.h>
+#include <linux/usb/isp1760.h>
 
 #include "../core/hcd.h"
 #include "isp1760-hcd.h"
@@ -308,6 +310,8 @@ static int __devinit isp1760_plat_probe(struct platform_device *pdev)
         struct resource *mem_res;
         struct resource *irq_res;
         resource_size_t mem_size;
+        struct isp1760_platform_data *priv = pdev->dev.platform_data;
+        unsigned int devflags = 0;
         unsigned long irqflags = IRQF_SHARED | IRQF_DISABLED;
 
         mem_res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
@@ -330,8 +334,23 @@ static int __devinit isp1760_plat_probe(struct platform_device *pdev)
         }
         irqflags |= irq_res->flags & IRQF_TRIGGER_MASK;
 
+        if (priv) {
+                if (priv->is_isp1761)
+                        devflags |= ISP1760_FLAG_ISP1761;
+                if (priv->bus_width_16)
+                        devflags |= ISP1760_FLAG_BUS_WIDTH_16;
+                if (priv->port1_otg)
+                        devflags |= ISP1760_FLAG_OTG_EN;
+                if (priv->analog_oc)
+                        devflags |= ISP1760_FLAG_ANALOG_OC;
+                if (priv->dack_polarity_high)
+                        devflags |= ISP1760_FLAG_DACK_POL_HIGH;
+                if (priv->dreq_polarity_high)
+                        devflags |= ISP1760_FLAG_DREQ_POL_HIGH;
+        }
+
         hcd = isp1760_register(mem_res->start, mem_size, irq_res->start,
-                               irqflags, &pdev->dev, dev_name(&pdev->dev), 0);
+                               irqflags, &pdev->dev, dev_name(&pdev->dev), devflags);
         if (IS_ERR(hcd)) {
                 pr_warning("isp1760: Failed to register the HCD device\n");
                 ret = -ENODEV;
diff --git a/drivers/usb/host/ohci-at91.c b/drivers/usb/host/ohci-at91.c
index bb5e6f671578..7ccffcbe7b6f 100644
--- a/drivers/usb/host/ohci-at91.c
+++ b/drivers/usb/host/ohci-at91.c
@@ -148,7 +148,7 @@ static int usb_hcd_at91_probe(const struct hc_driver *driver,
         at91_start_hc(pdev);
         ohci_hcd_init(hcd_to_ohci(hcd));
 
-        retval = usb_add_hcd(hcd, pdev->resource[1].start, IRQF_DISABLED);
+        retval = usb_add_hcd(hcd, pdev->resource[1].start, IRQF_SHARED);
         if (retval == 0)
                 return retval;
 
diff --git a/drivers/usb/host/ohci-au1xxx.c b/drivers/usb/host/ohci-au1xxx.c
index 2ac4e022a13f..e4380082ebb1 100644
--- a/drivers/usb/host/ohci-au1xxx.c
+++ b/drivers/usb/host/ohci-au1xxx.c
@@ -248,10 +248,9 @@ static int ohci_hcd_au1xxx_drv_remove(struct platform_device *pdev)
 }
 
 #ifdef CONFIG_PM
-static int ohci_hcd_au1xxx_drv_suspend(struct platform_device *pdev,
-                                        pm_message_t message)
+static int ohci_hcd_au1xxx_drv_suspend(struct device *dev)
 {
-        struct usb_hcd *hcd = platform_get_drvdata(pdev);
+        struct usb_hcd *hcd = dev_get_drvdata(dev);
         struct ohci_hcd *ohci = hcd_to_ohci(hcd);
         unsigned long flags;
         int rc;
@@ -274,10 +273,6 @@ static int ohci_hcd_au1xxx_drv_suspend(struct platform_device *pdev,
         ohci_writel(ohci, OHCI_INTR_MIE, &ohci->regs->intrdisable);
         (void)ohci_readl(ohci, &ohci->regs->intrdisable);
 
-        /* make sure snapshot being resumed re-enumerates everything */
-        if (message.event == PM_EVENT_PRETHAW)
-                ohci_usb_reset(ohci);
-
         clear_bit(HCD_FLAG_HW_ACCESSIBLE, &hcd->flags);
 
         au1xxx_stop_ohc();
@@ -287,9 +282,9 @@ bail:
         return rc;
 }
 
-static int ohci_hcd_au1xxx_drv_resume(struct platform_device *pdev)
+static int ohci_hcd_au1xxx_drv_resume(struct device *dev)
 {
-        struct usb_hcd *hcd = platform_get_drvdata(pdev);
+        struct usb_hcd *hcd = dev_get_drvdata(dev);
 
         au1xxx_start_ohc();
 
@@ -298,20 +293,26 @@ static int ohci_hcd_au1xxx_drv_resume(struct platform_device *pdev)
 
         return 0;
 }
+
+static struct dev_pm_ops au1xxx_ohci_pmops = {
+        .suspend        = ohci_hcd_au1xxx_drv_suspend,
+        .resume         = ohci_hcd_au1xxx_drv_resume,
+};
+
+#define AU1XXX_OHCI_PMOPS &au1xxx_ohci_pmops
+
 #else
-#define ohci_hcd_au1xxx_drv_suspend NULL
-#define ohci_hcd_au1xxx_drv_resume NULL
+#define AU1XXX_OHCI_PMOPS NULL
 #endif
 
 static struct platform_driver ohci_hcd_au1xxx_driver = {
         .probe          = ohci_hcd_au1xxx_drv_probe,
         .remove         = ohci_hcd_au1xxx_drv_remove,
         .shutdown       = usb_hcd_platform_shutdown,
-        .suspend        = ohci_hcd_au1xxx_drv_suspend,
-        .resume         = ohci_hcd_au1xxx_drv_resume,
         .driver         = {
                 .name   = "au1xxx-ohci",
                 .owner  = THIS_MODULE,
+                .pm     = AU1XXX_OHCI_PMOPS,
         },
 };
 
diff --git a/drivers/usb/host/ohci-ep93xx.c b/drivers/usb/host/ohci-ep93xx.c
index b0dbf4157d29..4e681613e7ae 100644
--- a/drivers/usb/host/ohci-ep93xx.c
+++ b/drivers/usb/host/ohci-ep93xx.c
@@ -188,7 +188,6 @@ static int ohci_hcd_ep93xx_drv_resume(struct platform_device *pdev)
 {
         struct usb_hcd *hcd = platform_get_drvdata(pdev);
         struct ohci_hcd *ohci = hcd_to_ohci(hcd);
-        int status;
 
         if (time_before(jiffies, ohci->next_statechange))
                 msleep(5);
diff --git a/drivers/usb/host/ohci-hcd.c b/drivers/usb/host/ohci-hcd.c
index 58151687d351..78bb7710f36d 100644
--- a/drivers/usb/host/ohci-hcd.c
+++ b/drivers/usb/host/ohci-hcd.c
@@ -34,7 +34,6 @@
 #include <linux/usb/otg.h>
 #include <linux/dma-mapping.h>
 #include <linux/dmapool.h>
-#include <linux/reboot.h>
 #include <linux/workqueue.h>
 #include <linux/debugfs.h>
 
diff --git a/drivers/usb/host/ohci-pxa27x.c b/drivers/usb/host/ohci-pxa27x.c
index bbc0c3b720b2..f1c06202fdf2 100644
--- a/drivers/usb/host/ohci-pxa27x.c
+++ b/drivers/usb/host/ohci-pxa27x.c
@@ -177,9 +177,13 @@ static inline void pxa27x_setup_hc(struct pxa27x_ohci *ohci,
 
         if (inf->flags & NO_OC_PROTECTION)
                 uhcrhda |= UHCRHDA_NOCP;
+        else
+                uhcrhda &= ~UHCRHDA_NOCP;
 
         if (inf->flags & OC_MODE_PERPORT)
                 uhcrhda |= UHCRHDA_OCPM;
+        else
+                uhcrhda &= ~UHCRHDA_OCPM;
 
         if (inf->power_on_delay) {
                 uhcrhda &= ~UHCRHDA_POTPGT(0xff);
diff --git a/drivers/usb/host/ohci-q.c b/drivers/usb/host/ohci-q.c
index c2d80f80448b..16fecb8ecc39 100644
--- a/drivers/usb/host/ohci-q.c
+++ b/drivers/usb/host/ohci-q.c
@@ -418,7 +418,7 @@ static struct ed *ed_get (
                 is_out = !(ep->desc.bEndpointAddress & USB_DIR_IN);
 
                 /* FIXME usbcore changes dev->devnum before SET_ADDRESS
-                 * suceeds ... otherwise we wouldn't need "pipe".
+                 * succeeds ... otherwise we wouldn't need "pipe".
                  */
                 info = usb_pipedevice (pipe);
                 ed->type = usb_pipetype(pipe);
diff --git a/drivers/usb/host/oxu210hp-hcd.c b/drivers/usb/host/oxu210hp-hcd.c
index 5ac489ee3dab..50f57f468836 100644
--- a/drivers/usb/host/oxu210hp-hcd.c
+++ b/drivers/usb/host/oxu210hp-hcd.c
@@ -33,7 +33,6 @@
 #include <linux/timer.h>
 #include <linux/list.h>
 #include <linux/interrupt.h>
-#include <linux/reboot.h>
 #include <linux/usb.h>
 #include <linux/moduleparam.h>
 #include <linux/dma-mapping.h>
diff --git a/drivers/usb/host/pci-quirks.c b/drivers/usb/host/pci-quirks.c
index 83b5f9cea85a..23cf3bde4762 100644
--- a/drivers/usb/host/pci-quirks.c
+++ b/drivers/usb/host/pci-quirks.c
@@ -475,4 +475,4 @@ static void __devinit quirk_usb_early_handoff(struct pci_dev *pdev)
         else if (pdev->class == PCI_CLASS_SERIAL_USB_XHCI)
                 quirk_usb_handoff_xhci(pdev);
 }
-DECLARE_PCI_FIXUP_FINAL(PCI_ANY_ID, PCI_ANY_ID, quirk_usb_early_handoff);
+DECLARE_PCI_FIXUP_HEADER(PCI_ANY_ID, PCI_ANY_ID, quirk_usb_early_handoff);
diff --git a/drivers/usb/host/r8a66597-hcd.c b/drivers/usb/host/r8a66597-hcd.c
index e18f74946e68..749b53742828 100644
--- a/drivers/usb/host/r8a66597-hcd.c
+++ b/drivers/usb/host/r8a66597-hcd.c
@@ -91,43 +91,43 @@ static int r8a66597_clock_enable(struct r8a66597 *r8a66597)
         u16 tmp;
         int i = 0;
 
-#if defined(CONFIG_SUPERH_ON_CHIP_R8A66597)
-#if defined(CONFIG_HAVE_CLK)
-        clk_enable(r8a66597->clk);
+        if (r8a66597->pdata->on_chip) {
+#ifdef CONFIG_HAVE_CLK
+                clk_enable(r8a66597->clk);
 #endif
-        do {
-                r8a66597_write(r8a66597, SCKE, SYSCFG0);
-                tmp = r8a66597_read(r8a66597, SYSCFG0);
-                if (i++ > 1000) {
-                        printk(KERN_ERR "r8a66597: register access fail.\n");
-                        return -ENXIO;
-                }
-        } while ((tmp & SCKE) != SCKE);
-        r8a66597_write(r8a66597, 0x04, 0x02);
-#else
-        do {
-                r8a66597_write(r8a66597, USBE, SYSCFG0);
-                tmp = r8a66597_read(r8a66597, SYSCFG0);
-                if (i++ > 1000) {
-                        printk(KERN_ERR "r8a66597: register access fail.\n");
-                        return -ENXIO;
-                }
-        } while ((tmp & USBE) != USBE);
-        r8a66597_bclr(r8a66597, USBE, SYSCFG0);
-        r8a66597_mdfy(r8a66597, get_xtal_from_pdata(r8a66597->pdata), XTAL,
-                        SYSCFG0);
+                do {
+                        r8a66597_write(r8a66597, SCKE, SYSCFG0);
+                        tmp = r8a66597_read(r8a66597, SYSCFG0);
+                        if (i++ > 1000) {
+                                printk(KERN_ERR "r8a66597: reg access fail.\n");
+                                return -ENXIO;
+                        }
+                } while ((tmp & SCKE) != SCKE);
+                r8a66597_write(r8a66597, 0x04, 0x02);
+        } else {
+                do {
+                        r8a66597_write(r8a66597, USBE, SYSCFG0);
+                        tmp = r8a66597_read(r8a66597, SYSCFG0);
+                        if (i++ > 1000) {
+                                printk(KERN_ERR "r8a66597: reg access fail.\n");
+                                return -ENXIO;
+                        }
+                } while ((tmp & USBE) != USBE);
+                r8a66597_bclr(r8a66597, USBE, SYSCFG0);
+                r8a66597_mdfy(r8a66597, get_xtal_from_pdata(r8a66597->pdata),
+                              XTAL, SYSCFG0);
 
-        i = 0;
-        r8a66597_bset(r8a66597, XCKE, SYSCFG0);
-        do {
-                msleep(1);
-                tmp = r8a66597_read(r8a66597, SYSCFG0);
-                if (i++ > 500) {
-                        printk(KERN_ERR "r8a66597: register access fail.\n");
-                        return -ENXIO;
-                }
-        } while ((tmp & SCKE) != SCKE);
-#endif  /* #if defined(CONFIG_SUPERH_ON_CHIP_R8A66597) */
+                i = 0;
+                r8a66597_bset(r8a66597, XCKE, SYSCFG0);
+                do {
+                        msleep(1);
+                        tmp = r8a66597_read(r8a66597, SYSCFG0);
+                        if (i++ > 500) {
+                                printk(KERN_ERR "r8a66597: reg access fail.\n");
+                                return -ENXIO;
+                        }
+                } while ((tmp & SCKE) != SCKE);
+        }
 
         return 0;
 }
@@ -136,15 +136,16 @@ static void r8a66597_clock_disable(struct r8a66597 *r8a66597)
 {
         r8a66597_bclr(r8a66597, SCKE, SYSCFG0);
         udelay(1);
-#if defined(CONFIG_SUPERH_ON_CHIP_R8A66597)
-#if defined(CONFIG_HAVE_CLK)
-        clk_disable(r8a66597->clk);
-#endif
-#else
-        r8a66597_bclr(r8a66597, PLLC, SYSCFG0);
-        r8a66597_bclr(r8a66597, XCKE, SYSCFG0);
-        r8a66597_bclr(r8a66597, USBE, SYSCFG0);
+
+        if (r8a66597->pdata->on_chip) {
+#ifdef CONFIG_HAVE_CLK
+                clk_disable(r8a66597->clk);
 #endif
+        } else {
+                r8a66597_bclr(r8a66597, PLLC, SYSCFG0);
+                r8a66597_bclr(r8a66597, XCKE, SYSCFG0);
+                r8a66597_bclr(r8a66597, USBE, SYSCFG0);
+        }
 }
 
 static void r8a66597_enable_port(struct r8a66597 *r8a66597, int port)
@@ -205,7 +206,7 @@ static int enable_controller(struct r8a66597 *r8a66597)
 
         r8a66597_bset(r8a66597, SIGNE | SACKE, INTENB1);
 
-        for (port = 0; port < R8A66597_MAX_ROOT_HUB; port++)
+        for (port = 0; port < r8a66597->max_root_hub; port++)
                 r8a66597_enable_port(r8a66597, port);
 
         return 0;
@@ -218,7 +219,7 @@ static void disable_controller(struct r8a66597 *r8a66597)
         r8a66597_write(r8a66597, 0, INTENB0);
         r8a66597_write(r8a66597, 0, INTSTS0);
 
-        for (port = 0; port < R8A66597_MAX_ROOT_HUB; port++)
+        for (port = 0; port < r8a66597->max_root_hub; port++)
                 r8a66597_disable_port(r8a66597, port);
 
         r8a66597_clock_disable(r8a66597);
@@ -249,11 +250,12 @@ static int is_hub_limit(char *devpath)
         return ((strlen(devpath) >= 4) ? 1 : 0);
 }
 
-static void get_port_number(char *devpath, u16 *root_port, u16 *hub_port)
+static void get_port_number(struct r8a66597 *r8a66597,
+                            char *devpath, u16 *root_port, u16 *hub_port)
 {
         if (root_port) {
                 *root_port = (devpath[0] & 0x0F) - 1;
-                if (*root_port >= R8A66597_MAX_ROOT_HUB)
+                if (*root_port >= r8a66597->max_root_hub)
                         printk(KERN_ERR "r8a66597: Illegal root port number.\n");
         }
         if (hub_port)
@@ -355,7 +357,8 @@ static int make_r8a66597_device(struct r8a66597 *r8a66597,
         INIT_LIST_HEAD(&dev->device_list);
         list_add_tail(&dev->device_list, &r8a66597->child_device);
 
-        get_port_number(urb->dev->devpath, &dev->root_port, &dev->hub_port);
+        get_port_number(r8a66597, urb->dev->devpath,
+                        &dev->root_port, &dev->hub_port);
         if (!is_child_device(urb->dev->devpath))
                 r8a66597->root_hub[dev->root_port].dev = dev;
 
@@ -420,7 +423,7 @@ static void free_usb_address(struct r8a66597 *r8a66597,
         list_del(&dev->device_list);
         kfree(dev);
 
-        for (port = 0; port < R8A66597_MAX_ROOT_HUB; port++) {
+        for (port = 0; port < r8a66597->max_root_hub; port++) {
                 if (r8a66597->root_hub[port].dev == dev) {
                         r8a66597->root_hub[port].dev = NULL;
                         break;
@@ -495,10 +498,20 @@ static void r8a66597_pipe_toggle(struct r8a66597 *r8a66597,
                 r8a66597_bset(r8a66597, SQCLR, pipe->pipectr);
 }
 
+static inline unsigned short mbw_value(struct r8a66597 *r8a66597)
+{
+        if (r8a66597->pdata->on_chip)
+                return MBW_32;
+        else
+                return MBW_16;
+}
+
 /* this function must be called with interrupt disabled */
 static inline void cfifo_change(struct r8a66597 *r8a66597, u16 pipenum)
 {
-        r8a66597_mdfy(r8a66597, MBW | pipenum, MBW | CURPIPE, CFIFOSEL);
+        unsigned short mbw = mbw_value(r8a66597);
+
+        r8a66597_mdfy(r8a66597, mbw | pipenum, mbw | CURPIPE, CFIFOSEL);
         r8a66597_reg_wait(r8a66597, CFIFOSEL, CURPIPE, pipenum);
 }
 
@@ -506,11 +519,13 @@ static inline void cfifo_change(struct r8a66597 *r8a66597, u16 pipenum)
 static inline void fifo_change_from_pipe(struct r8a66597 *r8a66597,
                                          struct r8a66597_pipe *pipe)
 {
+        unsigned short mbw = mbw_value(r8a66597);
+
         cfifo_change(r8a66597, 0);
-        r8a66597_mdfy(r8a66597, MBW | 0, MBW | CURPIPE, D0FIFOSEL);
-        r8a66597_mdfy(r8a66597, MBW | 0, MBW | CURPIPE, D1FIFOSEL);
+        r8a66597_mdfy(r8a66597, mbw | 0, mbw | CURPIPE, D0FIFOSEL);
+        r8a66597_mdfy(r8a66597, mbw | 0, mbw | CURPIPE, D1FIFOSEL);
 
-        r8a66597_mdfy(r8a66597, MBW | pipe->info.pipenum, MBW | CURPIPE,
+        r8a66597_mdfy(r8a66597, mbw | pipe->info.pipenum, mbw | CURPIPE,
                       pipe->fifosel);
         r8a66597_reg_wait(r8a66597, pipe->fifosel, CURPIPE, pipe->info.pipenum);
 }
@@ -742,9 +757,13 @@ static void enable_r8a66597_pipe_dma(struct r8a66597 *r8a66597,
                                      struct r8a66597_pipe *pipe,
                                      struct urb *urb)
 {
-#if !defined(CONFIG_SUPERH_ON_CHIP_R8A66597)
         int i;
         struct r8a66597_pipe_info *info = &pipe->info;
+        unsigned short mbw = mbw_value(r8a66597);
+
+        /* pipe dma is only for external controlles */
+        if (r8a66597->pdata->on_chip)
+                return;
 
         if ((pipe->info.pipenum != 0) && (info->type != R8A66597_INT)) {
                 for (i = 0; i < R8A66597_MAX_DMA_CHANNEL; i++) {
@@ -763,8 +782,8 @@ static void enable_r8a66597_pipe_dma(struct r8a66597 *r8a66597,
                         set_pipe_reg_addr(pipe, i);
 
                         cfifo_change(r8a66597, 0);
-                        r8a66597_mdfy(r8a66597, MBW | pipe->info.pipenum,
-                                      MBW | CURPIPE, pipe->fifosel);
+                        r8a66597_mdfy(r8a66597, mbw | pipe->info.pipenum,
+                                      mbw | CURPIPE, pipe->fifosel);
 
                         r8a66597_reg_wait(r8a66597, pipe->fifosel, CURPIPE,
                                           pipe->info.pipenum);
@@ -772,7 +791,6 @@ static void enable_r8a66597_pipe_dma(struct r8a66597 *r8a66597,
                         break;
                 }
         }
-#endif  /* #if defined(CONFIG_SUPERH_ON_CHIP_R8A66597) */
 }
 
 /* this function must be called with interrupt disabled */
@@ -1769,7 +1787,7 @@ static void r8a66597_timer(unsigned long _r8a66597)
 
         spin_lock_irqsave(&r8a66597->lock, flags);
 
-        for (port = 0; port < R8A66597_MAX_ROOT_HUB; port++)
+        for (port = 0; port < r8a66597->max_root_hub; port++)
                 r8a66597_root_hub_control(r8a66597, port);
 
         spin_unlock_irqrestore(&r8a66597->lock, flags);
@@ -1807,7 +1825,7 @@ static void set_address_zero(struct r8a66597 *r8a66597, struct urb *urb)
         u16 root_port, hub_port;
 
         if (usb_address == 0) {
-                get_port_number(urb->dev->devpath,
+                get_port_number(r8a66597, urb->dev->devpath,
                                 &root_port, &hub_port);
                 set_devadd_reg(r8a66597, 0,
                                get_r8a66597_usb_speed(urb->dev->speed),
@@ -2082,7 +2100,7 @@ static int r8a66597_hub_status_data(struct usb_hcd *hcd, char *buf)
 
         *buf = 0;       /* initialize (no change) */
 
-        for (i = 0; i < R8A66597_MAX_ROOT_HUB; i++) {
+        for (i = 0; i < r8a66597->max_root_hub; i++) {
                 if (r8a66597->root_hub[i].port & 0xffff0000)
                         *buf |= 1 << (i + 1);
         }
@@ -2097,11 +2115,11 @@ static void r8a66597_hub_descriptor(struct r8a66597 *r8a66597,
 {
         desc->bDescriptorType = 0x29;
         desc->bHubContrCurrent = 0;
-        desc->bNbrPorts = R8A66597_MAX_ROOT_HUB;
+        desc->bNbrPorts = r8a66597->max_root_hub;
         desc->bDescLength = 9;
         desc->bPwrOn2PwrGood = 0;
         desc->wHubCharacteristics = cpu_to_le16(0x0011);
-        desc->bitmap[0] = ((1 << R8A66597_MAX_ROOT_HUB) - 1) << 1;
+        desc->bitmap[0] = ((1 << r8a66597->max_root_hub) - 1) << 1;
         desc->bitmap[1] = ~0;
 }
 
@@ -2129,7 +2147,7 @@ static int r8a66597_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
                 }
                 break;
         case ClearPortFeature:
-                if (wIndex > R8A66597_MAX_ROOT_HUB)
+                if (wIndex > r8a66597->max_root_hub)
                         goto error;
                 if (wLength != 0)
                         goto error;
@@ -2162,12 +2180,12 @@ static int r8a66597_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
                 *buf = 0x00;
                 break;
         case GetPortStatus:
-                if (wIndex > R8A66597_MAX_ROOT_HUB)
+                if (wIndex > r8a66597->max_root_hub)
                         goto error;
                 *(__le32 *)buf = cpu_to_le32(rh->port);
                 break;
         case SetPortFeature:
-                if (wIndex > R8A66597_MAX_ROOT_HUB)
+                if (wIndex > r8a66597->max_root_hub)
                         goto error;
                 if (wLength != 0)
                         goto error;
@@ -2216,7 +2234,7 @@ static int r8a66597_bus_suspend(struct usb_hcd *hcd)
 
         dbg("%s", __func__);
 
-        for (port = 0; port < R8A66597_MAX_ROOT_HUB; port++) {
+        for (port = 0; port < r8a66597->max_root_hub; port++) {
                 struct r8a66597_root_hub *rh = &r8a66597->root_hub[port];
                 unsigned long dvstctr_reg = get_dvstctr_reg(port);
 
@@ -2247,7 +2265,7 @@ static int r8a66597_bus_resume(struct usb_hcd *hcd)
 
         dbg("%s", __func__);
 
-        for (port = 0; port < R8A66597_MAX_ROOT_HUB; port++) {
+        for (port = 0; port < r8a66597->max_root_hub; port++) {
                 struct r8a66597_root_hub *rh = &r8a66597->root_hub[port];
                 unsigned long dvstctr_reg = get_dvstctr_reg(port);
 
@@ -2305,16 +2323,16 @@ static struct hc_driver r8a66597_hc_driver = {
 };
 
 #if defined(CONFIG_PM)
-static int r8a66597_suspend(struct platform_device *pdev, pm_message_t state)
+static int r8a66597_suspend(struct device *dev)
 {
-        struct r8a66597         *r8a66597 = dev_get_drvdata(&pdev->dev);
+        struct r8a66597         *r8a66597 = dev_get_drvdata(dev);
         int port;
 
         dbg("%s", __func__);
 
         disable_controller(r8a66597);
 
-        for (port = 0; port < R8A66597_MAX_ROOT_HUB; port++) {
+        for (port = 0; port < r8a66597->max_root_hub; port++) {
                 struct r8a66597_root_hub *rh = &r8a66597->root_hub[port];
 
                 rh->port = 0x00000000;
@@ -2323,9 +2341,9 @@ static int r8a66597_suspend(struct platform_device *pdev, pm_message_t state)
         return 0;
 }
 
-static int r8a66597_resume(struct platform_device *pdev)
+static int r8a66597_resume(struct device *dev)
 {
-        struct r8a66597         *r8a66597 = dev_get_drvdata(&pdev->dev);
+        struct r8a66597         *r8a66597 = dev_get_drvdata(dev);
         struct usb_hcd          *hcd = r8a66597_to_hcd(r8a66597);
 
         dbg("%s", __func__);
@@ -2335,9 +2353,17 @@ static int r8a66597_resume(struct platform_device *pdev)
 
         return 0;
 }
+
+static struct dev_pm_ops r8a66597_dev_pm_ops = {
+        .suspend = r8a66597_suspend,
+        .resume = r8a66597_resume,
+        .poweroff = r8a66597_suspend,
+        .restore = r8a66597_resume,
+};
+
+#define R8A66597_DEV_PM_OPS     (&r8a66597_dev_pm_ops)
 #else   /* if defined(CONFIG_PM) */
-#define r8a66597_suspend        NULL
-#define r8a66597_resume         NULL
+#define R8A66597_DEV_PM_OPS     NULL
 #endif
 
 static int __init_or_module r8a66597_remove(struct platform_device *pdev)
@@ -2348,8 +2374,9 @@ static int __init_or_module r8a66597_remove(struct platform_device *pdev)
         del_timer_sync(&r8a66597->rh_timer);
         usb_remove_hcd(hcd);
         iounmap((void *)r8a66597->reg);
-#if defined(CONFIG_SUPERH_ON_CHIP_R8A66597) && defined(CONFIG_HAVE_CLK)
-        clk_put(r8a66597->clk);
+#ifdef CONFIG_HAVE_CLK
+        if (r8a66597->pdata->on_chip)
+                clk_put(r8a66597->clk);
 #endif
         usb_put_hcd(hcd);
         return 0;
@@ -2357,7 +2384,7 @@ static int __init_or_module r8a66597_remove(struct platform_device *pdev)
 
 static int __devinit r8a66597_probe(struct platform_device *pdev)
 {
-#if defined(CONFIG_SUPERH_ON_CHIP_R8A66597) && defined(CONFIG_HAVE_CLK)
+#ifdef CONFIG_HAVE_CLK
         char clk_name[8];
 #endif
         struct resource *res = NULL, *ires;
@@ -2419,15 +2446,20 @@ static int __devinit r8a66597_probe(struct platform_device *pdev)
         r8a66597->pdata = pdev->dev.platform_data;
         r8a66597->irq_sense_low = irq_trigger == IRQF_TRIGGER_LOW;
 
-#if defined(CONFIG_SUPERH_ON_CHIP_R8A66597) && defined(CONFIG_HAVE_CLK)
-        snprintf(clk_name, sizeof(clk_name), "usb%d", pdev->id);
-        r8a66597->clk = clk_get(&pdev->dev, clk_name);
-        if (IS_ERR(r8a66597->clk)) {
-                dev_err(&pdev->dev, "cannot get clock \"%s\"\n", clk_name);
-                ret = PTR_ERR(r8a66597->clk);
-                goto clean_up2;
-        }
+        if (r8a66597->pdata->on_chip) {
+#ifdef CONFIG_HAVE_CLK
+                snprintf(clk_name, sizeof(clk_name), "usb%d", pdev->id);
+                r8a66597->clk = clk_get(&pdev->dev, clk_name);
+                if (IS_ERR(r8a66597->clk)) {
+                        dev_err(&pdev->dev, "cannot get clock \"%s\"\n",
+                                clk_name);
+                        ret = PTR_ERR(r8a66597->clk);
+                        goto clean_up2;
+                }
 #endif
+                r8a66597->max_root_hub = 1;
+        } else
+                r8a66597->max_root_hub = 2;
 
         spin_lock_init(&r8a66597->lock);
         init_timer(&r8a66597->rh_timer);
@@ -2457,8 +2489,9 @@ static int __devinit r8a66597_probe(struct platform_device *pdev)
         return 0;
 
 clean_up3:
-#if defined(CONFIG_SUPERH_ON_CHIP_R8A66597) && defined(CONFIG_HAVE_CLK)
-        clk_put(r8a66597->clk);
+#ifdef CONFIG_HAVE_CLK
+        if (r8a66597->pdata->on_chip)
+                clk_put(r8a66597->clk);
 clean_up2:
 #endif
         usb_put_hcd(hcd);
@@ -2473,11 +2506,10 @@ clean_up:
 static struct platform_driver r8a66597_driver = {
         .probe =        r8a66597_probe,
         .remove =       r8a66597_remove,
-        .suspend =      r8a66597_suspend,
-        .resume =       r8a66597_resume,
         .driver         = {
                 .name = (char *) hcd_name,
                 .owner  = THIS_MODULE,
+                .pm     = R8A66597_DEV_PM_OPS,
         },
 };
 
diff --git a/drivers/usb/host/r8a66597.h b/drivers/usb/host/r8a66597.h
index d72680b433f9..228e3fb23854 100644
--- a/drivers/usb/host/r8a66597.h
+++ b/drivers/usb/host/r8a66597.h
@@ -26,390 +26,16 @@
 #ifndef __R8A66597_H__
 #define __R8A66597_H__
 
-#if defined(CONFIG_SUPERH_ON_CHIP_R8A66597) && defined(CONFIG_HAVE_CLK)
+#ifdef CONFIG_HAVE_CLK
 #include <linux/clk.h>
 #endif
 
 #include <linux/usb/r8a66597.h>
 
-#define SYSCFG0         0x00
-#define SYSCFG1         0x02
-#define SYSSTS0         0x04
-#define SYSSTS1         0x06
-#define DVSTCTR0        0x08
-#define DVSTCTR1        0x0A
-#define TESTMODE        0x0C
-#define PINCFG          0x0E
-#define DMA0CFG         0x10
-#define DMA1CFG         0x12
-#define CFIFO           0x14
-#define D0FIFO          0x18
-#define D1FIFO          0x1C
-#define CFIFOSEL        0x20
-#define CFIFOCTR        0x22
-#define CFIFOSIE        0x24
-#define D0FIFOSEL       0x28
-#define D0FIFOCTR       0x2A
-#define D1FIFOSEL       0x2C
-#define D1FIFOCTR       0x2E
-#define INTENB0         0x30
-#define INTENB1         0x32
-#define INTENB2         0x34
-#define BRDYENB         0x36
-#define NRDYENB         0x38
-#define BEMPENB         0x3A
-#define SOFCFG          0x3C
-#define INTSTS0         0x40
-#define INTSTS1         0x42
-#define INTSTS2         0x44
-#define BRDYSTS         0x46
-#define NRDYSTS         0x48
-#define BEMPSTS         0x4A
-#define FRMNUM          0x4C
-#define UFRMNUM         0x4E
-#define USBADDR         0x50
-#define USBREQ          0x54
-#define USBVAL          0x56
-#define USBINDX         0x58
-#define USBLENG         0x5A
-#define DCPCFG          0x5C
-#define DCPMAXP         0x5E
-#define DCPCTR          0x60
-#define PIPESEL         0x64
-#define PIPECFG         0x68
-#define PIPEBUF         0x6A
-#define PIPEMAXP        0x6C
-#define PIPEPERI        0x6E
-#define PIPE1CTR        0x70
-#define PIPE2CTR        0x72
-#define PIPE3CTR        0x74
-#define PIPE4CTR        0x76
-#define PIPE5CTR        0x78
-#define PIPE6CTR        0x7A
-#define PIPE7CTR        0x7C
-#define PIPE8CTR        0x7E
-#define PIPE9CTR        0x80
-#define PIPE1TRE        0x90
-#define PIPE1TRN        0x92
-#define PIPE2TRE        0x94
-#define PIPE2TRN        0x96
-#define PIPE3TRE        0x98
-#define PIPE3TRN        0x9A
-#define PIPE4TRE        0x9C
-#define PIPE4TRN        0x9E
-#define PIPE5TRE        0xA0
-#define PIPE5TRN        0xA2
-#define DEVADD0         0xD0
-#define DEVADD1         0xD2
-#define DEVADD2         0xD4
-#define DEVADD3         0xD6
-#define DEVADD4         0xD8
-#define DEVADD5         0xDA
-#define DEVADD6         0xDC
-#define DEVADD7         0xDE
-#define DEVADD8         0xE0
-#define DEVADD9         0xE2
-#define DEVADDA         0xE4
-
-/* System Configuration Control Register */
-#define XTAL            0xC000  /* b15-14: Crystal selection */
-#define   XTAL48         0x8000   /* 48MHz */
-#define   XTAL24         0x4000   /* 24MHz */
-#define   XTAL12         0x0000   /* 12MHz */
-#define XCKE            0x2000  /* b13: External clock enable */
-#define PLLC            0x0800  /* b11: PLL control */
-#define SCKE            0x0400  /* b10: USB clock enable */
-#define PCSDIS          0x0200  /* b9: not CS wakeup */
-#define LPSME           0x0100  /* b8: Low power sleep mode */
-#define HSE             0x0080  /* b7: Hi-speed enable */
-#define DCFM            0x0040  /* b6: Controller function select  */
-#define DRPD            0x0020  /* b5: D+/- pull down control */
-#define DPRPU           0x0010  /* b4: D+ pull up control */
-#define USBE            0x0001  /* b0: USB module operation enable */
-
-/* System Configuration Status Register */
-#define OVCBIT          0x8000  /* b15-14: Over-current bit */
-#define OVCMON          0xC000  /* b15-14: Over-current monitor */
-#define SOFEA           0x0020  /* b5: SOF monitor */
-#define IDMON           0x0004  /* b3: ID-pin monitor */
-#define LNST            0x0003  /* b1-0: D+, D- line status */
-#define   SE1            0x0003   /* SE1 */
-#define   FS_KSTS        0x0002   /* Full-Speed K State */
-#define   FS_JSTS        0x0001   /* Full-Speed J State */
-#define   LS_JSTS        0x0002   /* Low-Speed J State */
-#define   LS_KSTS        0x0001   /* Low-Speed K State */
-#define   SE0            0x0000   /* SE0 */
-
-/* Device State Control Register */
-#define EXTLP0          0x0400  /* b10: External port */
-#define VBOUT           0x0200  /* b9: VBUS output */
-#define WKUP            0x0100  /* b8: Remote wakeup */
-#define RWUPE           0x0080  /* b7: Remote wakeup sense */
-#define USBRST          0x0040  /* b6: USB reset enable */
-#define RESUME          0x0020  /* b5: Resume enable */
-#define UACT            0x0010  /* b4: USB bus enable */
-#define RHST            0x0007  /* b1-0: Reset handshake status */
-#define   HSPROC         0x0004   /* HS handshake is processing */
-#define   HSMODE         0x0003   /* Hi-Speed mode */
-#define   FSMODE         0x0002   /* Full-Speed mode */
-#define   LSMODE         0x0001   /* Low-Speed mode */
-#define   UNDECID        0x0000   /* Undecided */
-
-/* Test Mode Register */
-#define UTST                    0x000F  /* b3-0: Test select */
-#define   H_TST_PACKET           0x000C   /* HOST TEST Packet */
-#define   H_TST_SE0_NAK          0x000B   /* HOST TEST SE0 NAK */
-#define   H_TST_K                0x000A   /* HOST TEST K */
-#define   H_TST_J                0x0009   /* HOST TEST J */
-#define   H_TST_NORMAL           0x0000   /* HOST Normal Mode */
-#define   P_TST_PACKET           0x0004   /* PERI TEST Packet */
-#define   P_TST_SE0_NAK          0x0003   /* PERI TEST SE0 NAK */
-#define   P_TST_K                0x0002   /* PERI TEST K */
-#define   P_TST_J                0x0001   /* PERI TEST J */
-#define   P_TST_NORMAL           0x0000   /* PERI Normal Mode */
-
-/* Data Pin Configuration Register */
-#define LDRV                    0x8000  /* b15: Drive Current Adjust */
-#define   VIF1                    0x0000                /* VIF = 1.8V */
-#define   VIF3                    0x8000                /* VIF = 3.3V */
-#define INTA                    0x0001  /* b1: USB INT-pin active */
-
-/* DMAx Pin Configuration Register */
-#define DREQA                   0x4000  /* b14: Dreq active select */
-#define BURST                   0x2000  /* b13: Burst mode */
-#define DACKA                   0x0400  /* b10: Dack active select */
-#define DFORM                   0x0380  /* b9-7: DMA mode select */
-#define   CPU_ADR_RD_WR          0x0000   /* Address + RD/WR mode (CPU bus) */
-#define   CPU_DACK_RD_WR         0x0100   /* DACK + RD/WR mode (CPU bus) */
-#define   CPU_DACK_ONLY          0x0180   /* DACK only mode (CPU bus) */
-#define   SPLIT_DACK_ONLY        0x0200   /* DACK only mode (SPLIT bus) */
-#define DENDA                   0x0040  /* b6: Dend active select */
-#define PKTM                    0x0020  /* b5: Packet mode */
-#define DENDE                   0x0010  /* b4: Dend enable */
-#define OBUS                    0x0004  /* b2: OUTbus mode */
-
-/* CFIFO/DxFIFO Port Select Register */
-#define RCNT            0x8000  /* b15: Read count mode */
-#define REW             0x4000  /* b14: Buffer rewind */
-#define DCLRM           0x2000  /* b13: DMA buffer clear mode */
-#define DREQE           0x1000  /* b12: DREQ output enable */
-#if defined(CONFIG_SUPERH_ON_CHIP_R8A66597)
-#define MBW             0x0800
-#else
-#define MBW             0x0400  /* b10: Maximum bit width for FIFO access */
-#endif
-#define   MBW_8          0x0000   /*  8bit */
-#define   MBW_16         0x0400   /* 16bit */
-#define BIGEND          0x0100  /* b8: Big endian mode */
-#define   BYTE_LITTLE    0x0000         /* little dendian */
-#define   BYTE_BIG       0x0100         /* big endifan */
-#define ISEL            0x0020  /* b5: DCP FIFO port direction select */
-#define CURPIPE         0x000F  /* b2-0: PIPE select */
-
-/* CFIFO/DxFIFO Port Control Register */
-#define BVAL            0x8000  /* b15: Buffer valid flag */
-#define BCLR            0x4000  /* b14: Buffer clear */
-#define FRDY            0x2000  /* b13: FIFO ready */
-#define DTLN            0x0FFF  /* b11-0: FIFO received data length */
-
-/* Interrupt Enable Register 0 */
-#define VBSE    0x8000  /* b15: VBUS interrupt */
-#define RSME    0x4000  /* b14: Resume interrupt */
-#define SOFE    0x2000  /* b13: Frame update interrupt */
-#define DVSE    0x1000  /* b12: Device state transition interrupt */
-#define CTRE    0x0800  /* b11: Control transfer stage transition interrupt */
-#define BEMPE   0x0400  /* b10: Buffer empty interrupt */
-#define NRDYE   0x0200  /* b9: Buffer not ready interrupt */
-#define BRDYE   0x0100  /* b8: Buffer ready interrupt */
-
-/* Interrupt Enable Register 1 */
-#define OVRCRE          0x8000  /* b15: Over-current interrupt */
-#define BCHGE           0x4000  /* b14: USB us chenge interrupt */
-#define DTCHE           0x1000  /* b12: Detach sense interrupt */
-#define ATTCHE          0x0800  /* b11: Attach sense interrupt */
-#define EOFERRE         0x0040  /* b6: EOF error interrupt */
-#define SIGNE           0x0020  /* b5: SETUP IGNORE interrupt */
-#define SACKE           0x0010  /* b4: SETUP ACK interrupt */
-
-/* BRDY Interrupt Enable/Status Register */
-#define BRDY9           0x0200  /* b9: PIPE9 */
-#define BRDY8           0x0100  /* b8: PIPE8 */
-#define BRDY7           0x0080  /* b7: PIPE7 */
-#define BRDY6           0x0040  /* b6: PIPE6 */
-#define BRDY5           0x0020  /* b5: PIPE5 */
-#define BRDY4           0x0010  /* b4: PIPE4 */
-#define BRDY3           0x0008  /* b3: PIPE3 */
-#define BRDY2           0x0004  /* b2: PIPE2 */
-#define BRDY1           0x0002  /* b1: PIPE1 */
-#define BRDY0           0x0001  /* b1: PIPE0 */
-
-/* NRDY Interrupt Enable/Status Register */
-#define NRDY9           0x0200  /* b9: PIPE9 */
-#define NRDY8           0x0100  /* b8: PIPE8 */
-#define NRDY7           0x0080  /* b7: PIPE7 */
-#define NRDY6           0x0040  /* b6: PIPE6 */
-#define NRDY5           0x0020  /* b5: PIPE5 */
-#define NRDY4           0x0010  /* b4: PIPE4 */
-#define NRDY3           0x0008  /* b3: PIPE3 */
-#define NRDY2           0x0004  /* b2: PIPE2 */
-#define NRDY1           0x0002  /* b1: PIPE1 */
-#define NRDY0           0x0001  /* b1: PIPE0 */
-
-/* BEMP Interrupt Enable/Status Register */
-#define BEMP9           0x0200  /* b9: PIPE9 */
-#define BEMP8           0x0100  /* b8: PIPE8 */
-#define BEMP7           0x0080  /* b7: PIPE7 */
-#define BEMP6           0x0040  /* b6: PIPE6 */
-#define BEMP5           0x0020  /* b5: PIPE5 */
-#define BEMP4           0x0010  /* b4: PIPE4 */
-#define BEMP3           0x0008  /* b3: PIPE3 */
-#define BEMP2           0x0004  /* b2: PIPE2 */
-#define BEMP1           0x0002  /* b1: PIPE1 */
-#define BEMP0           0x0001  /* b0: PIPE0 */
-
-/* SOF Pin Configuration Register */
-#define TRNENSEL        0x0100  /* b8: Select transaction enable period */
-#define BRDYM           0x0040  /* b6: BRDY clear timing */
-#define INTL            0x0020  /* b5: Interrupt sense select */
-#define EDGESTS         0x0010  /* b4:  */
-#define SOFMODE         0x000C  /* b3-2: SOF pin select */
-#define   SOF_125US      0x0008   /* SOF OUT 125us Frame Signal */
-#define   SOF_1MS        0x0004   /* SOF OUT 1ms Frame Signal */
-#define   SOF_DISABLE    0x0000   /* SOF OUT Disable */
-
-/* Interrupt Status Register 0 */
-#define VBINT   0x8000  /* b15: VBUS interrupt */
-#define RESM    0x4000  /* b14: Resume interrupt */
-#define SOFR    0x2000  /* b13: SOF frame update interrupt */
-#define DVST    0x1000  /* b12: Device state transition interrupt */
-#define CTRT    0x0800  /* b11: Control transfer stage transition interrupt */
-#define BEMP    0x0400  /* b10: Buffer empty interrupt */
-#define NRDY    0x0200  /* b9: Buffer not ready interrupt */
-#define BRDY    0x0100  /* b8: Buffer ready interrupt */
-#define VBSTS   0x0080  /* b7: VBUS input port */
-#define DVSQ    0x0070  /* b6-4: Device state */
-#define   DS_SPD_CNFG    0x0070   /* Suspend Configured */
-#define   DS_SPD_ADDR    0x0060   /* Suspend Address */
-#define   DS_SPD_DFLT    0x0050   /* Suspend Default */
-#define   DS_SPD_POWR    0x0040   /* Suspend Powered */
-#define   DS_SUSP        0x0040   /* Suspend */
-#define   DS_CNFG        0x0030   /* Configured */
-#define   DS_ADDS        0x0020   /* Address */
-#define   DS_DFLT        0x0010   /* Default */
-#define   DS_POWR        0x0000   /* Powered */
-#define DVSQS           0x0030  /* b5-4: Device state */
-#define VALID           0x0008  /* b3: Setup packet detected flag */
-#define CTSQ            0x0007  /* b2-0: Control transfer stage */
-#define   CS_SQER        0x0006   /* Sequence error */
-#define   CS_WRND        0x0005   /* Control write nodata status stage */
-#define   CS_WRSS        0x0004   /* Control write status stage */
-#define   CS_WRDS        0x0003   /* Control write data stage */
-#define   CS_RDSS        0x0002   /* Control read status stage */
-#define   CS_RDDS        0x0001   /* Control read data stage */
-#define   CS_IDST        0x0000   /* Idle or setup stage */
-
-/* Interrupt Status Register 1 */
-#define OVRCR           0x8000  /* b15: Over-current interrupt */
-#define BCHG            0x4000  /* b14: USB bus chenge interrupt */
-#define DTCH            0x1000  /* b12: Detach sense interrupt */
-#define ATTCH           0x0800  /* b11: Attach sense interrupt */
-#define EOFERR          0x0040  /* b6: EOF-error interrupt */
-#define SIGN            0x0020  /* b5: Setup ignore interrupt */
-#define SACK            0x0010  /* b4: Setup acknowledge interrupt */
-
-/* Frame Number Register */
-#define OVRN            0x8000  /* b15: Overrun error */
-#define CRCE            0x4000  /* b14: Received data error */
-#define FRNM            0x07FF  /* b10-0: Frame number */
-
-/* Micro Frame Number Register */
-#define UFRNM           0x0007  /* b2-0: Micro frame number */
-
-/* Default Control Pipe Maxpacket Size Register */
-/* Pipe Maxpacket Size Register */
-#define DEVSEL  0xF000  /* b15-14: Device address select */
-#define MAXP    0x007F  /* b6-0: Maxpacket size of default control pipe */
-
-/* Default Control Pipe Control Register */
-#define BSTS            0x8000  /* b15: Buffer status */
-#define SUREQ           0x4000  /* b14: Send USB request  */
-#define CSCLR           0x2000  /* b13: complete-split status clear */
-#define CSSTS           0x1000  /* b12: complete-split status */
-#define SUREQCLR        0x0800  /* b11: stop setup request */
-#define SQCLR           0x0100  /* b8: Sequence toggle bit clear */
-#define SQSET           0x0080  /* b7: Sequence toggle bit set */
-#define SQMON           0x0040  /* b6: Sequence toggle bit monitor */
-#define PBUSY           0x0020  /* b5: pipe busy */
-#define PINGE           0x0010  /* b4: ping enable */
-#define CCPL            0x0004  /* b2: Enable control transfer complete */
-#define PID             0x0003  /* b1-0: Response PID */
-#define   PID_STALL11    0x0003   /* STALL */
-#define   PID_STALL      0x0002   /* STALL */
-#define   PID_BUF        0x0001   /* BUF */
-#define   PID_NAK        0x0000   /* NAK */
-
-/* Pipe Window Select Register */
-#define PIPENM          0x0007  /* b2-0: Pipe select */
-
-/* Pipe Configuration Register */
-#define R8A66597_TYP    0xC000  /* b15-14: Transfer type */
-#define   R8A66597_ISO   0xC000           /* Isochronous */
-#define   R8A66597_INT   0x8000           /* Interrupt */
-#define   R8A66597_BULK  0x4000           /* Bulk */
-#define R8A66597_BFRE   0x0400  /* b10: Buffer ready interrupt mode select */
-#define R8A66597_DBLB   0x0200  /* b9: Double buffer mode select */
-#define R8A66597_CNTMD  0x0100  /* b8: Continuous transfer mode select */
-#define R8A66597_SHTNAK 0x0080  /* b7: Transfer end NAK */
-#define R8A66597_DIR    0x0010  /* b4: Transfer direction select */
-#define R8A66597_EPNUM  0x000F  /* b3-0: Eendpoint number select */
-
-/* Pipe Buffer Configuration Register */
-#define BUFSIZE         0x7C00  /* b14-10: Pipe buffer size */
-#define BUFNMB          0x007F  /* b6-0: Pipe buffer number */
-#define PIPE0BUF        256
-#define PIPExBUF        64
-
-/* Pipe Maxpacket Size Register */
-#define MXPS            0x07FF  /* b10-0: Maxpacket size */
-
-/* Pipe Cycle Configuration Register */
-#define IFIS    0x1000  /* b12: Isochronous in-buffer flush mode select */
-#define IITV    0x0007  /* b2-0: Isochronous interval */
-
-/* Pipex Control Register */
-#define BSTS    0x8000  /* b15: Buffer status */
-#define INBUFM  0x4000  /* b14: IN buffer monitor (Only for PIPE1 to 5) */
-#define CSCLR   0x2000  /* b13: complete-split status clear */
-#define CSSTS   0x1000  /* b12: complete-split status */
-#define ATREPM  0x0400  /* b10: Auto repeat mode */
-#define ACLRM   0x0200  /* b9: Out buffer auto clear mode */
-#define SQCLR   0x0100  /* b8: Sequence toggle bit clear */
-#define SQSET   0x0080  /* b7: Sequence toggle bit set */
-#define SQMON   0x0040  /* b6: Sequence toggle bit monitor */
-#define PBUSY   0x0020  /* b5: pipe busy */
-#define PID     0x0003  /* b1-0: Response PID */
-
-/* PIPExTRE */
-#define TRENB           0x0200  /* b9: Transaction counter enable */
-#define TRCLR           0x0100  /* b8: Transaction counter clear */
-
-/* PIPExTRN */
-#define TRNCNT          0xFFFF  /* b15-0: Transaction counter */
-
-/* DEVADDx */
-#define UPPHUB          0x7800
-#define HUBPORT         0x0700
-#define USBSPD          0x00C0
-#define RTPORT          0x0001
-
 #define R8A66597_MAX_NUM_PIPE           10
 #define R8A66597_BUF_BSIZE              8
 #define R8A66597_MAX_DEVICE             10
-#if defined(CONFIG_SUPERH_ON_CHIP_R8A66597)
-#define R8A66597_MAX_ROOT_HUB           1
-#else
 #define R8A66597_MAX_ROOT_HUB           2
-#endif
 #define R8A66597_MAX_SAMPLING           5
 #define R8A66597_RH_POLL_TIME           10
 #define R8A66597_MAX_DMA_CHANNEL        2
@@ -487,7 +113,7 @@ struct r8a66597_root_hub {
 struct r8a66597 {
         spinlock_t lock;
         unsigned long reg;
-#if defined(CONFIG_SUPERH_ON_CHIP_R8A66597) && defined(CONFIG_HAVE_CLK)
+#ifdef CONFIG_HAVE_CLK
         struct clk *clk;
 #endif
         struct r8a66597_platdata        *pdata;
@@ -504,6 +130,7 @@ struct r8a66597 {
         unsigned short interval_map;
         unsigned char pipe_cnt[R8A66597_MAX_NUM_PIPE];
         unsigned char dma_map;
+        unsigned int max_root_hub;
 
         struct list_head child_device;
         unsigned long child_connect_map[4];
@@ -550,21 +177,22 @@ static inline void r8a66597_read_fifo(struct r8a66597 *r8a66597,
                                       unsigned long offset, u16 *buf,
                                       int len)
 {
-#if defined(CONFIG_SUPERH_ON_CHIP_R8A66597)
         unsigned long fifoaddr = r8a66597->reg + offset;
         unsigned long count;
 
-        count = len / 4;
-        insl(fifoaddr, buf, count);
+        if (r8a66597->pdata->on_chip) {
+                count = len / 4;
+                insl(fifoaddr, buf, count);
 
-        if (len & 0x00000003) {
-                unsigned long tmp = inl(fifoaddr);
-                memcpy((unsigned char *)buf + count * 4, &tmp, len & 0x03);
+                if (len & 0x00000003) {
+                        unsigned long tmp = inl(fifoaddr);
+                        memcpy((unsigned char *)buf + count * 4, &tmp,
+                               len & 0x03);
+                }
+        } else {
+                len = (len + 1) / 2;
+                insw(fifoaddr, buf, len);
         }
-#else
-        len = (len + 1) / 2;
-        insw(r8a66597->reg + offset, buf, len);
-#endif
 }
 
 static inline void r8a66597_write(struct r8a66597 *r8a66597, u16 val,
@@ -578,33 +206,33 @@ static inline void r8a66597_write_fifo(struct r8a66597 *r8a66597,
                                        int len)
 {
         unsigned long fifoaddr = r8a66597->reg + offset;
-#if defined(CONFIG_SUPERH_ON_CHIP_R8A66597)
         unsigned long count;
         unsigned char *pb;
         int i;
 
-        count = len / 4;
-        outsl(fifoaddr, buf, count);
+        if (r8a66597->pdata->on_chip) {
+                count = len / 4;
+                outsl(fifoaddr, buf, count);
+
+                if (len & 0x00000003) {
+                        pb = (unsigned char *)buf + count * 4;
+                        for (i = 0; i < (len & 0x00000003); i++) {
+                                if (r8a66597_read(r8a66597, CFIFOSEL) & BIGEND)
+                                        outb(pb[i], fifoaddr + i);
+                                else
+                                        outb(pb[i], fifoaddr + 3 - i);
+                        }
+                }
+        } else {
+                int odd = len & 0x0001;
 
-        if (len & 0x00000003) {
-                pb = (unsigned char *)buf + count * 4;
-                for (i = 0; i < (len & 0x00000003); i++) {
-                        if (r8a66597_read(r8a66597, CFIFOSEL) & BIGEND)
-                                outb(pb[i], fifoaddr + i);
-                        else
-                                outb(pb[i], fifoaddr + 3 - i);
+                len = len / 2;
+                outsw(fifoaddr, buf, len);
+                if (unlikely(odd)) {
+                        buf = &buf[len];
+                        outb((unsigned char)*buf, fifoaddr);
                 }
         }
-#else
-        int odd = len & 0x0001;
-
-        len = len / 2;
-        outsw(fifoaddr, buf, len);
-        if (unlikely(odd)) {
-                buf = &buf[len];
-                outb((unsigned char)*buf, fifoaddr);
-        }
-#endif
 }
 
 static inline void r8a66597_mdfy(struct r8a66597 *r8a66597,
diff --git a/drivers/usb/host/sl811-hcd.c b/drivers/usb/host/sl811-hcd.c
index a949259f18b9..5b22a4d1c9e4 100644
--- a/drivers/usb/host/sl811-hcd.c
+++ b/drivers/usb/host/sl811-hcd.c
@@ -719,8 +719,12 @@ retry:
                 /* port status seems weird until after reset, so
                  * force the reset and make khubd clean up later.
                  */
-                sl811->port1 |= (1 << USB_PORT_FEAT_C_CONNECTION)
-                                | (1 << USB_PORT_FEAT_CONNECTION);
+                if (sl811->stat_insrmv & 1)
+                        sl811->port1 |= 1 << USB_PORT_FEAT_CONNECTION;
+                else
+                        sl811->port1 &= ~(1 << USB_PORT_FEAT_CONNECTION);
+
+                sl811->port1 |= 1 << USB_PORT_FEAT_C_CONNECTION;
 
         } else if (irqstat & SL11H_INTMASK_RD) {
                 if (sl811->port1 & (1 << USB_PORT_FEAT_SUSPEND)) {
diff --git a/drivers/usb/host/uhci-q.c b/drivers/usb/host/uhci-q.c
index 64e57bfe236b..acd582c02802 100644
--- a/drivers/usb/host/uhci-q.c
+++ b/drivers/usb/host/uhci-q.c
@@ -1422,7 +1422,6 @@ static int uhci_urb_enqueue(struct usb_hcd *hcd,
                 goto err_submit_failed;
 
         /* Add this URB to the QH */
-        urbp->qh = qh;
         list_add_tail(&urbp->node, &qh->queue);
 
         /* If the new URB is the first and only one on this QH then either
diff --git a/drivers/usb/host/whci/asl.c b/drivers/usb/host/whci/asl.c
index c2050785a819..c632437c7649 100644
--- a/drivers/usb/host/whci/asl.c
+++ b/drivers/usb/host/whci/asl.c
@@ -227,11 +227,21 @@ void scan_async_work(struct work_struct *work)
         /*
          * Now that the ASL is updated, complete the removal of any
          * removed qsets.
+         *
+         * If the qset was to be reset, do so and reinsert it into the
+         * ASL if it has pending transfers.
          */
         spin_lock_irq(&whc->lock);
 
         list_for_each_entry_safe(qset, t, &whc->async_removed_list, list_node) {
                 qset_remove_complete(whc, qset);
+                if (qset->reset) {
+                        qset_reset(whc, qset);
+                        if (!list_empty(&qset->stds)) {
+                                asl_qset_insert_begin(whc, qset);
+                                queue_work(whc->workqueue, &whc->async_work);
+                        }
+                }
         }
 
         spin_unlock_irq(&whc->lock);
@@ -267,7 +277,7 @@ int asl_urb_enqueue(struct whc *whc, struct urb *urb, gfp_t mem_flags)
         else
                 err = qset_add_urb(whc, qset, urb, GFP_ATOMIC);
         if (!err) {
-                if (!qset->in_sw_list)
+                if (!qset->in_sw_list && !qset->remove)
                         asl_qset_insert_begin(whc, qset);
         } else
                 usb_hcd_unlink_urb_from_ep(&whc->wusbhc.usb_hcd, urb);
diff --git a/drivers/usb/host/whci/hcd.c b/drivers/usb/host/whci/hcd.c
index e019a5058ab8..687b622a1612 100644
--- a/drivers/usb/host/whci/hcd.c
+++ b/drivers/usb/host/whci/hcd.c
@@ -192,19 +192,23 @@ static void whc_endpoint_reset(struct usb_hcd *usb_hcd,
         struct wusbhc *wusbhc = usb_hcd_to_wusbhc(usb_hcd);
         struct whc *whc = wusbhc_to_whc(wusbhc);
         struct whc_qset *qset;
+        unsigned long flags;
+
+        spin_lock_irqsave(&whc->lock, flags);
 
         qset = ep->hcpriv;
         if (qset) {
                 qset->remove = 1;
+                qset->reset = 1;
 
                 if (usb_endpoint_xfer_bulk(&ep->desc)
                     || usb_endpoint_xfer_control(&ep->desc))
                         queue_work(whc->workqueue, &whc->async_work);
                 else
                         queue_work(whc->workqueue, &whc->periodic_work);
-
-                qset_reset(whc, qset);
         }
+
+        spin_unlock_irqrestore(&whc->lock, flags);
 }
 
 
diff --git a/drivers/usb/host/whci/pzl.c b/drivers/usb/host/whci/pzl.c
index ff4ef9e910d9..a9e05bac6646 100644
--- a/drivers/usb/host/whci/pzl.c
+++ b/drivers/usb/host/whci/pzl.c
@@ -255,11 +255,21 @@ void scan_periodic_work(struct work_struct *work)
         /*
          * Now that the PZL is updated, complete the removal of any
          * removed qsets.
+         *
+         * If the qset was to be reset, do so and reinsert it into the
+         * PZL if it has pending transfers.
          */
         spin_lock_irq(&whc->lock);
 
         list_for_each_entry_safe(qset, t, &whc->periodic_removed_list, list_node) {
                 qset_remove_complete(whc, qset);
+                if (qset->reset) {
+                        qset_reset(whc, qset);
+                        if (!list_empty(&qset->stds)) {
+                                qset_insert_in_sw_list(whc, qset);
+                                queue_work(whc->workqueue, &whc->periodic_work);
+                        }
+                }
         }
 
         spin_unlock_irq(&whc->lock);
@@ -295,7 +305,7 @@ int pzl_urb_enqueue(struct whc *whc, struct urb *urb, gfp_t mem_flags)
         else
                 err = qset_add_urb(whc, qset, urb, GFP_ATOMIC);
         if (!err) {
-                if (!qset->in_sw_list)
+                if (!qset->in_sw_list && !qset->remove)
                         qset_insert_in_sw_list(whc, qset);
         } else
                 usb_hcd_unlink_urb_from_ep(&whc->wusbhc.usb_hcd, urb);
diff --git a/drivers/usb/host/whci/qset.c b/drivers/usb/host/whci/qset.c
index 640b38fbd051..1b9dc1571570 100644
--- a/drivers/usb/host/whci/qset.c
+++ b/drivers/usb/host/whci/qset.c
@@ -103,7 +103,6 @@ static void qset_fill_qh(struct whc_qset *qset, struct urb *urb)
 void qset_clear(struct whc *whc, struct whc_qset *qset)
 {
         qset->td_start = qset->td_end = qset->ntds = 0;
-        qset->remove = 0;
 
         qset->qh.link = cpu_to_le32(QH_LINK_NTDS(8) | QH_LINK_T);
         qset->qh.status = qset->qh.status & QH_STATUS_SEQ_MASK;
@@ -125,7 +124,7 @@ void qset_clear(struct whc *whc, struct whc_qset *qset)
  */
 void qset_reset(struct whc *whc, struct whc_qset *qset)
 {
-        wait_for_completion(&qset->remove_complete);
+        qset->reset = 0;
 
         qset->qh.status &= ~QH_STATUS_SEQ_MASK;
         qset->qh.cur_window = cpu_to_le32((1 << qset->max_burst) - 1);
@@ -156,6 +155,7 @@ struct whc_qset *get_qset(struct whc *whc, struct urb *urb,
 
 void qset_remove_complete(struct whc *whc, struct whc_qset *qset)
 {
+        qset->remove = 0;
         list_del_init(&qset->list_node);
         complete(&qset->remove_complete);
 }
diff --git a/drivers/usb/host/whci/whci-hc.h b/drivers/usb/host/whci/whci-hc.h
index 794dba0d0f0a..e8d0001605be 100644
--- a/drivers/usb/host/whci/whci-hc.h
+++ b/drivers/usb/host/whci/whci-hc.h
@@ -264,6 +264,7 @@ struct whc_qset {
         unsigned in_sw_list:1;
         unsigned in_hw_list:1;
         unsigned remove:1;
+        unsigned reset:1;
         struct urb *pause_after_urb;
         struct completion remove_complete;
         int max_burst;
diff --git a/drivers/usb/host/xhci-dbg.c b/drivers/usb/host/xhci-dbg.c
index 705e34324156..33128d52f212 100644
--- a/drivers/usb/host/xhci-dbg.c
+++ b/drivers/usb/host/xhci-dbg.c
@@ -413,7 +413,8 @@ void xhci_dbg_slot_ctx(struct xhci_hcd *xhci, struct xhci_container_ctx *ctx)
         int i;
 
         struct xhci_slot_ctx *slot_ctx = xhci_get_slot_ctx(xhci, ctx);
-        dma_addr_t dma = ctx->dma + ((unsigned long)slot_ctx - (unsigned long)ctx);
+        dma_addr_t dma = ctx->dma +
+                ((unsigned long)slot_ctx - (unsigned long)ctx->bytes);
         int csz = HCC_64BYTE_CONTEXT(xhci->hcc_params);
 
         xhci_dbg(xhci, "Slot Context:\n");
@@ -459,7 +460,7 @@ void xhci_dbg_ep_ctx(struct xhci_hcd *xhci,
         for (i = 0; i < last_ep_ctx; ++i) {
                 struct xhci_ep_ctx *ep_ctx = xhci_get_ep_ctx(xhci, ctx, i);
                 dma_addr_t dma = ctx->dma +
-                        ((unsigned long)ep_ctx - (unsigned long)ctx);
+                        ((unsigned long)ep_ctx - (unsigned long)ctx->bytes);
 
                 xhci_dbg(xhci, "Endpoint %02d Context:\n", i);
                 xhci_dbg(xhci, "@%p (virt) @%08llx (dma) %#08x - ep_info\n",
diff --git a/drivers/usb/host/xhci-hcd.c b/drivers/usb/host/xhci-hcd.c
index 816c39caca1c..99911e727e0b 100644
--- a/drivers/usb/host/xhci-hcd.c
+++ b/drivers/usb/host/xhci-hcd.c
@@ -22,12 +22,18 @@
 
 #include <linux/irq.h>
 #include <linux/module.h>
+#include <linux/moduleparam.h>
 
 #include "xhci.h"
 
 #define DRIVER_AUTHOR "Sarah Sharp"
 #define DRIVER_DESC "'eXtensible' Host Controller (xHC) Driver"
 
+/* Some 0.95 hardware can't handle the chain bit on a Link TRB being cleared */
+static int link_quirk;
+module_param(link_quirk, int, S_IRUGO | S_IWUSR);
+MODULE_PARM_DESC(link_quirk, "Don't clear the chain bit on a link TRB");
+
 /* TODO: copied from ehci-hcd.c - can this be refactored? */
 /*
  * handshake - spin reading hc until handshake completes or fails
@@ -214,6 +220,12 @@ int xhci_init(struct usb_hcd *hcd)
 
         xhci_dbg(xhci, "xhci_init\n");
         spin_lock_init(&xhci->lock);
+        if (link_quirk) {
+                xhci_dbg(xhci, "QUIRK: Not clearing Link TRB chain bits.\n");
+                xhci->quirks |= XHCI_LINK_TRB_QUIRK;
+        } else {
+                xhci_dbg(xhci, "xHCI doesn't need link TRB QUIRK\n");
+        }
         retval = xhci_mem_init(xhci, GFP_KERNEL);
         xhci_dbg(xhci, "Finished xhci_init\n");
 
@@ -339,13 +351,14 @@ void xhci_event_ring_work(unsigned long arg)
         xhci_dbg_ring_ptrs(xhci, xhci->cmd_ring);
         xhci_dbg_cmd_ptrs(xhci);
         for (i = 0; i < MAX_HC_SLOTS; ++i) {
-                if (xhci->devs[i]) {
-                        for (j = 0; j < 31; ++j) {
-                                if (xhci->devs[i]->ep_rings[j]) {
-                                        xhci_dbg(xhci, "Dev %d endpoint ring %d:\n", i, j);
-                                        xhci_debug_segment(xhci, xhci->devs[i]->ep_rings[j]->deq_seg);
-                                }
-                        }
+                if (!xhci->devs[i])
+                        continue;
+                for (j = 0; j < 31; ++j) {
+                        struct xhci_ring *ring = xhci->devs[i]->eps[j].ring;
+                        if (!ring)
+                                continue;
+                        xhci_dbg(xhci, "Dev %d endpoint ring %d:\n", i, j);
+                        xhci_debug_segment(xhci, ring->deq_seg);
                 }
         }
 
@@ -555,13 +568,22 @@ unsigned int xhci_get_endpoint_flag(struct usb_endpoint_descriptor *desc)
         return 1 << (xhci_get_endpoint_index(desc) + 1);
 }
 
+/* Find the flag for this endpoint (for use in the control context).  Use the
+ * endpoint index to create a bitmask.  The slot context is bit 0, endpoint 0 is
+ * bit 1, etc.
+ */
+unsigned int xhci_get_endpoint_flag_from_index(unsigned int ep_index)
+{
+        return 1 << (ep_index + 1);
+}
+
 /* Compute the last valid endpoint context index.  Basically, this is the
  * endpoint index plus one.  For slot contexts with more than valid endpoint,
  * we find the most significant bit set in the added contexts flags.
  * e.g. ep 1 IN (with epnum 0x81) => added_ctxs = 0b1000
  * fls(0b1000) = 4, but the endpoint context index is 3, so subtract one.
  */
-static inline unsigned int xhci_last_valid_endpoint(u32 added_ctxs)
+unsigned int xhci_last_valid_endpoint(u32 added_ctxs)
 {
         return fls(added_ctxs) - 1;
 }
@@ -589,6 +611,71 @@ int xhci_check_args(struct usb_hcd *hcd, struct usb_device *udev,
         return 1;
 }
 
+static int xhci_configure_endpoint(struct xhci_hcd *xhci,
+                struct usb_device *udev, struct xhci_command *command,
+                bool ctx_change, bool must_succeed);
+
+/*
+ * Full speed devices may have a max packet size greater than 8 bytes, but the
+ * USB core doesn't know that until it reads the first 8 bytes of the
+ * descriptor.  If the usb_device's max packet size changes after that point,
+ * we need to issue an evaluate context command and wait on it.
+ */
+static int xhci_check_maxpacket(struct xhci_hcd *xhci, unsigned int slot_id,
+                unsigned int ep_index, struct urb *urb)
+{
+        struct xhci_container_ctx *in_ctx;
+        struct xhci_container_ctx *out_ctx;
+        struct xhci_input_control_ctx *ctrl_ctx;
+        struct xhci_ep_ctx *ep_ctx;
+        int max_packet_size;
+        int hw_max_packet_size;
+        int ret = 0;
+
+        out_ctx = xhci->devs[slot_id]->out_ctx;
+        ep_ctx = xhci_get_ep_ctx(xhci, out_ctx, ep_index);
+        hw_max_packet_size = MAX_PACKET_DECODED(ep_ctx->ep_info2);
+        max_packet_size = urb->dev->ep0.desc.wMaxPacketSize;
+        if (hw_max_packet_size != max_packet_size) {
+                xhci_dbg(xhci, "Max Packet Size for ep 0 changed.\n");
+                xhci_dbg(xhci, "Max packet size in usb_device = %d\n",
+                                max_packet_size);
+                xhci_dbg(xhci, "Max packet size in xHCI HW = %d\n",
+                                hw_max_packet_size);
+                xhci_dbg(xhci, "Issuing evaluate context command.\n");
+
+                /* Set up the modified control endpoint 0 */
+                xhci_endpoint_copy(xhci, xhci->devs[slot_id]->in_ctx,
+                                xhci->devs[slot_id]->out_ctx, ep_index);
+                in_ctx = xhci->devs[slot_id]->in_ctx;
+                ep_ctx = xhci_get_ep_ctx(xhci, in_ctx, ep_index);
+                ep_ctx->ep_info2 &= ~MAX_PACKET_MASK;
+                ep_ctx->ep_info2 |= MAX_PACKET(max_packet_size);
+
+                /* Set up the input context flags for the command */
+                /* FIXME: This won't work if a non-default control endpoint
+                 * changes max packet sizes.
+                 */
+                ctrl_ctx = xhci_get_input_control_ctx(xhci, in_ctx);
+                ctrl_ctx->add_flags = EP0_FLAG;
+                ctrl_ctx->drop_flags = 0;
+
+                xhci_dbg(xhci, "Slot %d input context\n", slot_id);
+                xhci_dbg_ctx(xhci, in_ctx, ep_index);
+                xhci_dbg(xhci, "Slot %d output context\n", slot_id);
+                xhci_dbg_ctx(xhci, out_ctx, ep_index);
+
+                ret = xhci_configure_endpoint(xhci, urb->dev, NULL,
+                                true, false);
+
+                /* Clean up the input context for later use by bandwidth
+                 * functions.
+                 */
+                ctrl_ctx->add_flags = SLOT_FLAG;
+        }
+        return ret;
+}
+
 /*
  * non-error returns are a promise to giveback() the urb later
  * we drop ownership so next owner (or urb unlink) can get it
@@ -600,13 +687,13 @@ int xhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, gfp_t mem_flags)
         int ret = 0;
         unsigned int slot_id, ep_index;
 
+
         if (!urb || xhci_check_args(hcd, urb->dev, urb->ep, true, __func__) <= 0)
                 return -EINVAL;
 
         slot_id = urb->dev->slot_id;
         ep_index = xhci_get_endpoint_index(&urb->ep->desc);
 
-        spin_lock_irqsave(&xhci->lock, flags);
         if (!xhci->devs || !xhci->devs[slot_id]) {
                 if (!in_interrupt())
                         dev_warn(&urb->dev->dev, "WARN: urb submitted for dev with no Slot ID\n");
@@ -619,19 +706,38 @@ int xhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, gfp_t mem_flags)
                 ret = -ESHUTDOWN;
                 goto exit;
         }
-        if (usb_endpoint_xfer_control(&urb->ep->desc))
+        if (usb_endpoint_xfer_control(&urb->ep->desc)) {
+                /* Check to see if the max packet size for the default control
+                 * endpoint changed during FS device enumeration
+                 */
+                if (urb->dev->speed == USB_SPEED_FULL) {
+                        ret = xhci_check_maxpacket(xhci, slot_id,
+                                        ep_index, urb);
+                        if (ret < 0)
+                                return ret;
+                }
+
                 /* We have a spinlock and interrupts disabled, so we must pass
                  * atomic context to this function, which may allocate memory.
                  */
+                spin_lock_irqsave(&xhci->lock, flags);
                 ret = xhci_queue_ctrl_tx(xhci, GFP_ATOMIC, urb,
                                 slot_id, ep_index);
-        else if (usb_endpoint_xfer_bulk(&urb->ep->desc))
+                spin_unlock_irqrestore(&xhci->lock, flags);
+        } else if (usb_endpoint_xfer_bulk(&urb->ep->desc)) {
+                spin_lock_irqsave(&xhci->lock, flags);
                 ret = xhci_queue_bulk_tx(xhci, GFP_ATOMIC, urb,
                                 slot_id, ep_index);
-        else
+                spin_unlock_irqrestore(&xhci->lock, flags);
+        } else if (usb_endpoint_xfer_int(&urb->ep->desc)) {
+                spin_lock_irqsave(&xhci->lock, flags);
+                ret = xhci_queue_intr_tx(xhci, GFP_ATOMIC, urb,
+                                slot_id, ep_index);
+                spin_unlock_irqrestore(&xhci->lock, flags);
+        } else {
                 ret = -EINVAL;
+        }
 exit:
-        spin_unlock_irqrestore(&xhci->lock, flags);
         return ret;
 }
 
@@ -674,6 +780,7 @@ int xhci_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status)
         struct xhci_td *td;
         unsigned int ep_index;
         struct xhci_ring *ep_ring;
+        struct xhci_virt_ep *ep;
 
         xhci = hcd_to_xhci(hcd);
         spin_lock_irqsave(&xhci->lock, flags);
@@ -686,17 +793,18 @@ int xhci_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status)
         xhci_dbg(xhci, "Event ring:\n");
         xhci_debug_ring(xhci, xhci->event_ring);
         ep_index = xhci_get_endpoint_index(&urb->ep->desc);
-        ep_ring = xhci->devs[urb->dev->slot_id]->ep_rings[ep_index];
+        ep = &xhci->devs[urb->dev->slot_id]->eps[ep_index];
+        ep_ring = ep->ring;
         xhci_dbg(xhci, "Endpoint ring:\n");
         xhci_debug_ring(xhci, ep_ring);
         td = (struct xhci_td *) urb->hcpriv;
 
-        ep_ring->cancels_pending++;
-        list_add_tail(&td->cancelled_td_list, &ep_ring->cancelled_td_list);
+        ep->cancels_pending++;
+        list_add_tail(&td->cancelled_td_list, &ep->cancelled_td_list);
         /* Queue a stop endpoint command, but only if this is
          * the first cancellation to be handled.
          */
-        if (ep_ring->cancels_pending == 1) {
+        if (ep->cancels_pending == 1) {
                 xhci_queue_stop_endpoint(xhci, urb->dev->slot_id, ep_index);
                 xhci_ring_cmd_db(xhci);
         }
@@ -930,6 +1038,141 @@ static void xhci_zero_in_ctx(struct xhci_hcd *xhci, struct xhci_virt_device *vir
         }
 }
 
+static int xhci_configure_endpoint_result(struct xhci_hcd *xhci,
+                struct usb_device *udev, int *cmd_status)
+{
+        int ret;
+
+        switch (*cmd_status) {
+        case COMP_ENOMEM:
+                dev_warn(&udev->dev, "Not enough host controller resources "
+                                "for new device state.\n");
+                ret = -ENOMEM;
+                /* FIXME: can we allocate more resources for the HC? */
+                break;
+        case COMP_BW_ERR:
+                dev_warn(&udev->dev, "Not enough bandwidth "
+                                "for new device state.\n");
+                ret = -ENOSPC;
+                /* FIXME: can we go back to the old state? */
+                break;
+        case COMP_TRB_ERR:
+                /* the HCD set up something wrong */
+                dev_warn(&udev->dev, "ERROR: Endpoint drop flag = 0, "
+                                "add flag = 1, "
+                                "and endpoint is not disabled.\n");
+                ret = -EINVAL;
+                break;
+        case COMP_SUCCESS:
+                dev_dbg(&udev->dev, "Successful Endpoint Configure command\n");
+                ret = 0;
+                break;
+        default:
+                xhci_err(xhci, "ERROR: unexpected command completion "
+                                "code 0x%x.\n", *cmd_status);
+                ret = -EINVAL;
+                break;
+        }
+        return ret;
+}
+
+static int xhci_evaluate_context_result(struct xhci_hcd *xhci,
+                struct usb_device *udev, int *cmd_status)
+{
+        int ret;
+        struct xhci_virt_device *virt_dev = xhci->devs[udev->slot_id];
+
+        switch (*cmd_status) {
+        case COMP_EINVAL:
+                dev_warn(&udev->dev, "WARN: xHCI driver setup invalid evaluate "
+                                "context command.\n");
+                ret = -EINVAL;
+                break;
+        case COMP_EBADSLT:
+                dev_warn(&udev->dev, "WARN: slot not enabled for"
+                                "evaluate context command.\n");
+        case COMP_CTX_STATE:
+                dev_warn(&udev->dev, "WARN: invalid context state for "
+                                "evaluate context command.\n");
+                xhci_dbg_ctx(xhci, virt_dev->out_ctx, 1);
+                ret = -EINVAL;
+                break;
+        case COMP_SUCCESS:
+                dev_dbg(&udev->dev, "Successful evaluate context command\n");
+                ret = 0;
+                break;
+        default:
+                xhci_err(xhci, "ERROR: unexpected command completion "
+                                "code 0x%x.\n", *cmd_status);
+                ret = -EINVAL;
+                break;
+        }
+        return ret;
+}
+
+/* Issue a configure endpoint command or evaluate context command
+ * and wait for it to finish.
+ */
+static int xhci_configure_endpoint(struct xhci_hcd *xhci,
+                struct usb_device *udev,
+                struct xhci_command *command,
+                bool ctx_change, bool must_succeed)
+{
+        int ret;
+        int timeleft;
+        unsigned long flags;
+        struct xhci_container_ctx *in_ctx;
+        struct completion *cmd_completion;
+        int *cmd_status;
+        struct xhci_virt_device *virt_dev;
+
+        spin_lock_irqsave(&xhci->lock, flags);
+        virt_dev = xhci->devs[udev->slot_id];
+        if (command) {
+                in_ctx = command->in_ctx;
+                cmd_completion = command->completion;
+                cmd_status = &command->status;
+                command->command_trb = xhci->cmd_ring->enqueue;
+                list_add_tail(&command->cmd_list, &virt_dev->cmd_list);
+        } else {
+                in_ctx = virt_dev->in_ctx;
+                cmd_completion = &virt_dev->cmd_completion;
+                cmd_status = &virt_dev->cmd_status;
+        }
+
+        if (!ctx_change)
+                ret = xhci_queue_configure_endpoint(xhci, in_ctx->dma,
+                                udev->slot_id, must_succeed);
+        else
+                ret = xhci_queue_evaluate_context(xhci, in_ctx->dma,
+                                udev->slot_id);
+        if (ret < 0) {
+                spin_unlock_irqrestore(&xhci->lock, flags);
+                xhci_dbg(xhci, "FIXME allocate a new ring segment\n");
+                return -ENOMEM;
+        }
+        xhci_ring_cmd_db(xhci);
+        spin_unlock_irqrestore(&xhci->lock, flags);
+
+        /* Wait for the configure endpoint command to complete */
+        timeleft = wait_for_completion_interruptible_timeout(
+                        cmd_completion,
+                        USB_CTRL_SET_TIMEOUT);
+        if (timeleft <= 0) {
+                xhci_warn(xhci, "%s while waiting for %s command\n",
+                                timeleft == 0 ? "Timeout" : "Signal",
+                                ctx_change == 0 ?
+                                        "configure endpoint" :
+                                        "evaluate context");
+                /* FIXME cancel the configure endpoint command */
+                return -ETIME;
+        }
+
+        if (!ctx_change)
+                return xhci_configure_endpoint_result(xhci, udev, cmd_status);
+        return xhci_evaluate_context_result(xhci, udev, cmd_status);
+}
+
 /* Called after one or more calls to xhci_add_endpoint() or
  * xhci_drop_endpoint().  If this call fails, the USB core is expected
  * to call xhci_reset_bandwidth().
@@ -944,8 +1187,6 @@ int xhci_check_bandwidth(struct usb_hcd *hcd, struct usb_device *udev)
 {
         int i;
         int ret = 0;
-        int timeleft;
-        unsigned long flags;
         struct xhci_hcd *xhci;
         struct xhci_virt_device *virt_dev;
         struct xhci_input_control_ctx *ctrl_ctx;
@@ -975,56 +1216,8 @@ int xhci_check_bandwidth(struct usb_hcd *hcd, struct usb_device *udev)
         xhci_dbg_ctx(xhci, virt_dev->in_ctx,
                         LAST_CTX_TO_EP_NUM(slot_ctx->dev_info));
 
-        spin_lock_irqsave(&xhci->lock, flags);
-        ret = xhci_queue_configure_endpoint(xhci, virt_dev->in_ctx->dma,
-                        udev->slot_id);
-        if (ret < 0) {
-                spin_unlock_irqrestore(&xhci->lock, flags);
-                xhci_dbg(xhci, "FIXME allocate a new ring segment\n");
-                return -ENOMEM;
-        }
-        xhci_ring_cmd_db(xhci);
-        spin_unlock_irqrestore(&xhci->lock, flags);
-
-        /* Wait for the configure endpoint command to complete */
-        timeleft = wait_for_completion_interruptible_timeout(
-                        &virt_dev->cmd_completion,
-                        USB_CTRL_SET_TIMEOUT);
-        if (timeleft <= 0) {
-                xhci_warn(xhci, "%s while waiting for configure endpoint command\n",
-                                timeleft == 0 ? "Timeout" : "Signal");
-                /* FIXME cancel the configure endpoint command */
-                return -ETIME;
-        }
-
-        switch (virt_dev->cmd_status) {
-        case COMP_ENOMEM:
-                dev_warn(&udev->dev, "Not enough host controller resources "
-                                "for new device state.\n");
-                ret = -ENOMEM;
-                /* FIXME: can we allocate more resources for the HC? */
-                break;
-        case COMP_BW_ERR:
-                dev_warn(&udev->dev, "Not enough bandwidth "
-                                "for new device state.\n");
-                ret = -ENOSPC;
-                /* FIXME: can we go back to the old state? */
-                break;
-        case COMP_TRB_ERR:
-                /* the HCD set up something wrong */
-                dev_warn(&udev->dev, "ERROR: Endpoint drop flag = 0, add flag = 1, "
-                                "and endpoint is not disabled.\n");
-                ret = -EINVAL;
-                break;
-        case COMP_SUCCESS:
-                dev_dbg(&udev->dev, "Successful Endpoint Configure command\n");
-                break;
-        default:
-                xhci_err(xhci, "ERROR: unexpected command completion "
-                                "code 0x%x.\n", virt_dev->cmd_status);
-                ret = -EINVAL;
-                break;
-        }
+        ret = xhci_configure_endpoint(xhci, udev, NULL,
+                        false, false);
         if (ret) {
                 /* Callee should call reset_bandwidth() */
                 return ret;
@@ -1037,10 +1230,10 @@ int xhci_check_bandwidth(struct usb_hcd *hcd, struct usb_device *udev)
         xhci_zero_in_ctx(xhci, virt_dev);
         /* Free any old rings */
         for (i = 1; i < 31; ++i) {
-                if (virt_dev->new_ep_rings[i]) {
-                        xhci_ring_free(xhci, virt_dev->ep_rings[i]);
-                        virt_dev->ep_rings[i] = virt_dev->new_ep_rings[i];
-                        virt_dev->new_ep_rings[i] = NULL;
+                if (virt_dev->eps[i].new_ring) {
+                        xhci_ring_free(xhci, virt_dev->eps[i].ring);
+                        virt_dev->eps[i].ring = virt_dev->eps[i].new_ring;
+                        virt_dev->eps[i].new_ring = NULL;
                 }
         }
 
@@ -1067,14 +1260,93 @@ void xhci_reset_bandwidth(struct usb_hcd *hcd, struct usb_device *udev)
         virt_dev = xhci->devs[udev->slot_id];
         /* Free any rings allocated for added endpoints */
         for (i = 0; i < 31; ++i) {
-                if (virt_dev->new_ep_rings[i]) {
-                        xhci_ring_free(xhci, virt_dev->new_ep_rings[i]);
-                        virt_dev->new_ep_rings[i] = NULL;
+                if (virt_dev->eps[i].new_ring) {
+                        xhci_ring_free(xhci, virt_dev->eps[i].new_ring);
+                        virt_dev->eps[i].new_ring = NULL;
                 }
         }
         xhci_zero_in_ctx(xhci, virt_dev);
 }
 
+static void xhci_setup_input_ctx_for_config_ep(struct xhci_hcd *xhci,
+                struct xhci_container_ctx *in_ctx,
+                struct xhci_container_ctx *out_ctx,
+                u32 add_flags, u32 drop_flags)
+{
+        struct xhci_input_control_ctx *ctrl_ctx;
+        ctrl_ctx = xhci_get_input_control_ctx(xhci, in_ctx);
+        ctrl_ctx->add_flags = add_flags;
+        ctrl_ctx->drop_flags = drop_flags;
+        xhci_slot_copy(xhci, in_ctx, out_ctx);
+        ctrl_ctx->add_flags |= SLOT_FLAG;
+
+        xhci_dbg(xhci, "Input Context:\n");
+        xhci_dbg_ctx(xhci, in_ctx, xhci_last_valid_endpoint(add_flags));
+}
+
+void xhci_setup_input_ctx_for_quirk(struct xhci_hcd *xhci,
+                unsigned int slot_id, unsigned int ep_index,
+                struct xhci_dequeue_state *deq_state)
+{
+        struct xhci_container_ctx *in_ctx;
+        struct xhci_ep_ctx *ep_ctx;
+        u32 added_ctxs;
+        dma_addr_t addr;
+
+        xhci_endpoint_copy(xhci, xhci->devs[slot_id]->in_ctx,
+                        xhci->devs[slot_id]->out_ctx, ep_index);
+        in_ctx = xhci->devs[slot_id]->in_ctx;
+        ep_ctx = xhci_get_ep_ctx(xhci, in_ctx, ep_index);
+        addr = xhci_trb_virt_to_dma(deq_state->new_deq_seg,
+                        deq_state->new_deq_ptr);
+        if (addr == 0) {
+                xhci_warn(xhci, "WARN Cannot submit config ep after "
+                                "reset ep command\n");
+                xhci_warn(xhci, "WARN deq seg = %p, deq ptr = %p\n",
+                                deq_state->new_deq_seg,
+                                deq_state->new_deq_ptr);
+                return;
+        }
+        ep_ctx->deq = addr | deq_state->new_cycle_state;
+
+        added_ctxs = xhci_get_endpoint_flag_from_index(ep_index);
+        xhci_setup_input_ctx_for_config_ep(xhci, xhci->devs[slot_id]->in_ctx,
+                        xhci->devs[slot_id]->out_ctx, added_ctxs, added_ctxs);
+}
+
+void xhci_cleanup_stalled_ring(struct xhci_hcd *xhci,
+                struct usb_device *udev, unsigned int ep_index)
+{
+        struct xhci_dequeue_state deq_state;
+        struct xhci_virt_ep *ep;
+
+        xhci_dbg(xhci, "Cleaning up stalled endpoint ring\n");
+        ep = &xhci->devs[udev->slot_id]->eps[ep_index];
+        /* We need to move the HW's dequeue pointer past this TD,
+         * or it will attempt to resend it on the next doorbell ring.
+         */
+        xhci_find_new_dequeue_state(xhci, udev->slot_id,
+                        ep_index, ep->stopped_td,
+                        &deq_state);
+
+        /* HW with the reset endpoint quirk will use the saved dequeue state to
+         * issue a configure endpoint command later.
+         */
+        if (!(xhci->quirks & XHCI_RESET_EP_QUIRK)) {
+                xhci_dbg(xhci, "Queueing new dequeue state\n");
+                xhci_queue_new_dequeue_state(xhci, udev->slot_id,
+                                ep_index, &deq_state);
+        } else {
+                /* Better hope no one uses the input context between now and the
+                 * reset endpoint completion!
+                 */
+                xhci_dbg(xhci, "Setting up input context for "
+                                "configure endpoint command\n");
+                xhci_setup_input_ctx_for_quirk(xhci, udev->slot_id,
+                                ep_index, &deq_state);
+        }
+}
+
 /* Deal with stalled endpoints.  The core should have sent the control message
  * to clear the halt condition.  However, we need to make the xHCI hardware
  * reset its sequence number, since a device will expect a sequence number of
@@ -1089,8 +1361,7 @@ void xhci_endpoint_reset(struct usb_hcd *hcd,
         unsigned int ep_index;
         unsigned long flags;
         int ret;
-        struct xhci_dequeue_state deq_state;
-        struct xhci_ring *ep_ring;
+        struct xhci_virt_ep *virt_ep;
 
         xhci = hcd_to_xhci(hcd);
         udev = (struct usb_device *) ep->hcpriv;
@@ -1100,12 +1371,16 @@ void xhci_endpoint_reset(struct usb_hcd *hcd,
         if (!ep->hcpriv)
                 return;
         ep_index = xhci_get_endpoint_index(&ep->desc);
-        ep_ring = xhci->devs[udev->slot_id]->ep_rings[ep_index];
-        if (!ep_ring->stopped_td) {
+        virt_ep = &xhci->devs[udev->slot_id]->eps[ep_index];
+        if (!virt_ep->stopped_td) {
                 xhci_dbg(xhci, "Endpoint 0x%x not halted, refusing to reset.\n",
                                 ep->desc.bEndpointAddress);
                 return;
         }
+        if (usb_endpoint_xfer_control(&ep->desc)) {
+                xhci_dbg(xhci, "Control endpoint stall already handled.\n");
+                return;
+        }
 
         xhci_dbg(xhci, "Queueing reset endpoint command\n");
         spin_lock_irqsave(&xhci->lock, flags);
@@ -1116,17 +1391,8 @@ void xhci_endpoint_reset(struct usb_hcd *hcd,
          * command.  Better hope that last command worked!
          */
         if (!ret) {
-                xhci_dbg(xhci, "Cleaning up stalled endpoint ring\n");
-                /* We need to move the HW's dequeue pointer past this TD,
-                 * or it will attempt to resend it on the next doorbell ring.
-                 */
-                xhci_find_new_dequeue_state(xhci, udev->slot_id,
-                                ep_index, ep_ring->stopped_td, &deq_state);
-                xhci_dbg(xhci, "Queueing new dequeue state\n");
-                xhci_queue_new_dequeue_state(xhci, ep_ring,
-                                udev->slot_id,
-                                ep_index, &deq_state);
-                kfree(ep_ring->stopped_td);
+                xhci_cleanup_stalled_ring(xhci, udev, ep_index);
+                kfree(virt_ep->stopped_td);
                 xhci_ring_cmd_db(xhci);
         }
         spin_unlock_irqrestore(&xhci->lock, flags);
@@ -1328,6 +1594,88 @@ int xhci_address_device(struct usb_hcd *hcd, struct usb_device *udev)
         return 0;
 }
 
+/* Once a hub descriptor is fetched for a device, we need to update the xHC's
+ * internal data structures for the device.
+ */
+int xhci_update_hub_device(struct usb_hcd *hcd, struct usb_device *hdev,
+                        struct usb_tt *tt, gfp_t mem_flags)
+{
+        struct xhci_hcd *xhci = hcd_to_xhci(hcd);
+        struct xhci_virt_device *vdev;
+        struct xhci_command *config_cmd;
+        struct xhci_input_control_ctx *ctrl_ctx;
+        struct xhci_slot_ctx *slot_ctx;
+        unsigned long flags;
+        unsigned think_time;
+        int ret;
+
+        /* Ignore root hubs */
+        if (!hdev->parent)
+                return 0;
+
+        vdev = xhci->devs[hdev->slot_id];
+        if (!vdev) {
+                xhci_warn(xhci, "Cannot update hub desc for unknown device.\n");
+                return -EINVAL;
+        }
+        config_cmd = xhci_alloc_command(xhci, true, mem_flags);
+        if (!config_cmd) {
+                xhci_dbg(xhci, "Could not allocate xHCI command structure.\n");
+                return -ENOMEM;
+        }
+
+        spin_lock_irqsave(&xhci->lock, flags);
+        xhci_slot_copy(xhci, config_cmd->in_ctx, vdev->out_ctx);
+        ctrl_ctx = xhci_get_input_control_ctx(xhci, config_cmd->in_ctx);
+        ctrl_ctx->add_flags |= SLOT_FLAG;
+        slot_ctx = xhci_get_slot_ctx(xhci, config_cmd->in_ctx);
+        slot_ctx->dev_info |= DEV_HUB;
+        if (tt->multi)
+                slot_ctx->dev_info |= DEV_MTT;
+        if (xhci->hci_version > 0x95) {
+                xhci_dbg(xhci, "xHCI version %x needs hub "
+                                "TT think time and number of ports\n",
+                                (unsigned int) xhci->hci_version);
+                slot_ctx->dev_info2 |= XHCI_MAX_PORTS(hdev->maxchild);
+                /* Set TT think time - convert from ns to FS bit times.
+                 * 0 = 8 FS bit times, 1 = 16 FS bit times,
+                 * 2 = 24 FS bit times, 3 = 32 FS bit times.
+                 */
+                think_time = tt->think_time;
+                if (think_time != 0)
+                        think_time = (think_time / 666) - 1;
+                slot_ctx->tt_info |= TT_THINK_TIME(think_time);
+        } else {
+                xhci_dbg(xhci, "xHCI version %x doesn't need hub "
+                                "TT think time or number of ports\n",
+                                (unsigned int) xhci->hci_version);
+        }
+        slot_ctx->dev_state = 0;
+        spin_unlock_irqrestore(&xhci->lock, flags);
+
+        xhci_dbg(xhci, "Set up %s for hub device.\n",
+                        (xhci->hci_version > 0x95) ?
+                        "configure endpoint" : "evaluate context");
+        xhci_dbg(xhci, "Slot %u Input Context:\n", hdev->slot_id);
+        xhci_dbg_ctx(xhci, config_cmd->in_ctx, 0);
+
+        /* Issue and wait for the configure endpoint or
+         * evaluate context command.
+         */
+        if (xhci->hci_version > 0x95)
+                ret = xhci_configure_endpoint(xhci, hdev, config_cmd,
+                                false, false);
+        else
+                ret = xhci_configure_endpoint(xhci, hdev, config_cmd,
+                                true, false);
+
+        xhci_dbg(xhci, "Slot %u Output Context:\n", hdev->slot_id);
+        xhci_dbg_ctx(xhci, vdev->out_ctx, 0);
+
+        xhci_free_command(xhci, config_cmd);
+        return ret;
+}
+
 int xhci_get_frame(struct usb_hcd *hcd)
 {
         struct xhci_hcd *xhci = hcd_to_xhci(hcd);
diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
index e6b9a1c6002d..1db4fea8c170 100644
--- a/drivers/usb/host/xhci-mem.c
+++ b/drivers/usb/host/xhci-mem.c
@@ -94,6 +94,9 @@ static void xhci_link_segments(struct xhci_hcd *xhci, struct xhci_segment *prev,
                 val = prev->trbs[TRBS_PER_SEGMENT-1].link.control;
                 val &= ~TRB_TYPE_BITMASK;
                 val |= TRB_TYPE(TRB_LINK);
+                /* Always set the chain bit with 0.95 hardware */
+                if (xhci_link_trb_quirk(xhci))
+                        val |= TRB_CHAIN;
                 prev->trbs[TRBS_PER_SEGMENT-1].link.control = val;
         }
         xhci_dbg(xhci, "Linking segment 0x%llx to segment 0x%llx (DMA)\n",
@@ -141,7 +144,6 @@ static struct xhci_ring *xhci_ring_alloc(struct xhci_hcd *xhci,
                 return 0;
 
         INIT_LIST_HEAD(&ring->td_list);
-        INIT_LIST_HEAD(&ring->cancelled_td_list);
         if (num_segs == 0)
                 return ring;
 
@@ -262,8 +264,8 @@ void xhci_free_virt_device(struct xhci_hcd *xhci, int slot_id)
                 return;
 
         for (i = 0; i < 31; ++i)
-                if (dev->ep_rings[i])
-                        xhci_ring_free(xhci, dev->ep_rings[i]);
+                if (dev->eps[i].ring)
+                        xhci_ring_free(xhci, dev->eps[i].ring);
 
         if (dev->in_ctx)
                 xhci_free_container_ctx(xhci, dev->in_ctx);
@@ -278,6 +280,7 @@ int xhci_alloc_virt_device(struct xhci_hcd *xhci, int slot_id,
                 struct usb_device *udev, gfp_t flags)
 {
         struct xhci_virt_device *dev;
+        int i;
 
         /* Slot ID 0 is reserved */
         if (slot_id == 0 || xhci->devs[slot_id]) {
@@ -306,12 +309,17 @@ int xhci_alloc_virt_device(struct xhci_hcd *xhci, int slot_id,
         xhci_dbg(xhci, "Slot %d input ctx = 0x%llx (dma)\n", slot_id,
                         (unsigned long long)dev->in_ctx->dma);
 
+        /* Initialize the cancellation list for each endpoint */
+        for (i = 0; i < 31; i++)
+                INIT_LIST_HEAD(&dev->eps[i].cancelled_td_list);
+
         /* Allocate endpoint 0 ring */
-        dev->ep_rings[0] = xhci_ring_alloc(xhci, 1, true, flags);
-        if (!dev->ep_rings[0])
+        dev->eps[0].ring = xhci_ring_alloc(xhci, 1, true, flags);
+        if (!dev->eps[0].ring)
                 goto fail;
 
         init_completion(&dev->cmd_completion);
+        INIT_LIST_HEAD(&dev->cmd_list);
 
         /* Point to output device context in dcbaa. */
         xhci->dcbaa->dev_context_ptrs[slot_id] = dev->out_ctx->dma;
@@ -352,9 +360,9 @@ int xhci_setup_addressable_virt_dev(struct xhci_hcd *xhci, struct usb_device *ud
         /* 3) Only the control endpoint is valid - one endpoint context */
         slot_ctx->dev_info |= LAST_CTX(1);
 
+        slot_ctx->dev_info |= (u32) udev->route;
         switch (udev->speed) {
         case USB_SPEED_SUPER:
-                slot_ctx->dev_info |= (u32) udev->route;
                 slot_ctx->dev_info |= (u32) SLOT_SPEED_SS;
                 break;
         case USB_SPEED_HIGH:
@@ -382,14 +390,12 @@ int xhci_setup_addressable_virt_dev(struct xhci_hcd *xhci, struct usb_device *ud
         xhci_dbg(xhci, "Set root hub portnum to %d\n", top_dev->portnum);
 
         /* Is this a LS/FS device under a HS hub? */
-        /*
-         * FIXME: I don't think this is right, where does the TT info for the
-         * roothub or parent hub come from?
-         */
         if ((udev->speed == USB_SPEED_LOW || udev->speed == USB_SPEED_FULL) &&
                         udev->tt) {
                 slot_ctx->tt_info = udev->tt->hub->slot_id;
                 slot_ctx->tt_info |= udev->ttport << 8;
+                if (udev->tt->multi)
+                        slot_ctx->dev_info |= DEV_MTT;
         }
         xhci_dbg(xhci, "udev->tt = %p\n", udev->tt);
         xhci_dbg(xhci, "udev->ttport = 0x%x\n", udev->ttport);
@@ -398,22 +404,35 @@ int xhci_setup_addressable_virt_dev(struct xhci_hcd *xhci, struct usb_device *ud
         /* Step 5 */
         ep0_ctx->ep_info2 = EP_TYPE(CTRL_EP);
         /*
-         * See section 4.3 bullet 6:
-         * The default Max Packet size for ep0 is "8 bytes for a USB2
-         * LS/FS/HS device or 512 bytes for a USB3 SS device"
          * XXX: Not sure about wireless USB devices.
          */
-        if (udev->speed == USB_SPEED_SUPER)
+        switch (udev->speed) {
+        case USB_SPEED_SUPER:
                 ep0_ctx->ep_info2 |= MAX_PACKET(512);
-        else
+                break;
+        case USB_SPEED_HIGH:
+        /* USB core guesses at a 64-byte max packet first for FS devices */
+        case USB_SPEED_FULL:
+                ep0_ctx->ep_info2 |= MAX_PACKET(64);
+                break;
+        case USB_SPEED_LOW:
                 ep0_ctx->ep_info2 |= MAX_PACKET(8);
+                break;
+        case USB_SPEED_VARIABLE:
+                xhci_dbg(xhci, "FIXME xHCI doesn't support wireless speeds\n");
+                return -EINVAL;
+                break;
+        default:
+                /* New speed? */
+                BUG();
+        }
         /* EP 0 can handle "burst" sizes of 1, so Max Burst Size field is 0 */
         ep0_ctx->ep_info2 |= MAX_BURST(0);
         ep0_ctx->ep_info2 |= ERROR_COUNT(3);
 
         ep0_ctx->deq =
-                dev->ep_rings[0]->first_seg->dma;
-        ep0_ctx->deq |= dev->ep_rings[0]->cycle_state;
+                dev->eps[0].ring->first_seg->dma;
+        ep0_ctx->deq |= dev->eps[0].ring->cycle_state;
 
         /* Steps 7 and 8 were done in xhci_alloc_virt_device() */
 
@@ -523,10 +542,11 @@ int xhci_endpoint_init(struct xhci_hcd *xhci,
         ep_ctx = xhci_get_ep_ctx(xhci, virt_dev->in_ctx, ep_index);
 
         /* Set up the endpoint ring */
-        virt_dev->new_ep_rings[ep_index] = xhci_ring_alloc(xhci, 1, true, mem_flags);
-        if (!virt_dev->new_ep_rings[ep_index])
+        virt_dev->eps[ep_index].new_ring =
+                xhci_ring_alloc(xhci, 1, true, mem_flags);
+        if (!virt_dev->eps[ep_index].new_ring)
                 return -ENOMEM;
-        ep_ring = virt_dev->new_ep_rings[ep_index];
+        ep_ring = virt_dev->eps[ep_index].new_ring;
         ep_ctx->deq = ep_ring->first_seg->dma | ep_ring->cycle_state;
 
         ep_ctx->ep_info = xhci_get_endpoint_interval(udev, ep);
@@ -598,6 +618,48 @@ void xhci_endpoint_zero(struct xhci_hcd *xhci,
          */
 }
 
+/* Copy output xhci_ep_ctx to the input xhci_ep_ctx copy.
+ * Useful when you want to change one particular aspect of the endpoint and then
+ * issue a configure endpoint command.
+ */
+void xhci_endpoint_copy(struct xhci_hcd *xhci,
+                struct xhci_container_ctx *in_ctx,
+                struct xhci_container_ctx *out_ctx,
+                unsigned int ep_index)
+{
+        struct xhci_ep_ctx *out_ep_ctx;
+        struct xhci_ep_ctx *in_ep_ctx;
+
+        out_ep_ctx = xhci_get_ep_ctx(xhci, out_ctx, ep_index);
+        in_ep_ctx = xhci_get_ep_ctx(xhci, in_ctx, ep_index);
+
+        in_ep_ctx->ep_info = out_ep_ctx->ep_info;
+        in_ep_ctx->ep_info2 = out_ep_ctx->ep_info2;
+        in_ep_ctx->deq = out_ep_ctx->deq;
+        in_ep_ctx->tx_info = out_ep_ctx->tx_info;
+}
+
+/* Copy output xhci_slot_ctx to the input xhci_slot_ctx.
+ * Useful when you want to change one particular aspect of the endpoint and then
+ * issue a configure endpoint command.  Only the context entries field matters,
+ * but we'll copy the whole thing anyway.
+ */
+void xhci_slot_copy(struct xhci_hcd *xhci,
+                struct xhci_container_ctx *in_ctx,
+                struct xhci_container_ctx *out_ctx)
+{
+        struct xhci_slot_ctx *in_slot_ctx;
+        struct xhci_slot_ctx *out_slot_ctx;
+
+        in_slot_ctx = xhci_get_slot_ctx(xhci, in_ctx);
+        out_slot_ctx = xhci_get_slot_ctx(xhci, out_ctx);
+
+        in_slot_ctx->dev_info = out_slot_ctx->dev_info;
+        in_slot_ctx->dev_info2 = out_slot_ctx->dev_info2;
+        in_slot_ctx->tt_info = out_slot_ctx->tt_info;
+        in_slot_ctx->dev_state = out_slot_ctx->dev_state;
+}
+
 /* Set up the scratchpad buffer array and scratchpad buffers, if needed. */
 static int scratchpad_alloc(struct xhci_hcd *xhci, gfp_t flags)
 {
@@ -695,6 +757,44 @@ static void scratchpad_free(struct xhci_hcd *xhci)
         xhci->scratchpad = NULL;
 }
 
+struct xhci_command *xhci_alloc_command(struct xhci_hcd *xhci,
+                bool allocate_completion, gfp_t mem_flags)
+{
+        struct xhci_command *command;
+
+        command = kzalloc(sizeof(*command), mem_flags);
+        if (!command)
+                return NULL;
+
+        command->in_ctx =
+                xhci_alloc_container_ctx(xhci, XHCI_CTX_TYPE_INPUT, mem_flags);
+        if (!command->in_ctx)
+                return NULL;
+
+        if (allocate_completion) {
+                command->completion =
+                        kzalloc(sizeof(struct completion), mem_flags);
+                if (!command->completion) {
+                        xhci_free_container_ctx(xhci, command->in_ctx);
+                        return NULL;
+                }
+                init_completion(command->completion);
+        }
+
+        command->status = 0;
+        INIT_LIST_HEAD(&command->cmd_list);
+        return command;
+}
+
+void xhci_free_command(struct xhci_hcd *xhci,
+                struct xhci_command *command)
+{
+        xhci_free_container_ctx(xhci,
+                        command->in_ctx);
+        kfree(command->completion);
+        kfree(command);
+}
+
 void xhci_mem_cleanup(struct xhci_hcd *xhci)
 {
         struct pci_dev  *pdev = to_pci_dev(xhci_to_hcd(xhci)->self.controller);
diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
index 592fe7e623f7..06595ec27bb7 100644
--- a/drivers/usb/host/xhci-pci.c
+++ b/drivers/usb/host/xhci-pci.c
@@ -24,6 +24,10 @@
 
 #include "xhci.h"
 
+/* Device for a quirk */
+#define PCI_VENDOR_ID_FRESCO_LOGIC      0x1b73
+#define PCI_DEVICE_ID_FRESCO_LOGIC_PDK  0x1000
+
 static const char hcd_name[] = "xhci_hcd";
 
 /* called after powerup, by probe or system-pm "wakeup" */
@@ -59,9 +63,20 @@ static int xhci_pci_setup(struct usb_hcd *hcd)
         xhci->hcs_params1 = xhci_readl(xhci, &xhci->cap_regs->hcs_params1);
         xhci->hcs_params2 = xhci_readl(xhci, &xhci->cap_regs->hcs_params2);
         xhci->hcs_params3 = xhci_readl(xhci, &xhci->cap_regs->hcs_params3);
+        xhci->hcc_params = xhci_readl(xhci, &xhci->cap_regs->hc_capbase);
+        xhci->hci_version = HC_VERSION(xhci->hcc_params);
         xhci->hcc_params = xhci_readl(xhci, &xhci->cap_regs->hcc_params);
         xhci_print_registers(xhci);
 
+        /* Look for vendor-specific quirks */
+        if (pdev->vendor == PCI_VENDOR_ID_FRESCO_LOGIC &&
+                        pdev->device == PCI_DEVICE_ID_FRESCO_LOGIC_PDK &&
+                        pdev->revision == 0x0) {
+                        xhci->quirks |= XHCI_RESET_EP_QUIRK;
+                        xhci_dbg(xhci, "QUIRK: Fresco Logic xHC needs configure"
+                                        " endpoint cmd after reset endpoint\n");
+        }
+
         /* Make sure the HC is halted. */
         retval = xhci_halt(xhci);
         if (retval)
@@ -121,6 +136,7 @@ static const struct hc_driver xhci_pci_hc_driver = {
         .check_bandwidth =      xhci_check_bandwidth,
         .reset_bandwidth =      xhci_reset_bandwidth,
         .address_device =       xhci_address_device,
+        .update_hub_device =    xhci_update_hub_device,
 
         /*
          * scheduling support
diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index aa88a067148b..173c39c76489 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -172,8 +172,9 @@ static void inc_deq(struct xhci_hcd *xhci, struct xhci_ring *ring, bool consumer
  * have their chain bit cleared (so that each Link TRB is a separate TD).
  *
  * Section 6.4.4.1 of the 0.95 spec says link TRBs cannot have the chain bit
- * set, but other sections talk about dealing with the chain bit set.
- * Assume section 6.4.4.1 is wrong, and the chain bit can be set in a Link TRB.
+ * set, but other sections talk about dealing with the chain bit set.  This was
+ * fixed in the 0.96 specification errata, but we have to assume that all 0.95
+ * xHCI hardware can't handle the chain bit being cleared on a link TRB.
  */
 static void inc_enq(struct xhci_hcd *xhci, struct xhci_ring *ring, bool consumer)
 {
@@ -191,8 +192,14 @@ static void inc_enq(struct xhci_hcd *xhci, struct xhci_ring *ring, bool consumer
         while (last_trb(xhci, ring, ring->enq_seg, next)) {
                 if (!consumer) {
                         if (ring != xhci->event_ring) {
-                                next->link.control &= ~TRB_CHAIN;
-                                next->link.control |= chain;
+                                /* If we're not dealing with 0.95 hardware,
+                                 * carry over the chain bit of the previous TRB
+                                 * (which may mean the chain bit is cleared).
+                                 */
+                                if (!xhci_link_trb_quirk(xhci)) {
+                                        next->link.control &= ~TRB_CHAIN;
+                                        next->link.control |= chain;
+                                }
                                 /* Give this link TRB to the hardware */
                                 wmb();
                                 if (next->link.control & TRB_CYCLE)
@@ -289,16 +296,18 @@ static void ring_ep_doorbell(struct xhci_hcd *xhci,
                 unsigned int slot_id,
                 unsigned int ep_index)
 {
-        struct xhci_ring *ep_ring;
+        struct xhci_virt_ep *ep;
+        unsigned int ep_state;
         u32 field;
         __u32 __iomem *db_addr = &xhci->dba->doorbell[slot_id];
 
-        ep_ring = xhci->devs[slot_id]->ep_rings[ep_index];
+        ep = &xhci->devs[slot_id]->eps[ep_index];
+        ep_state = ep->ep_state;
         /* Don't ring the doorbell for this endpoint if there are pending
          * cancellations because the we don't want to interrupt processing.
          */
-        if (!ep_ring->cancels_pending && !(ep_ring->state & SET_DEQ_PENDING)
-                        && !(ep_ring->state & EP_HALTED)) {
+        if (!ep->cancels_pending && !(ep_state & SET_DEQ_PENDING)
+                        && !(ep_state & EP_HALTED)) {
                 field = xhci_readl(xhci, db_addr) & DB_MASK;
                 xhci_writel(xhci, field | EPI_TO_DB(ep_index), db_addr);
                 /* Flush PCI posted writes - FIXME Matthew Wilcox says this
@@ -354,7 +363,7 @@ void xhci_find_new_dequeue_state(struct xhci_hcd *xhci,
                 struct xhci_td *cur_td, struct xhci_dequeue_state *state)
 {
         struct xhci_virt_device *dev = xhci->devs[slot_id];
-        struct xhci_ring *ep_ring = dev->ep_rings[ep_index];
+        struct xhci_ring *ep_ring = dev->eps[ep_index].ring;
         struct xhci_generic_trb *trb;
         struct xhci_ep_ctx *ep_ctx;
         dma_addr_t addr;
@@ -362,7 +371,7 @@ void xhci_find_new_dequeue_state(struct xhci_hcd *xhci,
         state->new_cycle_state = 0;
         xhci_dbg(xhci, "Finding segment containing stopped TRB.\n");
         state->new_deq_seg = find_trb_seg(cur_td->start_seg,
-                        ep_ring->stopped_trb,
+                        dev->eps[ep_index].stopped_trb,
                         &state->new_cycle_state);
         if (!state->new_deq_seg)
                 BUG();
@@ -442,9 +451,11 @@ static int queue_set_tr_deq(struct xhci_hcd *xhci, int slot_id,
                 union xhci_trb *deq_ptr, u32 cycle_state);
 
 void xhci_queue_new_dequeue_state(struct xhci_hcd *xhci,
-                struct xhci_ring *ep_ring, unsigned int slot_id,
-                unsigned int ep_index, struct xhci_dequeue_state *deq_state)
+                unsigned int slot_id, unsigned int ep_index,
+                struct xhci_dequeue_state *deq_state)
 {
+        struct xhci_virt_ep *ep = &xhci->devs[slot_id]->eps[ep_index];
+
         xhci_dbg(xhci, "Set TR Deq Ptr cmd, new deq seg = %p (0x%llx dma), "
                         "new deq ptr = %p (0x%llx dma), new cycle = %u\n",
                         deq_state->new_deq_seg,
@@ -461,8 +472,7 @@ void xhci_queue_new_dequeue_state(struct xhci_hcd *xhci,
          * if the ring is running, and ringing the doorbell starts the
          * ring running.
          */
-        ep_ring->state |= SET_DEQ_PENDING;
-        xhci_ring_cmd_db(xhci);
+        ep->ep_state |= SET_DEQ_PENDING;
 }
 
 /*
@@ -481,6 +491,7 @@ static void handle_stopped_endpoint(struct xhci_hcd *xhci,
         unsigned int slot_id;
         unsigned int ep_index;
         struct xhci_ring *ep_ring;
+        struct xhci_virt_ep *ep;
         struct list_head *entry;
         struct xhci_td *cur_td = 0;
         struct xhci_td *last_unlinked_td;
@@ -493,9 +504,10 @@ static void handle_stopped_endpoint(struct xhci_hcd *xhci,
         memset(&deq_state, 0, sizeof(deq_state));
         slot_id = TRB_TO_SLOT_ID(trb->generic.field[3]);
         ep_index = TRB_TO_EP_INDEX(trb->generic.field[3]);
-        ep_ring = xhci->devs[slot_id]->ep_rings[ep_index];
+        ep = &xhci->devs[slot_id]->eps[ep_index];
+        ep_ring = ep->ring;
 
-        if (list_empty(&ep_ring->cancelled_td_list))
+        if (list_empty(&ep->cancelled_td_list))
                 return;
 
         /* Fix up the ep ring first, so HW stops executing cancelled TDs.
@@ -503,7 +515,7 @@ static void handle_stopped_endpoint(struct xhci_hcd *xhci,
          * it.  We're also in the event handler, so we can't get re-interrupted
          * if another Stop Endpoint command completes
          */
-        list_for_each(entry, &ep_ring->cancelled_td_list) {
+        list_for_each(entry, &ep->cancelled_td_list) {
                 cur_td = list_entry(entry, struct xhci_td, cancelled_td_list);
                 xhci_dbg(xhci, "Cancelling TD starting at %p, 0x%llx (dma).\n",
                                 cur_td->first_trb,
@@ -512,7 +524,7 @@ static void handle_stopped_endpoint(struct xhci_hcd *xhci,
                  * If we stopped on the TD we need to cancel, then we have to
                  * move the xHC endpoint ring dequeue pointer past this TD.
                  */
-                if (cur_td == ep_ring->stopped_td)
+                if (cur_td == ep->stopped_td)
                         xhci_find_new_dequeue_state(xhci, slot_id, ep_index, cur_td,
                                         &deq_state);
                 else
@@ -523,14 +535,15 @@ static void handle_stopped_endpoint(struct xhci_hcd *xhci,
                  * the cancelled TD list for URB completion later.
                  */
                 list_del(&cur_td->td_list);
-                ep_ring->cancels_pending--;
+                ep->cancels_pending--;
         }
         last_unlinked_td = cur_td;
 
         /* If necessary, queue a Set Transfer Ring Dequeue Pointer command */
         if (deq_state.new_deq_ptr && deq_state.new_deq_seg) {
-                xhci_queue_new_dequeue_state(xhci, ep_ring,
+                xhci_queue_new_dequeue_state(xhci,
                                 slot_id, ep_index, &deq_state);
+                xhci_ring_cmd_db(xhci);
         } else {
                 /* Otherwise just ring the doorbell to restart the ring */
                 ring_ep_doorbell(xhci, slot_id, ep_index);
@@ -543,7 +556,7 @@ static void handle_stopped_endpoint(struct xhci_hcd *xhci,
          * So stop when we've completed the URB for the last TD we unlinked.
          */
         do {
-                cur_td = list_entry(ep_ring->cancelled_td_list.next,
+                cur_td = list_entry(ep->cancelled_td_list.next,
                                 struct xhci_td, cancelled_td_list);
                 list_del(&cur_td->cancelled_td_list);
 
@@ -590,7 +603,7 @@ static void handle_set_deq_completion(struct xhci_hcd *xhci,
         slot_id = TRB_TO_SLOT_ID(trb->generic.field[3]);
         ep_index = TRB_TO_EP_INDEX(trb->generic.field[3]);
         dev = xhci->devs[slot_id];
-        ep_ring = dev->ep_rings[ep_index];
+        ep_ring = dev->eps[ep_index].ring;
         ep_ctx = xhci_get_ep_ctx(xhci, dev->out_ctx, ep_index);
         slot_ctx = xhci_get_slot_ctx(xhci, dev->out_ctx);
 
@@ -634,7 +647,7 @@ static void handle_set_deq_completion(struct xhci_hcd *xhci,
                                 ep_ctx->deq);
         }
 
-        ep_ring->state &= ~SET_DEQ_PENDING;
+        dev->eps[ep_index].ep_state &= ~SET_DEQ_PENDING;
         ring_ep_doorbell(xhci, slot_id, ep_index);
 }
 
@@ -644,18 +657,60 @@ static void handle_reset_ep_completion(struct xhci_hcd *xhci,
 {
         int slot_id;
         unsigned int ep_index;
+        struct xhci_ring *ep_ring;
 
         slot_id = TRB_TO_SLOT_ID(trb->generic.field[3]);
         ep_index = TRB_TO_EP_INDEX(trb->generic.field[3]);
+        ep_ring = xhci->devs[slot_id]->eps[ep_index].ring;
         /* This command will only fail if the endpoint wasn't halted,
          * but we don't care.
          */
         xhci_dbg(xhci, "Ignoring reset ep completion code of %u\n",
                         (unsigned int) GET_COMP_CODE(event->status));
 
-        /* Clear our internal halted state and restart the ring */
-        xhci->devs[slot_id]->ep_rings[ep_index]->state &= ~EP_HALTED;
-        ring_ep_doorbell(xhci, slot_id, ep_index);
+        /* HW with the reset endpoint quirk needs to have a configure endpoint
+         * command complete before the endpoint can be used.  Queue that here
+         * because the HW can't handle two commands being queued in a row.
+         */
+        if (xhci->quirks & XHCI_RESET_EP_QUIRK) {
+                xhci_dbg(xhci, "Queueing configure endpoint command\n");
+                xhci_queue_configure_endpoint(xhci,
+                                xhci->devs[slot_id]->in_ctx->dma, slot_id,
+                                false);
+                xhci_ring_cmd_db(xhci);
+        } else {
+                /* Clear our internal halted state and restart the ring */
+                xhci->devs[slot_id]->eps[ep_index].ep_state &= ~EP_HALTED;
+                ring_ep_doorbell(xhci, slot_id, ep_index);
+        }
+}
+
+/* Check to see if a command in the device's command queue matches this one.
+ * Signal the completion or free the command, and return 1.  Return 0 if the
+ * completed command isn't at the head of the command list.
+ */
+static int handle_cmd_in_cmd_wait_list(struct xhci_hcd *xhci,
+                struct xhci_virt_device *virt_dev,
+                struct xhci_event_cmd *event)
+{
+        struct xhci_command *command;
+
+        if (list_empty(&virt_dev->cmd_list))
+                return 0;
+
+        command = list_entry(virt_dev->cmd_list.next,
+                        struct xhci_command, cmd_list);
+        if (xhci->cmd_ring->dequeue != command->command_trb)
+                return 0;
+
+        command->status =
+                GET_COMP_CODE(event->status);
+        list_del(&command->cmd_list);
+        if (command->completion)
+                complete(command->completion);
+        else
+                xhci_free_command(xhci, command);
+        return 1;
 }
 
 static void handle_cmd_completion(struct xhci_hcd *xhci,
@@ -664,6 +719,11 @@ static void handle_cmd_completion(struct xhci_hcd *xhci,
         int slot_id = TRB_TO_SLOT_ID(event->flags);
         u64 cmd_dma;
         dma_addr_t cmd_dequeue_dma;
+        struct xhci_input_control_ctx *ctrl_ctx;
+        struct xhci_virt_device *virt_dev;
+        unsigned int ep_index;
+        struct xhci_ring *ep_ring;
+        unsigned int ep_state;
 
         cmd_dma = event->cmd_trb;
         cmd_dequeue_dma = xhci_trb_virt_to_dma(xhci->cmd_ring->deq_seg,
@@ -691,6 +751,47 @@ static void handle_cmd_completion(struct xhci_hcd *xhci,
                         xhci_free_virt_device(xhci, slot_id);
                 break;
         case TRB_TYPE(TRB_CONFIG_EP):
+                virt_dev = xhci->devs[slot_id];
+                if (handle_cmd_in_cmd_wait_list(xhci, virt_dev, event))
+                        break;
+                /*
+                 * Configure endpoint commands can come from the USB core
+                 * configuration or alt setting changes, or because the HW
+                 * needed an extra configure endpoint command after a reset
+                 * endpoint command.  In the latter case, the xHCI driver is
+                 * not waiting on the configure endpoint command.
+                 */
+                ctrl_ctx = xhci_get_input_control_ctx(xhci,
+                                virt_dev->in_ctx);
+                /* Input ctx add_flags are the endpoint index plus one */
+                ep_index = xhci_last_valid_endpoint(ctrl_ctx->add_flags) - 1;
+                ep_ring = xhci->devs[slot_id]->eps[ep_index].ring;
+                if (!ep_ring) {
+                        /* This must have been an initial configure endpoint */
+                        xhci->devs[slot_id]->cmd_status =
+                                GET_COMP_CODE(event->status);
+                        complete(&xhci->devs[slot_id]->cmd_completion);
+                        break;
+                }
+                ep_state = xhci->devs[slot_id]->eps[ep_index].ep_state;
+                xhci_dbg(xhci, "Completed config ep cmd - last ep index = %d, "
+                                "state = %d\n", ep_index, ep_state);
+                if (xhci->quirks & XHCI_RESET_EP_QUIRK &&
+                                ep_state & EP_HALTED) {
+                        /* Clear our internal halted state and restart ring */
+                        xhci->devs[slot_id]->eps[ep_index].ep_state &=
+                                ~EP_HALTED;
+                        ring_ep_doorbell(xhci, slot_id, ep_index);
+                } else {
+                        xhci->devs[slot_id]->cmd_status =
+                                GET_COMP_CODE(event->status);
+                        complete(&xhci->devs[slot_id]->cmd_completion);
+                }
+                break;
+        case TRB_TYPE(TRB_EVAL_CONTEXT):
+                virt_dev = xhci->devs[slot_id];
+                if (handle_cmd_in_cmd_wait_list(xhci, virt_dev, event))
+                        break;
                 xhci->devs[slot_id]->cmd_status = GET_COMP_CODE(event->status);
                 complete(&xhci->devs[slot_id]->cmd_completion);
                 break;
@@ -805,7 +906,9 @@ static int handle_tx_event(struct xhci_hcd *xhci,
                 struct xhci_transfer_event *event)
 {
         struct xhci_virt_device *xdev;
+        struct xhci_virt_ep *ep;
         struct xhci_ring *ep_ring;
+        unsigned int slot_id;
         int ep_index;
         struct xhci_td *td = 0;
         dma_addr_t event_dma;
@@ -814,9 +917,11 @@ static int handle_tx_event(struct xhci_hcd *xhci,
         struct urb *urb = 0;
         int status = -EINPROGRESS;
         struct xhci_ep_ctx *ep_ctx;
+        u32 trb_comp_code;
 
         xhci_dbg(xhci, "In %s\n", __func__);
-        xdev = xhci->devs[TRB_TO_SLOT_ID(event->flags)];
+        slot_id = TRB_TO_SLOT_ID(event->flags);
+        xdev = xhci->devs[slot_id];
         if (!xdev) {
                 xhci_err(xhci, "ERROR Transfer event pointed to bad slot\n");
                 return -ENODEV;
@@ -825,7 +930,8 @@ static int handle_tx_event(struct xhci_hcd *xhci,
         /* Endpoint ID is 1 based, our index is zero based */
         ep_index = TRB_TO_EP_ID(event->flags) - 1;
         xhci_dbg(xhci, "%s - ep index = %d\n", __func__, ep_index);
-        ep_ring = xdev->ep_rings[ep_index];
+        ep = &xdev->eps[ep_index];
+        ep_ring = ep->ring;
         ep_ctx = xhci_get_ep_ctx(xhci, xdev->out_ctx, ep_index);
         if (!ep_ring || (ep_ctx->ep_info & EP_STATE_MASK) == EP_STATE_DISABLED) {
                 xhci_err(xhci, "ERROR Transfer event pointed to disabled endpoint\n");
@@ -870,7 +976,8 @@ static int handle_tx_event(struct xhci_hcd *xhci,
                         (unsigned int) event->flags);
 
         /* Look for common error cases */
-        switch (GET_COMP_CODE(event->transfer_len)) {
+        trb_comp_code = GET_COMP_CODE(event->transfer_len);
+        switch (trb_comp_code) {
         /* Skip codes that require special handling depending on
          * transfer type
          */
@@ -885,7 +992,7 @@ static int handle_tx_event(struct xhci_hcd *xhci,
                 break;
         case COMP_STALL:
                 xhci_warn(xhci, "WARN: Stalled endpoint\n");
-                ep_ring->state |= EP_HALTED;
+                ep->ep_state |= EP_HALTED;
                 status = -EPIPE;
                 break;
         case COMP_TRB_ERR:
@@ -913,7 +1020,7 @@ static int handle_tx_event(struct xhci_hcd *xhci,
         /* Was this a control transfer? */
         if (usb_endpoint_xfer_control(&td->urb->ep->desc)) {
                 xhci_debug_trb(xhci, xhci->event_ring->dequeue);
-                switch (GET_COMP_CODE(event->transfer_len)) {
+                switch (trb_comp_code) {
                 case COMP_SUCCESS:
                         if (event_trb == ep_ring->dequeue) {
                                 xhci_warn(xhci, "WARN: Success on ctrl setup TRB without IOC set??\n");
@@ -928,8 +1035,37 @@ static int handle_tx_event(struct xhci_hcd *xhci,
                         break;
                 case COMP_SHORT_TX:
                         xhci_warn(xhci, "WARN: short transfer on control ep\n");
-                        status = -EREMOTEIO;
+                        if (td->urb->transfer_flags & URB_SHORT_NOT_OK)
+                                status = -EREMOTEIO;
+                        else
+                                status = 0;
                         break;
+                case COMP_BABBLE:
+                        /* The 0.96 spec says a babbling control endpoint
+                         * is not halted. The 0.96 spec says it is.  Some HW
+                         * claims to be 0.95 compliant, but it halts the control
+                         * endpoint anyway.  Check if a babble halted the
+                         * endpoint.
+                         */
+                        if (ep_ctx->ep_info != EP_STATE_HALTED)
+                                break;
+                        /* else fall through */
+                case COMP_STALL:
+                        /* Did we transfer part of the data (middle) phase? */
+                        if (event_trb != ep_ring->dequeue &&
+                                        event_trb != td->last_trb)
+                                td->urb->actual_length =
+                                        td->urb->transfer_buffer_length
+                                        - TRB_LEN(event->transfer_len);
+                        else
+                                td->urb->actual_length = 0;
+
+                        ep->stopped_td = td;
+                        ep->stopped_trb = event_trb;
+                        xhci_queue_reset_ep(xhci, slot_id, ep_index);
+                        xhci_cleanup_stalled_ring(xhci, td->urb->dev, ep_index);
+                        xhci_ring_cmd_db(xhci);
+                        goto td_cleanup;
                 default:
                         /* Others already handled above */
                         break;
@@ -943,7 +1079,10 @@ static int handle_tx_event(struct xhci_hcd *xhci,
                         if (event_trb == td->last_trb) {
                                 if (td->urb->actual_length != 0) {
                                         /* Don't overwrite a previously set error code */
-                                        if (status == -EINPROGRESS || status == 0)
+                                        if ((status == -EINPROGRESS ||
+                                                                status == 0) &&
+                                                        (td->urb->transfer_flags
+                                                         & URB_SHORT_NOT_OK))
                                                 /* Did we already see a short data stage? */
                                                 status = -EREMOTEIO;
                                 } else {
@@ -952,7 +1091,7 @@ static int handle_tx_event(struct xhci_hcd *xhci,
                                 }
                         } else {
                         /* Maybe the event was for the data stage? */
-                                if (GET_COMP_CODE(event->transfer_len) != COMP_STOP_INVAL) {
+                                if (trb_comp_code != COMP_STOP_INVAL) {
                                         /* We didn't stop on a link TRB in the middle */
                                         td->urb->actual_length =
                                                 td->urb->transfer_buffer_length -
@@ -964,7 +1103,7 @@ static int handle_tx_event(struct xhci_hcd *xhci,
                         }
                 }
         } else {
-                switch (GET_COMP_CODE(event->transfer_len)) {
+                switch (trb_comp_code) {
                 case COMP_SUCCESS:
                         /* Double check that the HW transferred everything. */
                         if (event_trb != td->last_trb) {
@@ -975,7 +1114,12 @@ static int handle_tx_event(struct xhci_hcd *xhci,
                                 else
                                         status = 0;
                         } else {
-                                xhci_dbg(xhci, "Successful bulk transfer!\n");
+                                if (usb_endpoint_xfer_bulk(&td->urb->ep->desc))
+                                        xhci_dbg(xhci, "Successful bulk "
+                                                        "transfer!\n");
+                                else
+                                        xhci_dbg(xhci, "Successful interrupt "
+                                                        "transfer!\n");
                                 status = 0;
                         }
                         break;
@@ -1001,11 +1145,17 @@ static int handle_tx_event(struct xhci_hcd *xhci,
                                 td->urb->actual_length =
                                         td->urb->transfer_buffer_length -
                                         TRB_LEN(event->transfer_len);
-                                if (td->urb->actual_length < 0) {
+                                if (td->urb->transfer_buffer_length <
+                                                td->urb->actual_length) {
                                         xhci_warn(xhci, "HC gave bad length "
                                                         "of %d bytes left\n",
                                                         TRB_LEN(event->transfer_len));
                                         td->urb->actual_length = 0;
+                                        if (td->urb->transfer_flags &
+                                                        URB_SHORT_NOT_OK)
+                                                status = -EREMOTEIO;
+                                        else
+                                                status = 0;
                                 }
                                 /* Don't overwrite a previously set error code */
                                 if (status == -EINPROGRESS) {
@@ -1041,30 +1191,31 @@ static int handle_tx_event(struct xhci_hcd *xhci,
                         /* If the ring didn't stop on a Link or No-op TRB, add
                          * in the actual bytes transferred from the Normal TRB
                          */
-                        if (GET_COMP_CODE(event->transfer_len) != COMP_STOP_INVAL)
+                        if (trb_comp_code != COMP_STOP_INVAL)
                                 td->urb->actual_length +=
                                         TRB_LEN(cur_trb->generic.field[2]) -
                                         TRB_LEN(event->transfer_len);
                 }
         }
-        if (GET_COMP_CODE(event->transfer_len) == COMP_STOP_INVAL ||
-                        GET_COMP_CODE(event->transfer_len) == COMP_STOP) {
+        if (trb_comp_code == COMP_STOP_INVAL ||
+                        trb_comp_code == COMP_STOP) {
                 /* The Endpoint Stop Command completion will take care of any
                  * stopped TDs.  A stopped TD may be restarted, so don't update
                  * the ring dequeue pointer or take this TD off any lists yet.
                  */
-                ep_ring->stopped_td = td;
-                ep_ring->stopped_trb = event_trb;
+                ep->stopped_td = td;
+                ep->stopped_trb = event_trb;
         } else {
-                if (GET_COMP_CODE(event->transfer_len) == COMP_STALL) {
+                if (trb_comp_code == COMP_STALL ||
+                                trb_comp_code == COMP_BABBLE) {
                         /* The transfer is completed from the driver's
                          * perspective, but we need to issue a set dequeue
                          * command for this stalled endpoint to move the dequeue
                          * pointer past the TD.  We can't do that here because
                          * the halt condition must be cleared first.
                          */
-                        ep_ring->stopped_td = td;
-                        ep_ring->stopped_trb = event_trb;
+                        ep->stopped_td = td;
+                        ep->stopped_trb = event_trb;
                 } else {
                         /* Update ring dequeue pointer */
                         while (ep_ring->dequeue != td->last_trb)
@@ -1072,16 +1223,41 @@ static int handle_tx_event(struct xhci_hcd *xhci,
                         inc_deq(xhci, ep_ring, false);
                 }
 
+td_cleanup:
                 /* Clean up the endpoint's TD list */
                 urb = td->urb;
+                /* Do one last check of the actual transfer length.
+                 * If the host controller said we transferred more data than
+                 * the buffer length, urb->actual_length will be a very big
+                 * number (since it's unsigned).  Play it safe and say we didn't
+                 * transfer anything.
+                 */
+                if (urb->actual_length > urb->transfer_buffer_length) {
+                        xhci_warn(xhci, "URB transfer length is wrong, "
+                                        "xHC issue? req. len = %u, "
+                                        "act. len = %u\n",
+                                        urb->transfer_buffer_length,
+                                        urb->actual_length);
+                        urb->actual_length = 0;
+                        if (td->urb->transfer_flags & URB_SHORT_NOT_OK)
+                                status = -EREMOTEIO;
+                        else
+                                status = 0;
+                }
                 list_del(&td->td_list);
                 /* Was this TD slated to be cancelled but completed anyway? */
                 if (!list_empty(&td->cancelled_td_list)) {
                         list_del(&td->cancelled_td_list);
-                        ep_ring->cancels_pending--;
+                        ep->cancels_pending--;
                 }
-                /* Leave the TD around for the reset endpoint function to use */
-                if (GET_COMP_CODE(event->transfer_len) != COMP_STALL) {
+                /* Leave the TD around for the reset endpoint function to use
+                 * (but only if it's not a control endpoint, since we already
+                 * queued the Set TR dequeue pointer command for stalled
+                 * control endpoints).
+                 */
+                if (usb_endpoint_xfer_control(&urb->ep->desc) ||
+                        (trb_comp_code != COMP_STALL &&
+                                trb_comp_code != COMP_BABBLE)) {
                         kfree(td);
                 }
                 urb->hcpriv = NULL;
@@ -1094,7 +1270,7 @@ cleanup:
         if (urb) {
                 usb_hcd_unlink_urb_from_ep(xhci_to_hcd(xhci), urb);
                 xhci_dbg(xhci, "Giveback URB %p, len = %d, status = %d\n",
-                                urb, td->urb->actual_length, status);
+                                urb, urb->actual_length, status);
                 spin_unlock(&xhci->lock);
                 usb_hcd_giveback_urb(xhci_to_hcd(xhci), urb, status);
                 spin_lock(&xhci->lock);
@@ -1235,7 +1411,7 @@ static int prepare_transfer(struct xhci_hcd *xhci,
 {
         int ret;
         struct xhci_ep_ctx *ep_ctx = xhci_get_ep_ctx(xhci, xdev->out_ctx, ep_index);
-        ret = prepare_ring(xhci, xdev->ep_rings[ep_index],
+        ret = prepare_ring(xhci, xdev->eps[ep_index].ring,
                         ep_ctx->ep_info & EP_STATE_MASK,
                         num_trbs, mem_flags);
         if (ret)
@@ -1255,9 +1431,9 @@ static int prepare_transfer(struct xhci_hcd *xhci,
         (*td)->urb = urb;
         urb->hcpriv = (void *) (*td);
         /* Add this TD to the tail of the endpoint ring's TD list */
-        list_add_tail(&(*td)->td_list, &xdev->ep_rings[ep_index]->td_list);
-        (*td)->start_seg = xdev->ep_rings[ep_index]->enq_seg;
-        (*td)->first_trb = xdev->ep_rings[ep_index]->enqueue;
+        list_add_tail(&(*td)->td_list, &xdev->eps[ep_index].ring->td_list);
+        (*td)->start_seg = xdev->eps[ep_index].ring->enq_seg;
+        (*td)->first_trb = xdev->eps[ep_index].ring->enqueue;
 
         return 0;
 }
@@ -1335,6 +1511,47 @@ static void giveback_first_trb(struct xhci_hcd *xhci, int slot_id,
         ring_ep_doorbell(xhci, slot_id, ep_index);
 }
 
+/*
+ * xHCI uses normal TRBs for both bulk and interrupt.  When the interrupt
+ * endpoint is to be serviced, the xHC will consume (at most) one TD.  A TD
+ * (comprised of sg list entries) can take several service intervals to
+ * transmit.
+ */
+int xhci_queue_intr_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
+                struct urb *urb, int slot_id, unsigned int ep_index)
+{
+        struct xhci_ep_ctx *ep_ctx = xhci_get_ep_ctx(xhci,
+                        xhci->devs[slot_id]->out_ctx, ep_index);
+        int xhci_interval;
+        int ep_interval;
+
+        xhci_interval = EP_INTERVAL_TO_UFRAMES(ep_ctx->ep_info);
+        ep_interval = urb->interval;
+        /* Convert to microframes */
+        if (urb->dev->speed == USB_SPEED_LOW ||
+                        urb->dev->speed == USB_SPEED_FULL)
+                ep_interval *= 8;
+        /* FIXME change this to a warning and a suggestion to use the new API
+         * to set the polling interval (once the API is added).
+         */
+        if (xhci_interval != ep_interval) {
+                if (!printk_ratelimit())
+                        dev_dbg(&urb->dev->dev, "Driver uses different interval"
+                                        " (%d microframe%s) than xHCI "
+                                        "(%d microframe%s)\n",
+                                        ep_interval,
+                                        ep_interval == 1 ? "" : "s",
+                                        xhci_interval,
+                                        xhci_interval == 1 ? "" : "s");
+                urb->interval = xhci_interval;
+                /* Convert back to frames for LS/FS devices */
+                if (urb->dev->speed == USB_SPEED_LOW ||
+                                urb->dev->speed == USB_SPEED_FULL)
+                        urb->interval /= 8;
+        }
+        return xhci_queue_bulk_tx(xhci, GFP_ATOMIC, urb, slot_id, ep_index);
+}
+
 static int queue_bulk_sg_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
                 struct urb *urb, int slot_id, unsigned int ep_index)
 {
@@ -1350,7 +1567,7 @@ static int queue_bulk_sg_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
         struct xhci_generic_trb *start_trb;
         int start_cycle;
 
-        ep_ring = xhci->devs[slot_id]->ep_rings[ep_index];
+        ep_ring = xhci->devs[slot_id]->eps[ep_index].ring;
         num_trbs = count_sg_trbs_needed(xhci, urb);
         num_sgs = urb->num_sgs;
 
@@ -1483,7 +1700,7 @@ int xhci_queue_bulk_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
         if (urb->sg)
                 return queue_bulk_sg_tx(xhci, mem_flags, urb, slot_id, ep_index);
 
-        ep_ring = xhci->devs[slot_id]->ep_rings[ep_index];
+        ep_ring = xhci->devs[slot_id]->eps[ep_index].ring;
 
         num_trbs = 0;
         /* How much data is (potentially) left before the 64KB boundary? */
@@ -1594,7 +1811,7 @@ int xhci_queue_ctrl_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
         u32 field, length_field;
         struct xhci_td *td;
 
-        ep_ring = xhci->devs[slot_id]->ep_rings[ep_index];
+        ep_ring = xhci->devs[slot_id]->eps[ep_index].ring;
 
         /*
          * Need to copy setup packet into setup TRB, so we can't use the setup
@@ -1677,12 +1894,27 @@ int xhci_queue_ctrl_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
 
 /****           Command Ring Operations         ****/
 
-/* Generic function for queueing a command TRB on the command ring */
-static int queue_command(struct xhci_hcd *xhci, u32 field1, u32 field2, u32 field3, u32 field4)
+/* Generic function for queueing a command TRB on the command ring.
+ * Check to make sure there's room on the command ring for one command TRB.
+ * Also check that there's room reserved for commands that must not fail.
+ * If this is a command that must not fail, meaning command_must_succeed = TRUE,
+ * then only check for the number of reserved spots.
+ * Don't decrement xhci->cmd_ring_reserved_trbs after we've queued the TRB
+ * because the command event handler may want to resubmit a failed command.
+ */
+static int queue_command(struct xhci_hcd *xhci, u32 field1, u32 field2,
+                u32 field3, u32 field4, bool command_must_succeed)
 {
-        if (!room_on_ring(xhci, xhci->cmd_ring, 1)) {
+        int reserved_trbs = xhci->cmd_ring_reserved_trbs;
+        if (!command_must_succeed)
+                reserved_trbs++;
+
+        if (!room_on_ring(xhci, xhci->cmd_ring, reserved_trbs)) {
                 if (!in_interrupt())
                         xhci_err(xhci, "ERR: No room for command on command ring\n");
+                if (command_must_succeed)
+                        xhci_err(xhci, "ERR: Reserved TRB counting for "
+                                        "unfailable commands failed.\n");
                 return -ENOMEM;
         }
         queue_trb(xhci, xhci->cmd_ring, false, field1, field2, field3,
@@ -1693,7 +1925,7 @@ static int queue_command(struct xhci_hcd *xhci, u32 field1, u32 field2, u32 fiel
 /* Queue a no-op command on the command ring */
 static int queue_cmd_noop(struct xhci_hcd *xhci)
 {
-        return queue_command(xhci, 0, 0, 0, TRB_TYPE(TRB_CMD_NOOP));
+        return queue_command(xhci, 0, 0, 0, TRB_TYPE(TRB_CMD_NOOP), false);
 }
 
 /*
@@ -1712,7 +1944,7 @@ void *xhci_setup_one_noop(struct xhci_hcd *xhci)
 int xhci_queue_slot_control(struct xhci_hcd *xhci, u32 trb_type, u32 slot_id)
 {
         return queue_command(xhci, 0, 0, 0,
-                        TRB_TYPE(trb_type) | SLOT_ID_FOR_TRB(slot_id));
+                        TRB_TYPE(trb_type) | SLOT_ID_FOR_TRB(slot_id), false);
 }
 
 /* Queue an address device command TRB */
@@ -1721,16 +1953,28 @@ int xhci_queue_address_device(struct xhci_hcd *xhci, dma_addr_t in_ctx_ptr,
 {
         return queue_command(xhci, lower_32_bits(in_ctx_ptr),
                         upper_32_bits(in_ctx_ptr), 0,
-                        TRB_TYPE(TRB_ADDR_DEV) | SLOT_ID_FOR_TRB(slot_id));
+                        TRB_TYPE(TRB_ADDR_DEV) | SLOT_ID_FOR_TRB(slot_id),
+                        false);
 }
 
 /* Queue a configure endpoint command TRB */
 int xhci_queue_configure_endpoint(struct xhci_hcd *xhci, dma_addr_t in_ctx_ptr,
+                u32 slot_id, bool command_must_succeed)
+{
+        return queue_command(xhci, lower_32_bits(in_ctx_ptr),
+                        upper_32_bits(in_ctx_ptr), 0,
+                        TRB_TYPE(TRB_CONFIG_EP) | SLOT_ID_FOR_TRB(slot_id),
+                        command_must_succeed);
+}
+
+/* Queue an evaluate context command TRB */
+int xhci_queue_evaluate_context(struct xhci_hcd *xhci, dma_addr_t in_ctx_ptr,
                 u32 slot_id)
 {
         return queue_command(xhci, lower_32_bits(in_ctx_ptr),
                         upper_32_bits(in_ctx_ptr), 0,
-                        TRB_TYPE(TRB_CONFIG_EP) | SLOT_ID_FOR_TRB(slot_id));
+                        TRB_TYPE(TRB_EVAL_CONTEXT) | SLOT_ID_FOR_TRB(slot_id),
+                        false);
 }
 
 int xhci_queue_stop_endpoint(struct xhci_hcd *xhci, int slot_id,
@@ -1741,7 +1985,7 @@ int xhci_queue_stop_endpoint(struct xhci_hcd *xhci, int slot_id,
         u32 type = TRB_TYPE(TRB_STOP_RING);
 
         return queue_command(xhci, 0, 0, 0,
-                        trb_slot_id | trb_ep_index | type);
+                        trb_slot_id | trb_ep_index | type, false);
 }
 
 /* Set Transfer Ring Dequeue Pointer command.
@@ -1765,7 +2009,7 @@ static int queue_set_tr_deq(struct xhci_hcd *xhci, int slot_id,
         }
         return queue_command(xhci, lower_32_bits(addr) | cycle_state,
                         upper_32_bits(addr), 0,
-                        trb_slot_id | trb_ep_index | type);
+                        trb_slot_id | trb_ep_index | type, false);
 }
 
 int xhci_queue_reset_ep(struct xhci_hcd *xhci, int slot_id,
@@ -1775,5 +2019,6 @@ int xhci_queue_reset_ep(struct xhci_hcd *xhci, int slot_id,
         u32 trb_ep_index = EP_ID_FOR_TRB(ep_index);
         u32 type = TRB_TYPE(TRB_RESET_EP);
 
-        return queue_command(xhci, 0, 0, 0, trb_slot_id | trb_ep_index | type);
+        return queue_command(xhci, 0, 0, 0, trb_slot_id | trb_ep_index | type,
+                        false);
 }
diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
index d31d32206ba3..4b254b6fa245 100644
--- a/drivers/usb/host/xhci.h
+++ b/drivers/usb/host/xhci.h
@@ -509,6 +509,8 @@ struct xhci_slot_ctx {
 #define MAX_EXIT        (0xffff)
 /* Root hub port number that is needed to access the USB device */
 #define ROOT_HUB_PORT(p)        (((p) & 0xff) << 16)
+/* Maximum number of ports under a hub device */
+#define XHCI_MAX_PORTS(p)       (((p) & 0xff) << 24)
 
 /* tt_info bitmasks */
 /*
@@ -522,6 +524,7 @@ struct xhci_slot_ctx {
  * '0' if the device is not low or full speed.
  */
 #define TT_PORT         (0xff << 8)
+#define TT_THINK_TIME(p)        (((p) & 0x3) << 16)
 
 /* dev_state bitmasks */
 /* USB device address - assigned by the HC */
@@ -581,6 +584,7 @@ struct xhci_ep_ctx {
 /* bit 15 is Linear Stream Array */
 /* Interval - period between requests to an endpoint - 125u increments. */
 #define EP_INTERVAL(p)          ((p & 0xff) << 16)
+#define EP_INTERVAL_TO_UFRAMES(p)               (1 << (((p) >> 16) & 0xff))
 
 /* ep_info2 bitmasks */
 /*
@@ -589,6 +593,7 @@ struct xhci_ep_ctx {
  */
 #define FORCE_EVENT     (0x1)
 #define ERROR_COUNT(p)  (((p) & 0x3) << 1)
+#define CTX_TO_EP_TYPE(p)       (((p) >> 3) & 0x7)
 #define EP_TYPE(p)      ((p) << 3)
 #define ISOC_OUT_EP     1
 #define BULK_OUT_EP     2
@@ -601,6 +606,8 @@ struct xhci_ep_ctx {
 /* bit 7 is Host Initiate Disable - for disabling stream selection */
 #define MAX_BURST(p)    (((p)&0xff) << 8)
 #define MAX_PACKET(p)   (((p)&0xffff) << 16)
+#define MAX_PACKET_MASK         (0xffff << 16)
+#define MAX_PACKET_DECODED(p)   (((p) >> 16) & 0xffff)
 
 
 /**
@@ -616,11 +623,44 @@ struct xhci_input_control_ctx {
         u32     rsvd2[6];
 };
 
+/* Represents everything that is needed to issue a command on the command ring.
+ * It's useful to pre-allocate these for commands that cannot fail due to
+ * out-of-memory errors, like freeing streams.
+ */
+struct xhci_command {
+        /* Input context for changing device state */
+        struct xhci_container_ctx       *in_ctx;
+        u32                             status;
+        /* If completion is null, no one is waiting on this command
+         * and the structure can be freed after the command completes.
+         */
+        struct completion               *completion;
+        union xhci_trb                  *command_trb;
+        struct list_head                cmd_list;
+};
+
 /* drop context bitmasks */
 #define DROP_EP(x)      (0x1 << x)
 /* add context bitmasks */
 #define ADD_EP(x)       (0x1 << x)
 
+struct xhci_virt_ep {
+        struct xhci_ring                *ring;
+        /* Temporary storage in case the configure endpoint command fails and we
+         * have to restore the device state to the previous state
+         */
+        struct xhci_ring                *new_ring;
+        unsigned int                    ep_state;
+#define SET_DEQ_PENDING         (1 << 0)
+#define EP_HALTED               (1 << 1)
+        /* ----  Related to URB cancellation ---- */
+        struct list_head        cancelled_td_list;
+        unsigned int            cancels_pending;
+        /* The TRB that was last reported in a stopped endpoint ring */
+        union xhci_trb          *stopped_trb;
+        struct xhci_td          *stopped_td;
+};
+
 struct xhci_virt_device {
         /*
          * Commands to the hardware are passed an "input context" that
@@ -633,16 +673,11 @@ struct xhci_virt_device {
         struct xhci_container_ctx       *out_ctx;
         /* Used for addressing devices and configuration changes */
         struct xhci_container_ctx       *in_ctx;
-
-        /* FIXME when stream support is added */
-        struct xhci_ring                *ep_rings[31];
-        /* Temporary storage in case the configure endpoint command fails and we
-         * have to restore the device state to the previous state
-         */
-        struct xhci_ring                *new_ep_rings[31];
+        struct xhci_virt_ep             eps[31];
         struct completion               cmd_completion;
         /* Status of the last command issued for this device */
         u32                             cmd_status;
+        struct list_head                cmd_list;
 };
 
 
@@ -905,6 +940,8 @@ union xhci_trb {
  * It must also be greater than 16.
  */
 #define TRBS_PER_SEGMENT        64
+/* Allow two commands + a link TRB, along with any reserved command TRBs */
+#define MAX_RSVD_CMD_TRBS       (TRBS_PER_SEGMENT - 3)
 #define SEGMENT_SIZE            (TRBS_PER_SEGMENT*16)
 /* TRB buffer pointers can't cross 64KB boundaries */
 #define TRB_MAX_BUFF_SHIFT              16
@@ -926,6 +963,12 @@ struct xhci_td {
         union xhci_trb          *last_trb;
 };
 
+struct xhci_dequeue_state {
+        struct xhci_segment *new_deq_seg;
+        union xhci_trb *new_deq_ptr;
+        int new_cycle_state;
+};
+
 struct xhci_ring {
         struct xhci_segment     *first_seg;
         union  xhci_trb         *enqueue;
@@ -935,15 +978,6 @@ struct xhci_ring {
         struct xhci_segment     *deq_seg;
         unsigned int            deq_updates;
         struct list_head        td_list;
-        /* ----  Related to URB cancellation ---- */
-        struct list_head        cancelled_td_list;
-        unsigned int            cancels_pending;
-        unsigned int            state;
-#define SET_DEQ_PENDING         (1 << 0)
-#define EP_HALTED               (1 << 1)
-        /* The TRB that was last reported in a stopped endpoint ring */
-        union xhci_trb          *stopped_trb;
-        struct xhci_td          *stopped_td;
         /*
          * Write the cycle state into the TRB cycle field to give ownership of
          * the TRB to the host controller (if we are the producer), or to check
@@ -952,12 +986,6 @@ struct xhci_ring {
         u32                     cycle_state;
 };
 
-struct xhci_dequeue_state {
-        struct xhci_segment *new_deq_seg;
-        union xhci_trb *new_deq_ptr;
-        int new_cycle_state;
-};
-
 struct xhci_erst_entry {
         /* 64-bit event ring segment address */
         u64     seg_addr;
@@ -1034,6 +1062,7 @@ struct xhci_hcd {
         /* data structures */
         struct xhci_device_context_array *dcbaa;
         struct xhci_ring        *cmd_ring;
+        unsigned int            cmd_ring_reserved_trbs;
         struct xhci_ring        *event_ring;
         struct xhci_erst        erst;
         /* Scratchpad */
@@ -1058,6 +1087,9 @@ struct xhci_hcd {
         int                     noops_submitted;
         int                     noops_handled;
         int                     error_bitmask;
+        unsigned int            quirks;
+#define XHCI_LINK_TRB_QUIRK     (1 << 0)
+#define XHCI_RESET_EP_QUIRK     (1 << 1)
 };
 
 /* For testing purposes */
@@ -1136,6 +1168,13 @@ static inline void xhci_write_64(struct xhci_hcd *xhci,
         writel(val_hi, ptr + 1);
 }
 
+static inline int xhci_link_trb_quirk(struct xhci_hcd *xhci)
+{
+        u32 temp = xhci_readl(xhci, &xhci->cap_regs->hc_capbase);
+        return ((HC_VERSION(temp) == 0x95) &&
+                        (xhci->quirks & XHCI_LINK_TRB_QUIRK));
+}
+
 /* xHCI debugging */
 void xhci_print_ir_set(struct xhci_hcd *xhci, struct xhci_intr_reg *ir_set, int set_num);
 void xhci_print_registers(struct xhci_hcd *xhci);
@@ -1150,7 +1189,7 @@ void xhci_dbg_cmd_ptrs(struct xhci_hcd *xhci);
 void xhci_dbg_ring_ptrs(struct xhci_hcd *xhci, struct xhci_ring *ring);
 void xhci_dbg_ctx(struct xhci_hcd *xhci, struct xhci_container_ctx *ctx, unsigned int last_ep);
 
-/* xHCI memory managment */
+/* xHCI memory management */
 void xhci_mem_cleanup(struct xhci_hcd *xhci);
 int xhci_mem_init(struct xhci_hcd *xhci, gfp_t flags);
 void xhci_free_virt_device(struct xhci_hcd *xhci, int slot_id);
@@ -1158,11 +1197,24 @@ int xhci_alloc_virt_device(struct xhci_hcd *xhci, int slot_id, struct usb_device
 int xhci_setup_addressable_virt_dev(struct xhci_hcd *xhci, struct usb_device *udev);
 unsigned int xhci_get_endpoint_index(struct usb_endpoint_descriptor *desc);
 unsigned int xhci_get_endpoint_flag(struct usb_endpoint_descriptor *desc);
+unsigned int xhci_get_endpoint_flag_from_index(unsigned int ep_index);
+unsigned int xhci_last_valid_endpoint(u32 added_ctxs);
 void xhci_endpoint_zero(struct xhci_hcd *xhci, struct xhci_virt_device *virt_dev, struct usb_host_endpoint *ep);
+void xhci_endpoint_copy(struct xhci_hcd *xhci,
+                struct xhci_container_ctx *in_ctx,
+                struct xhci_container_ctx *out_ctx,
+                unsigned int ep_index);
+void xhci_slot_copy(struct xhci_hcd *xhci,
+                struct xhci_container_ctx *in_ctx,
+                struct xhci_container_ctx *out_ctx);
 int xhci_endpoint_init(struct xhci_hcd *xhci, struct xhci_virt_device *virt_dev,
                 struct usb_device *udev, struct usb_host_endpoint *ep,
                 gfp_t mem_flags);
 void xhci_ring_free(struct xhci_hcd *xhci, struct xhci_ring *ring);
+struct xhci_command *xhci_alloc_command(struct xhci_hcd *xhci,
+                bool allocate_completion, gfp_t mem_flags);
+void xhci_free_command(struct xhci_hcd *xhci,
+                struct xhci_command *command);
 
 #ifdef CONFIG_PCI
 /* xHCI PCI glue */
@@ -1182,6 +1234,8 @@ irqreturn_t xhci_irq(struct usb_hcd *hcd);
 int xhci_alloc_dev(struct usb_hcd *hcd, struct usb_device *udev);
 void xhci_free_dev(struct usb_hcd *hcd, struct usb_device *udev);
 int xhci_address_device(struct usb_hcd *hcd, struct usb_device *udev);
+int xhci_update_hub_device(struct usb_hcd *hcd, struct usb_device *hdev,
+                        struct usb_tt *tt, gfp_t mem_flags);
 int xhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, gfp_t mem_flags);
 int xhci_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status);
 int xhci_add_endpoint(struct usb_hcd *hcd, struct usb_device *udev, struct usb_host_endpoint *ep);
@@ -1205,7 +1259,11 @@ int xhci_queue_ctrl_tx(struct xhci_hcd *xhci, gfp_t mem_flags, struct urb *urb,
                 int slot_id, unsigned int ep_index);
 int xhci_queue_bulk_tx(struct xhci_hcd *xhci, gfp_t mem_flags, struct urb *urb,
                 int slot_id, unsigned int ep_index);
+int xhci_queue_intr_tx(struct xhci_hcd *xhci, gfp_t mem_flags, struct urb *urb,
+                int slot_id, unsigned int ep_index);
 int xhci_queue_configure_endpoint(struct xhci_hcd *xhci, dma_addr_t in_ctx_ptr,
+                u32 slot_id, bool command_must_succeed);
+int xhci_queue_evaluate_context(struct xhci_hcd *xhci, dma_addr_t in_ctx_ptr,
                 u32 slot_id);
 int xhci_queue_reset_ep(struct xhci_hcd *xhci, int slot_id,
                 unsigned int ep_index);
@@ -1213,8 +1271,13 @@ void xhci_find_new_dequeue_state(struct xhci_hcd *xhci,
                 unsigned int slot_id, unsigned int ep_index,
                 struct xhci_td *cur_td, struct xhci_dequeue_state *state);
 void xhci_queue_new_dequeue_state(struct xhci_hcd *xhci,
-                struct xhci_ring *ep_ring, unsigned int slot_id,
-                unsigned int ep_index, struct xhci_dequeue_state *deq_state);
+                unsigned int slot_id, unsigned int ep_index,
+                struct xhci_dequeue_state *deq_state);
+void xhci_cleanup_stalled_ring(struct xhci_hcd *xhci,
+                struct usb_device *udev, unsigned int ep_index);
+void xhci_queue_config_ep_quirk(struct xhci_hcd *xhci,
+                unsigned int slot_id, unsigned int ep_index,
+                struct xhci_dequeue_state *deq_state);
 
 /* xHCI roothub code */
 int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue, u16 wIndex,
diff --git a/drivers/usb/image/microtek.c b/drivers/usb/image/microtek.c
index 4541dfcea88f..459a7287fe01 100644
--- a/drivers/usb/image/microtek.c
+++ b/drivers/usb/image/microtek.c
@@ -653,33 +653,6 @@ static struct scsi_host_template mts_scsi_host_template = {
         .max_sectors=           256, /* 128 K */
 };
 
-struct vendor_product
-{
-        char* name;
-        enum
-        {
-                mts_sup_unknown=0,
-                mts_sup_alpha,
-                mts_sup_full
-        }
-        support_status;
-} ;
-
-
-/* These are taken from the msmUSB.inf file on the Windows driver CD */
-static const struct vendor_product mts_supported_products[] =
-{
-        { "Phantom 336CX",      mts_sup_unknown},
-        { "Phantom 336CX",      mts_sup_unknown},
-        { "Scanmaker X6",       mts_sup_alpha},
-        { "Phantom C6",         mts_sup_unknown},
-        { "Phantom 336CX",      mts_sup_unknown},
-        { "ScanMaker V6USL",    mts_sup_unknown},
-        { "ScanMaker V6USL",    mts_sup_unknown},
-        { "Scanmaker V6UL",     mts_sup_unknown},
-        { "Scanmaker V6UPL",    mts_sup_alpha},
-};
-
 /* The entries of microtek_table must correspond, line-by-line to
    the entries of mts_supported_products[]. */
 
@@ -711,7 +684,6 @@ static int mts_usb_probe(struct usb_interface *intf,
         int err_retval = -ENOMEM;
 
         struct mts_desc * new_desc;
-        struct vendor_product const* p;
         struct usb_device *dev = interface_to_usbdev (intf);
 
         /* the current altsetting on the interface we're probing */
@@ -726,15 +698,6 @@ static int mts_usb_probe(struct usb_interface *intf,
 
         MTS_DEBUG_GOT_HERE();
 
-        p = &mts_supported_products[id - mts_usb_ids];
-
-        MTS_DEBUG_GOT_HERE();
-
-        MTS_DEBUG( "found model %s\n", p->name );
-        if ( p->support_status != mts_sup_full )
-                MTS_MESSAGE( "model %s is not known to be fully supported, reports welcome!\n",
-                             p->name );
-
         /* the current altsetting on the interface we're probing */
         altsetting = intf->cur_altsetting;
 
diff --git a/drivers/usb/misc/idmouse.c b/drivers/usb/misc/idmouse.c
index 6da8887538c7..1337a9ce80b9 100644
--- a/drivers/usb/misc/idmouse.c
+++ b/drivers/usb/misc/idmouse.c
@@ -96,6 +96,8 @@ static int idmouse_probe(struct usb_interface *interface,
                                 const struct usb_device_id *id);
 
 static void idmouse_disconnect(struct usb_interface *interface);
+static int idmouse_suspend(struct usb_interface *intf, pm_message_t message);
+static int idmouse_resume(struct usb_interface *intf);
 
 /* file operation pointers */
 static const struct file_operations idmouse_fops = {
@@ -117,7 +119,11 @@ static struct usb_driver idmouse_driver = {
         .name = DRIVER_SHORT,
         .probe = idmouse_probe,
         .disconnect = idmouse_disconnect,
+        .suspend = idmouse_suspend,
+        .resume = idmouse_resume,
+        .reset_resume = idmouse_resume,
         .id_table = idmouse_table,
+        .supports_autosuspend = 1,
 };
 
 static int idmouse_create_image(struct usb_idmouse *dev)
@@ -197,6 +203,17 @@ reset:
         return result;
 }
 
+/* PM operations are nops as this driver does IO only during open() */
+static int idmouse_suspend(struct usb_interface *intf, pm_message_t message)
+{
+        return 0;
+}
+
+static int idmouse_resume(struct usb_interface *intf)
+{
+        return 0;
+}
+
 static inline void idmouse_delete(struct usb_idmouse *dev)
 {
         kfree(dev->bulk_in_buffer);
@@ -235,9 +252,13 @@ static int idmouse_open(struct inode *inode, struct file *file)
         } else {
 
                 /* create a new image and check for success */
+                result = usb_autopm_get_interface(interface);
+                if (result)
+                        goto error;
                 result = idmouse_create_image (dev);
                 if (result)
                         goto error;
+                usb_autopm_put_interface(interface);
 
                 /* increment our usage count for the driver */
                 ++dev->open;
diff --git a/drivers/usb/misc/iowarrior.c b/drivers/usb/misc/iowarrior.c
index 90e1a8dedfa9..e75bb87ee92b 100644
--- a/drivers/usb/misc/iowarrior.c
+++ b/drivers/usb/misc/iowarrior.c
@@ -727,7 +727,7 @@ static const struct file_operations iowarrior_fops = {
         .poll = iowarrior_poll,
 };
 
-static char *iowarrior_nodename(struct device *dev)
+static char *iowarrior_devnode(struct device *dev, mode_t *mode)
 {
         return kasprintf(GFP_KERNEL, "usb/%s", dev_name(dev));
 }
@@ -738,7 +738,7 @@ static char *iowarrior_nodename(struct device *dev)
  */
 static struct usb_class_driver iowarrior_class = {
         .name = "iowarrior%d",
-        .nodename = iowarrior_nodename,
+        .devnode = iowarrior_devnode,
         .fops = &iowarrior_fops,
         .minor_base = IOWARRIOR_MINOR_BASE,
 };
diff --git a/drivers/usb/misc/ldusb.c b/drivers/usb/misc/ldusb.c
index ad4fb15b5dcb..90f130126c10 100644
--- a/drivers/usb/misc/ldusb.c
+++ b/drivers/usb/misc/ldusb.c
@@ -412,6 +412,9 @@ static unsigned int ld_usb_poll(struct file *file, poll_table *wait)
 
         dev = file->private_data;
 
+        if (!dev->intf)
+                return POLLERR | POLLHUP;
+
         poll_wait(file, &dev->read_wait, wait);
         poll_wait(file, &dev->write_wait, wait);
 
@@ -767,6 +770,9 @@ static void ld_usb_disconnect(struct usb_interface *intf)
                 ld_usb_delete(dev);
         } else {
                 dev->intf = NULL;
+                /* wake up pollers */
+                wake_up_interruptible_all(&dev->read_wait);
+                wake_up_interruptible_all(&dev->write_wait);
                 mutex_unlock(&dev->mutex);
         }
 
diff --git a/drivers/usb/misc/legousbtower.c b/drivers/usb/misc/legousbtower.c
index c1e2433f640d..faa6d623de78 100644
--- a/drivers/usb/misc/legousbtower.c
+++ b/drivers/usb/misc/legousbtower.c
@@ -266,7 +266,7 @@ static const struct file_operations tower_fops = {
         .llseek =       tower_llseek,
 };
 
-static char *legousbtower_nodename(struct device *dev)
+static char *legousbtower_devnode(struct device *dev, mode_t *mode)
 {
         return kasprintf(GFP_KERNEL, "usb/%s", dev_name(dev));
 }
@@ -277,7 +277,7 @@ static char *legousbtower_nodename(struct device *dev)
  */
 static struct usb_class_driver tower_class = {
         .name =         "legousbtower%d",
-        .nodename =     legousbtower_nodename,
+        .devnode =      legousbtower_devnode,
         .fops =         &tower_fops,
         .minor_base =   LEGO_USB_TOWER_MINOR_BASE,
 };
@@ -552,6 +552,9 @@ static unsigned int tower_poll (struct file *file, poll_table *wait)
 
         dev = file->private_data;
 
+        if (!dev->udev)
+                return POLLERR | POLLHUP;
+
         poll_wait(file, &dev->read_wait, wait);
         poll_wait(file, &dev->write_wait, wait);
 
@@ -1025,6 +1028,9 @@ static void tower_disconnect (struct usb_interface *interface)
                 tower_delete (dev);
         } else {
                 dev->udev = NULL;
+                /* wake up pollers */
+                wake_up_interruptible_all(&dev->read_wait);
+                wake_up_interruptible_all(&dev->write_wait);
                 mutex_unlock(&dev->lock);
         }
 
diff --git a/drivers/usb/misc/sisusbvga/sisusb.c b/drivers/usb/misc/sisusbvga/sisusb.c
index b4ec716de7da..0025847743f3 100644
--- a/drivers/usb/misc/sisusbvga/sisusb.c
+++ b/drivers/usb/misc/sisusbvga/sisusb.c
@@ -79,14 +79,12 @@ sisusb_free_buffers(struct sisusb_usb_data *sisusb)
 
         for (i = 0; i < NUMOBUFS; i++) {
                 if (sisusb->obuf[i]) {
-                        usb_buffer_free(sisusb->sisusb_dev, sisusb->obufsize,
-                                sisusb->obuf[i], sisusb->transfer_dma_out[i]);
+                        kfree(sisusb->obuf[i]);
                         sisusb->obuf[i] = NULL;
                 }
         }
         if (sisusb->ibuf) {
-                usb_buffer_free(sisusb->sisusb_dev, sisusb->ibufsize,
-                        sisusb->ibuf, sisusb->transfer_dma_in);
+                kfree(sisusb->ibuf);
                 sisusb->ibuf = NULL;
         }
 }
@@ -230,8 +228,7 @@ sisusb_bulk_completeout(struct urb *urb)
 
 static int
 sisusb_bulkout_msg(struct sisusb_usb_data *sisusb, int index, unsigned int pipe, void *data,
-                int len, int *actual_length, int timeout, unsigned int tflags,
-                dma_addr_t transfer_dma)
+                int len, int *actual_length, int timeout, unsigned int tflags)
 {
         struct urb *urb = sisusb->sisurbout[index];
         int retval, byteswritten = 0;
@@ -245,9 +242,6 @@ sisusb_bulkout_msg(struct sisusb_usb_data *sisusb, int index, unsigned int pipe,
         urb->transfer_flags |= tflags;
         urb->actual_length = 0;
 
-        if ((urb->transfer_dma = transfer_dma))
-                urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
-
         /* Set up context */
         sisusb->urbout_context[index].actual_length = (timeout) ?
                                                 NULL : actual_length;
@@ -297,8 +291,8 @@ sisusb_bulk_completein(struct urb *urb)
 }
 
 static int
-sisusb_bulkin_msg(struct sisusb_usb_data *sisusb, unsigned int pipe, void *data, int len,
-                int *actual_length, int timeout, unsigned int tflags, dma_addr_t transfer_dma)
+sisusb_bulkin_msg(struct sisusb_usb_data *sisusb, unsigned int pipe, void *data,
+        int len, int *actual_length, int timeout, unsigned int tflags)
 {
         struct urb *urb = sisusb->sisurbin;
         int retval, readbytes = 0;
@@ -311,9 +305,6 @@ sisusb_bulkin_msg(struct sisusb_usb_data *sisusb, unsigned int pipe, void *data,
         urb->transfer_flags |= tflags;
         urb->actual_length = 0;
 
-        if ((urb->transfer_dma = transfer_dma))
-                urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
-
         sisusb->completein = 0;
         retval = usb_submit_urb(urb, GFP_ATOMIC);
         if (retval == 0) {
@@ -422,8 +413,7 @@ static int sisusb_send_bulk_msg(struct sisusb_usb_data *sisusb, int ep, int len,
                                                 thispass,
                                                 &transferred_len,
                                                 async ? 0 : 5 * HZ,
-                                                tflags,
-                                                sisusb->transfer_dma_out[index]);
+                                                tflags);
 
                         if (result == -ETIMEDOUT) {
 
@@ -432,29 +422,16 @@ static int sisusb_send_bulk_msg(struct sisusb_usb_data *sisusb, int ep, int len,
                                         return -ETIME;
 
                                 continue;
+                        }
 
-                        } else if ((result == 0) && !async && transferred_len) {
+                        if ((result == 0) && !async && transferred_len) {
 
                                 thispass -= transferred_len;
-                                if (thispass) {
-                                        if (sisusb->transfer_dma_out) {
-                                                /* If DMA, copy remaining
-                                                 * to beginning of buffer
-                                                 */
-                                                memcpy(buffer,
-                                                       buffer + transferred_len,
-                                                       thispass);
-                                        } else {
-                                                /* If not DMA, simply increase
-                                                 * the pointer
-                                                 */
-                                                buffer += transferred_len;
-                                        }
-                                }
+                                buffer += transferred_len;
 
                         } else
                                 break;
-                };
+                }
 
                 if (result)
                         return result;
@@ -530,8 +507,7 @@ static int sisusb_recv_bulk_msg(struct sisusb_usb_data *sisusb, int ep, int len,
                                            thispass,
                                            &transferred_len,
                                            5 * HZ,
-                                           tflags,
-                                           sisusb->transfer_dma_in);
+                                           tflags);
 
                 if (transferred_len)
                         thispass = transferred_len;
@@ -3132,8 +3108,7 @@ static int sisusb_probe(struct usb_interface *intf,
 
         /* Allocate buffers */
         sisusb->ibufsize = SISUSB_IBUF_SIZE;
-        if (!(sisusb->ibuf = usb_buffer_alloc(dev, SISUSB_IBUF_SIZE,
-                                        GFP_KERNEL, &sisusb->transfer_dma_in))) {
+        if (!(sisusb->ibuf = kmalloc(SISUSB_IBUF_SIZE, GFP_KERNEL))) {
                 dev_err(&sisusb->sisusb_dev->dev, "Failed to allocate memory for input buffer");
                 retval = -ENOMEM;
                 goto error_2;
@@ -3142,9 +3117,7 @@ static int sisusb_probe(struct usb_interface *intf,
         sisusb->numobufs = 0;
         sisusb->obufsize = SISUSB_OBUF_SIZE;
         for (i = 0; i < NUMOBUFS; i++) {
-                if (!(sisusb->obuf[i] = usb_buffer_alloc(dev, SISUSB_OBUF_SIZE,
-                                        GFP_KERNEL,
-                                        &sisusb->transfer_dma_out[i]))) {
+                if (!(sisusb->obuf[i] = kmalloc(SISUSB_OBUF_SIZE, GFP_KERNEL))) {
                         if (i == 0) {
                                 dev_err(&sisusb->sisusb_dev->dev, "Failed to allocate memory for output buffer\n");
                                 retval = -ENOMEM;
diff --git a/drivers/usb/misc/sisusbvga/sisusb.h b/drivers/usb/misc/sisusbvga/sisusb.h
index cf0b4a5883f6..55492a5930bd 100644
--- a/drivers/usb/misc/sisusbvga/sisusb.h
+++ b/drivers/usb/misc/sisusbvga/sisusb.h
@@ -123,8 +123,6 @@ struct sisusb_usb_data {
         int numobufs;           /* number of obufs = number of out urbs */
         char *obuf[NUMOBUFS], *ibuf;    /* transfer buffers */
         int obufsize, ibufsize;
-        dma_addr_t transfer_dma_out[NUMOBUFS];
-        dma_addr_t transfer_dma_in;
         struct urb *sisurbout[NUMOBUFS];
         struct urb *sisurbin;
         unsigned char urbstatus[NUMOBUFS];
diff --git a/drivers/usb/misc/usbsevseg.c b/drivers/usb/misc/usbsevseg.c
index 28a6a3a09538..3db255537e79 100644
--- a/drivers/usb/misc/usbsevseg.c
+++ b/drivers/usb/misc/usbsevseg.c
@@ -38,6 +38,7 @@ static char *display_textmodes[] = {"raw", "hex", "ascii", NULL};
 
 struct usb_sevsegdev {
         struct usb_device *udev;
+        struct usb_interface *intf;
 
         u8 powered;
         u8 mode_msb;
@@ -46,6 +47,8 @@ struct usb_sevsegdev {
         u8 textmode;
         u8 text[MAXLEN];
         u16 textlength;
+
+        u8 shadow_power; /* for PM */
 };
 
 /* sysfs_streq can't replace this completely
@@ -65,6 +68,12 @@ static void update_display_powered(struct usb_sevsegdev *mydev)
 {
         int rc;
 
+        if (!mydev->shadow_power && mydev->powered) {
+                rc = usb_autopm_get_interface(mydev->intf);
+                if (rc < 0)
+                        return;
+        }
+
         rc = usb_control_msg(mydev->udev,
                         usb_sndctrlpipe(mydev->udev, 0),
                         0x12,
@@ -76,12 +85,18 @@ static void update_display_powered(struct usb_sevsegdev *mydev)
                         2000);
         if (rc < 0)
                 dev_dbg(&mydev->udev->dev, "power retval = %d\n", rc);
+
+        if (mydev->shadow_power && !mydev->powered)
+                usb_autopm_put_interface(mydev->intf);
 }
 
 static void update_display_mode(struct usb_sevsegdev *mydev)
 {
         int rc;
 
+        if(mydev->shadow_power != 1)
+                return;
+
         rc = usb_control_msg(mydev->udev,
                         usb_sndctrlpipe(mydev->udev, 0),
                         0x12,
@@ -96,14 +111,17 @@ static void update_display_mode(struct usb_sevsegdev *mydev)
                 dev_dbg(&mydev->udev->dev, "mode retval = %d\n", rc);
 }
 
-static void update_display_visual(struct usb_sevsegdev *mydev)
+static void update_display_visual(struct usb_sevsegdev *mydev, gfp_t mf)
 {
         int rc;
         int i;
         unsigned char *buffer;
         u8 decimals = 0;
 
-        buffer = kzalloc(MAXLEN, GFP_KERNEL);
+        if(mydev->shadow_power != 1)
+                return;
+
+        buffer = kzalloc(MAXLEN, mf);
         if (!buffer) {
                 dev_err(&mydev->udev->dev, "out of memory\n");
                 return;
@@ -163,7 +181,7 @@ static ssize_t set_attr_##name(struct device *dev, 		\
         struct usb_sevsegdev *mydev = usb_get_intfdata(intf);   \
                                                                 \
         mydev->name = simple_strtoul(buf, NULL, 10);            \
-        update_fcn(mydev); \
+        update_fcn(mydev);                                      \
                                                                 \
         return count;                                           \
 }                                                               \
@@ -194,7 +212,7 @@ static ssize_t set_attr_text(struct device *dev,
         if (end > 0)
                 memcpy(mydev->text, buf, end);
 
-        update_display_visual(mydev);
+        update_display_visual(mydev, GFP_KERNEL);
         return count;
 }
 
@@ -242,7 +260,7 @@ static ssize_t set_attr_decimals(struct device *dev,
                 if (buf[i] == '1')
                         mydev->decimals[end-1-i] = 1;
 
-        update_display_visual(mydev);
+        update_display_visual(mydev, GFP_KERNEL);
 
         return count;
 }
@@ -286,7 +304,7 @@ static ssize_t set_attr_textmode(struct device *dev,
         for (i = 0; display_textmodes[i]; i++) {
                 if (sysfs_streq(display_textmodes[i], buf)) {
                         mydev->textmode = i;
-                        update_display_visual(mydev);
+                        update_display_visual(mydev, GFP_KERNEL);
                         return count;
                 }
         }
@@ -330,6 +348,7 @@ static int sevseg_probe(struct usb_interface *interface,
         }
 
         mydev->udev = usb_get_dev(udev);
+        mydev->intf = interface;
         usb_set_intfdata(interface, mydev);
 
         /*set defaults */
@@ -364,11 +383,49 @@ static void sevseg_disconnect(struct usb_interface *interface)
         dev_info(&interface->dev, "USB 7 Segment now disconnected\n");
 }
 
+static int sevseg_suspend(struct usb_interface *intf, pm_message_t message)
+{
+        struct usb_sevsegdev *mydev;
+
+        mydev = usb_get_intfdata(intf);
+        mydev->shadow_power = 0;
+
+        return 0;
+}
+
+static int sevseg_resume(struct usb_interface *intf)
+{
+        struct usb_sevsegdev *mydev;
+
+        mydev = usb_get_intfdata(intf);
+        mydev->shadow_power = 1;
+        update_display_mode(mydev);
+        update_display_visual(mydev, GFP_NOIO);
+
+        return 0;
+}
+
+static int sevseg_reset_resume(struct usb_interface *intf)
+{
+        struct usb_sevsegdev *mydev;
+
+        mydev = usb_get_intfdata(intf);
+        mydev->shadow_power = 1;
+        update_display_mode(mydev);
+        update_display_visual(mydev, GFP_NOIO);
+
+        return 0;
+}
+
 static struct usb_driver sevseg_driver = {
         .name =         "usbsevseg",
         .probe =        sevseg_probe,
         .disconnect =   sevseg_disconnect,
+        .suspend =      sevseg_suspend,
+        .resume =       sevseg_resume,
+        .reset_resume = sevseg_reset_resume,
         .id_table =     id_table,
+        .supports_autosuspend = 1,
 };
 
 static int __init usb_sevseg_init(void)
diff --git a/drivers/usb/mon/Kconfig b/drivers/usb/mon/Kconfig
index f28f350cd96a..635745f57fbd 100644
--- a/drivers/usb/mon/Kconfig
+++ b/drivers/usb/mon/Kconfig
@@ -5,11 +5,9 @@
 config USB_MON
         tristate "USB Monitor"
         depends on USB
-        default y if USB=y
-        default m if USB=m
         help
           If you select this option, a component which captures the USB traffic
           between peripheral-specific drivers and HC drivers will be built.
           For more information, see <file:Documentation/usb/usbmon.txt>.
 
-          If unsure, say Y (if allowed), otherwise M.
+          If unsure, say Y, if allowed, otherwise M.
diff --git a/drivers/usb/mon/Makefile b/drivers/usb/mon/Makefile
index c6516b566731..384b198faa7c 100644
--- a/drivers/usb/mon/Makefile
+++ b/drivers/usb/mon/Makefile
@@ -2,6 +2,6 @@
 # Makefile for USB monitor
 #
 
-usbmon-objs     := mon_main.o mon_stat.o mon_text.o mon_bin.o mon_dma.o
+usbmon-objs     := mon_main.o mon_stat.o mon_text.o mon_bin.o
 
 obj-$(CONFIG_USB_MON)   += usbmon.o
diff --git a/drivers/usb/mon/mon_bin.c b/drivers/usb/mon/mon_bin.c
index 0f7a30b7d2d1..dfdc43e2e00d 100644
--- a/drivers/usb/mon/mon_bin.c
+++ b/drivers/usb/mon/mon_bin.c
@@ -220,9 +220,8 @@ static void mon_free_buff(struct mon_pgmap *map, int npages);
 
 /*
  * This is a "chunked memcpy". It does not manipulate any counters.
- * But it returns the new offset for repeated application.
  */
-unsigned int mon_copy_to_buff(const struct mon_reader_bin *this,
+static void mon_copy_to_buff(const struct mon_reader_bin *this,
     unsigned int off, const unsigned char *from, unsigned int length)
 {
         unsigned int step_len;
@@ -247,7 +246,6 @@ unsigned int mon_copy_to_buff(const struct mon_reader_bin *this,
                 from += step_len;
                 length -= step_len;
         }
-        return off;
 }
 
 /*
@@ -400,15 +398,8 @@ static char mon_bin_get_data(const struct mon_reader_bin *rp,
     unsigned int offset, struct urb *urb, unsigned int length)
 {
 
-        if (urb->dev->bus->uses_dma &&
-            (urb->transfer_flags & URB_NO_TRANSFER_DMA_MAP)) {
-                mon_dmapeek_vec(rp, offset, urb->transfer_dma, length);
-                return 0;
-        }
-
         if (urb->transfer_buffer == NULL)
                 return 'Z';
-
         mon_copy_to_buff(rp, offset, urb->transfer_buffer, length);
         return 0;
 }
@@ -635,7 +626,6 @@ static int mon_bin_open(struct inode *inode, struct file *file)
         spin_lock_init(&rp->b_lock);
         init_waitqueue_head(&rp->b_wait);
         mutex_init(&rp->fetch_lock);
-
         rp->b_size = BUFF_DFL;
 
         size = sizeof(struct mon_pgmap) * (rp->b_size/CHUNK_SIZE);
diff --git a/drivers/usb/mon/mon_dma.c b/drivers/usb/mon/mon_dma.c
deleted file mode 100644
index 140cc80bd2b1..000000000000
--- a/drivers/usb/mon/mon_dma.c
+++ /dev/null
@@ -1,95 +0,0 @@
-/*
- * The USB Monitor, inspired by Dave Harding's USBMon.
- *
- * mon_dma.c: Library which snoops on DMA areas.
- *
- * Copyright (C) 2005 Pete Zaitcev (zaitcev@redhat.com)
- */
-#include <linux/kernel.h>
-#include <linux/list.h>
-#include <linux/highmem.h>
-#include <asm/page.h>
-
-#include <linux/usb.h>  /* Only needed for declarations in usb_mon.h */
-#include "usb_mon.h"
-
-/*
- * PC-compatibles, are, fortunately, sufficiently cache-coherent for this.
- */
-#if defined(__i386__) || defined(__x86_64__) /* CONFIG_ARCH_I386 doesn't exit */
-#define MON_HAS_UNMAP 1
-
-#define phys_to_page(phys)      pfn_to_page((phys) >> PAGE_SHIFT)
-
-char mon_dmapeek(unsigned char *dst, dma_addr_t dma_addr, int len)
-{
-        struct page *pg;
-        unsigned long flags;
-        unsigned char *map;
-        unsigned char *ptr;
-
-        /*
-         * On i386, a DMA handle is the "physical" address of a page.
-         * In other words, the bus address is equal to physical address.
-         * There is no IOMMU.
-         */
-        pg = phys_to_page(dma_addr);
-
-        /*
-         * We are called from hardware IRQs in case of callbacks.
-         * But we can be called from softirq or process context in case
-         * of submissions. In such case, we need to protect KM_IRQ0.
-         */
-        local_irq_save(flags);
-        map = kmap_atomic(pg, KM_IRQ0);
-        ptr = map + (dma_addr & (PAGE_SIZE-1));
-        memcpy(dst, ptr, len);
-        kunmap_atomic(map, KM_IRQ0);
-        local_irq_restore(flags);
-        return 0;
-}
-
-void mon_dmapeek_vec(const struct mon_reader_bin *rp,
-    unsigned int offset, dma_addr_t dma_addr, unsigned int length)
-{
-        unsigned long flags;
-        unsigned int step_len;
-        struct page *pg;
-        unsigned char *map;
-        unsigned long page_off, page_len;
-
-        local_irq_save(flags);
-        while (length) {
-                /* compute number of bytes we are going to copy in this page */
-                step_len = length;
-                page_off = dma_addr & (PAGE_SIZE-1);
-                page_len = PAGE_SIZE - page_off;
-                if (page_len < step_len)
-                        step_len = page_len;
-
-                /* copy data and advance pointers */
-                pg = phys_to_page(dma_addr);
-                map = kmap_atomic(pg, KM_IRQ0);
-                offset = mon_copy_to_buff(rp, offset, map + page_off, step_len);
-                kunmap_atomic(map, KM_IRQ0);
-                dma_addr += step_len;
-                length -= step_len;
-        }
-        local_irq_restore(flags);
-}
-
-#endif /* __i386__ */
-
-#ifndef MON_HAS_UNMAP
-char mon_dmapeek(unsigned char *dst, dma_addr_t dma_addr, int len)
-{
-        return 'D';
-}
-
-void mon_dmapeek_vec(const struct mon_reader_bin *rp,
-    unsigned int offset, dma_addr_t dma_addr, unsigned int length)
-{
-        ;
-}
-
-#endif /* MON_HAS_UNMAP */
diff --git a/drivers/usb/mon/mon_main.c b/drivers/usb/mon/mon_main.c
index 5e0ab4201c00..e0c2db3b767b 100644
--- a/drivers/usb/mon/mon_main.c
+++ b/drivers/usb/mon/mon_main.c
@@ -361,7 +361,6 @@ static int __init mon_init(void)
         }
         // MOD_INC_USE_COUNT(which_module?);
 
-
         mutex_lock(&usb_bus_list_lock);
         list_for_each_entry (ubus, &usb_bus_list, bus_list) {
                 mon_bus_init(ubus);
diff --git a/drivers/usb/mon/mon_text.c b/drivers/usb/mon/mon_text.c
index a7eb4c99342c..9f1a9227ebe6 100644
--- a/drivers/usb/mon/mon_text.c
+++ b/drivers/usb/mon/mon_text.c
@@ -150,20 +150,6 @@ static inline char mon_text_get_data(struct mon_event_text *ep, struct urb *urb,
                         return '>';
         }
 
-        /*
-         * The check to see if it's safe to poke at data has an enormous
-         * number of corner cases, but it seems that the following is
-         * more or less safe.
-         *
-         * We do not even try to look at transfer_buffer, because it can
-         * contain non-NULL garbage in case the upper level promised to
-         * set DMA for the HCD.
-         */
-        if (urb->dev->bus->uses_dma &&
-            (urb->transfer_flags & URB_NO_TRANSFER_DMA_MAP)) {
-                return mon_dmapeek(ep->data, urb->transfer_dma, len);
-        }
-
         if (urb->transfer_buffer == NULL)
                 return 'Z';     /* '0' would be not as pretty. */
 
diff --git a/drivers/usb/mon/usb_mon.h b/drivers/usb/mon/usb_mon.h
index f5d84ff8c101..df9a4df342c7 100644
--- a/drivers/usb/mon/usb_mon.h
+++ b/drivers/usb/mon/usb_mon.h
@@ -65,20 +65,6 @@ int __init mon_bin_init(void);
 void mon_bin_exit(void);
 
 /*
- * DMA interface.
- *
- * XXX The vectored side needs a serious re-thinking. Abstracting vectors,
- * like in Paolo's original patch, produces a double pkmap. We need an idea.
-*/
-extern char mon_dmapeek(unsigned char *dst, dma_addr_t dma_addr, int len);
-
-struct mon_reader_bin;
-extern void mon_dmapeek_vec(const struct mon_reader_bin *rp,
-    unsigned int offset, dma_addr_t dma_addr, unsigned int len);
-extern unsigned int mon_copy_to_buff(const struct mon_reader_bin *rp,
-    unsigned int offset, const unsigned char *from, unsigned int len);
-
-/*
  */
 extern struct mutex mon_lock;
 
diff --git a/drivers/usb/musb/musb_core.c b/drivers/usb/musb/musb_core.c
index 1d26beddf2ca..3a61ddb62bd2 100644
--- a/drivers/usb/musb/musb_core.c
+++ b/drivers/usb/musb/musb_core.c
@@ -1850,6 +1850,10 @@ static void musb_free(struct musb *musb)
                 dma_controller_destroy(c);
         }
 
+#ifdef CONFIG_USB_MUSB_OTG
+        put_device(musb->xceiv->dev);
+#endif
+
         musb_writeb(musb->mregs, MUSB_DEVCTL, 0);
         musb_platform_exit(musb);
         musb_writeb(musb->mregs, MUSB_DEVCTL, 0);
@@ -1859,10 +1863,6 @@ static void musb_free(struct musb *musb)
                 clk_put(musb->clock);
         }
 
-#ifdef CONFIG_USB_MUSB_OTG
-        put_device(musb->xceiv->dev);
-#endif
-
 #ifdef CONFIG_USB_MUSB_HDRC_HCD
         usb_put_hcd(musb_to_hcd(musb));
 #else
diff --git a/drivers/usb/otg/isp1301_omap.c b/drivers/usb/otg/isp1301_omap.c
index e0d56ef2bcb0..77a5f4188999 100644
--- a/drivers/usb/otg/isp1301_omap.c
+++ b/drivers/usb/otg/isp1301_omap.c
@@ -117,24 +117,7 @@ static void enable_vbus_draw(struct isp1301 *isp, unsigned mA)
                 pr_debug("  VBUS %d mA error %d\n", mA, status);
 }
 
-static void enable_vbus_source(struct isp1301 *isp)
-{
-        /* this board won't supply more than 8mA vbus power.
-         * some boards can switch a 100ma "unit load" (or more).
-         */
-}
-
-
-/* products will deliver OTG messages with LEDs, GUI, etc */
-static inline void notresponding(struct isp1301 *isp)
-{
-        printk(KERN_NOTICE "OTG device not responding.\n");
-}
-
-
-#endif
-
-#if defined(CONFIG_MACH_OMAP_H4)
+#else
 
 static void enable_vbus_draw(struct isp1301 *isp, unsigned mA)
 {
@@ -144,6 +127,8 @@ static void enable_vbus_draw(struct isp1301 *isp, unsigned mA)
          */
 }
 
+#endif
+
 static void enable_vbus_source(struct isp1301 *isp)
 {
         /* this board won't supply more than 8mA vbus power.
@@ -159,8 +144,6 @@ static inline void notresponding(struct isp1301 *isp)
 }
 
 
-#endif
-
 /*-------------------------------------------------------------------------*/
 
 static struct i2c_driver isp1301_driver;
diff --git a/drivers/usb/serial/ark3116.c b/drivers/usb/serial/ark3116.c
index aec61880f36c..131e61adaaf7 100644
--- a/drivers/usb/serial/ark3116.c
+++ b/drivers/usb/serial/ark3116.c
@@ -31,14 +31,19 @@ static int debug;
 
 static struct usb_device_id id_table [] = {
         { USB_DEVICE(0x6547, 0x0232) },
+        { USB_DEVICE(0x18ec, 0x3118) },         /* USB to IrDA adapter */
         { },
 };
 MODULE_DEVICE_TABLE(usb, id_table);
 
-struct ark3116_private {
-        spinlock_t lock;
-        u8 termios_initialized;
-};
+static int is_irda(struct usb_serial *serial)
+{
+        struct usb_device *dev = serial->dev;
+        if (le16_to_cpu(dev->descriptor.idVendor) == 0x18ec &&
+                        le16_to_cpu(dev->descriptor.idProduct) == 0x3118)
+                return 1;
+        return 0;
+}
 
 static inline void ARK3116_SND(struct usb_serial *serial, int seq,
                                __u8 request, __u8 requesttype,
@@ -82,29 +87,28 @@ static inline void ARK3116_RCV_QUIET(struct usb_serial *serial,
 static int ark3116_attach(struct usb_serial *serial)
 {
         char *buf;
-        struct ark3116_private *priv;
-        int i;
-
-        for (i = 0; i < serial->num_ports; ++i) {
-                priv = kzalloc(sizeof(struct ark3116_private), GFP_KERNEL);
-                if (!priv)
-                        goto cleanup;
-                spin_lock_init(&priv->lock);
-
-                usb_set_serial_port_data(serial->port[i], priv);
-        }
 
         buf = kmalloc(1, GFP_KERNEL);
         if (!buf) {
                 dbg("error kmalloc -> out of mem?");
-                goto cleanup;
+                return -ENOMEM;
         }
 
+        if (is_irda(serial))
+                dbg("IrDA mode");
+
         /* 3 */
         ARK3116_SND(serial, 3, 0xFE, 0x40, 0x0008, 0x0002);
         ARK3116_SND(serial, 4, 0xFE, 0x40, 0x0008, 0x0001);
         ARK3116_SND(serial, 5, 0xFE, 0x40, 0x0000, 0x0008);
-        ARK3116_SND(serial, 6, 0xFE, 0x40, 0x0000, 0x000B);
+        ARK3116_SND(serial, 6, 0xFE, 0x40, is_irda(serial) ? 0x0001 : 0x0000,
+                    0x000B);
+
+        if (is_irda(serial)) {
+                ARK3116_SND(serial, 1001, 0xFE, 0x40, 0x0000, 0x000C);
+                ARK3116_SND(serial, 1002, 0xFE, 0x40, 0x0041, 0x000D);
+                ARK3116_SND(serial, 1003, 0xFE, 0x40, 0x0001, 0x000A);
+        }
 
         /* <-- seq7 */
         ARK3116_RCV(serial,  7, 0xFE, 0xC0, 0x0000, 0x0003, 0x00, buf);
@@ -141,6 +145,8 @@ static int ark3116_attach(struct usb_serial *serial)
         ARK3116_SND(serial, 147, 0xFE, 0x40, 0x0083, 0x0003);
         ARK3116_SND(serial, 148, 0xFE, 0x40, 0x0038, 0x0000);
         ARK3116_SND(serial, 149, 0xFE, 0x40, 0x0001, 0x0001);
+        if (is_irda(serial))
+                ARK3116_SND(serial, 1004, 0xFE, 0x40, 0x0000, 0x0009);
         ARK3116_SND(serial, 150, 0xFE, 0x40, 0x0003, 0x0003);
         ARK3116_RCV(serial, 151, 0xFE, 0xC0, 0x0000, 0x0004, 0x03, buf);
         ARK3116_SND(serial, 152, 0xFE, 0x40, 0x0000, 0x0003);
@@ -149,13 +155,16 @@ static int ark3116_attach(struct usb_serial *serial)
 
         kfree(buf);
         return 0;
+}
 
-cleanup:
-        for (--i; i >= 0; --i) {
-                kfree(usb_get_serial_port_data(serial->port[i]));
-                usb_set_serial_port_data(serial->port[i], NULL);
-        }
-        return -ENOMEM;
+static void ark3116_init_termios(struct tty_struct *tty)
+{
+        struct ktermios *termios = tty->termios;
+        *termios = tty_std_termios;
+        termios->c_cflag = B9600 | CS8
+                                      | CREAD | HUPCL | CLOCAL;
+        termios->c_ispeed = 9600;
+        termios->c_ospeed = 9600;
 }
 
 static void ark3116_set_termios(struct tty_struct *tty,
@@ -163,10 +172,8 @@ static void ark3116_set_termios(struct tty_struct *tty,
                                 struct ktermios *old_termios)
 {
         struct usb_serial *serial = port->serial;
-        struct ark3116_private *priv = usb_get_serial_port_data(port);
         struct ktermios *termios = tty->termios;
         unsigned int cflag = termios->c_cflag;
-        unsigned long flags;
         int baud;
         int ark3116_baud;
         char *buf;
@@ -176,16 +183,6 @@ static void ark3116_set_termios(struct tty_struct *tty,
 
         dbg("%s - port %d", __func__, port->number);
 
-        spin_lock_irqsave(&priv->lock, flags);
-        if (!priv->termios_initialized) {
-                *termios = tty_std_termios;
-                termios->c_cflag = B9600 | CS8
-                                              | CREAD | HUPCL | CLOCAL;
-                termios->c_ispeed = 9600;
-                termios->c_ospeed = 9600;
-                priv->termios_initialized = 1;
-        }
-        spin_unlock_irqrestore(&priv->lock, flags);
 
         cflag = termios->c_cflag;
         termios->c_cflag &= ~(CMSPAR|CRTSCTS);
@@ -318,8 +315,7 @@ static void ark3116_set_termios(struct tty_struct *tty,
         return;
 }
 
-static int ark3116_open(struct tty_struct *tty, struct usb_serial_port *port,
-                                        struct file *filp)
+static int ark3116_open(struct tty_struct *tty, struct usb_serial_port *port)
 {
         struct ktermios tmp_termios;
         struct usb_serial *serial = port->serial;
@@ -334,7 +330,7 @@ static int ark3116_open(struct tty_struct *tty, struct usb_serial_port *port,
                 return -ENOMEM;
         }
 
-        result = usb_serial_generic_open(tty, port, filp);
+        result = usb_serial_generic_open(tty, port);
         if (result)
                 goto err_out;
 
@@ -455,6 +451,7 @@ static struct usb_serial_driver ark3116_device = {
         .num_ports =            1,
         .attach =               ark3116_attach,
         .set_termios =          ark3116_set_termios,
+        .init_termios =         ark3116_init_termios,
         .ioctl =                ark3116_ioctl,
         .tiocmget =             ark3116_tiocmget,
         .open =                 ark3116_open,
diff --git a/drivers/usb/serial/belkin_sa.c b/drivers/usb/serial/belkin_sa.c
index 7033b031b443..a0467bc61627 100644
--- a/drivers/usb/serial/belkin_sa.c
+++ b/drivers/usb/serial/belkin_sa.c
@@ -92,7 +92,7 @@ static int debug;
 static int  belkin_sa_startup(struct usb_serial *serial);
 static void belkin_sa_release(struct usb_serial *serial);
 static int  belkin_sa_open(struct tty_struct *tty,
-                        struct usb_serial_port *port, struct file *filp);
+                        struct usb_serial_port *port);
 static void belkin_sa_close(struct usb_serial_port *port);
 static void belkin_sa_read_int_callback(struct urb *urb);
 static void belkin_sa_set_termios(struct tty_struct *tty,
@@ -213,7 +213,7 @@ static void belkin_sa_release(struct usb_serial *serial)
 
 
 static int  belkin_sa_open(struct tty_struct *tty,
-                        struct usb_serial_port *port, struct file *filp)
+                                        struct usb_serial_port *port)
 {
         int retval = 0;
 
diff --git a/drivers/usb/serial/ch341.c b/drivers/usb/serial/ch341.c
index 2830766f5b39..59eff721fcc5 100644
--- a/drivers/usb/serial/ch341.c
+++ b/drivers/usb/serial/ch341.c
@@ -56,6 +56,18 @@
 #define CH341_BAUDBASE_FACTOR 1532620800
 #define CH341_BAUDBASE_DIVMAX 3
 
+/* Break support - the information used to implement this was gleaned from
+ * the Net/FreeBSD uchcom.c driver by Takanori Watanabe.  Domo arigato.
+ */
+
+#define CH341_REQ_WRITE_REG    0x9A
+#define CH341_REQ_READ_REG     0x95
+#define CH341_REG_BREAK1       0x05
+#define CH341_REG_BREAK2       0x18
+#define CH341_NBREAK_BITS_REG1 0x01
+#define CH341_NBREAK_BITS_REG2 0x40
+
+
 static int debug;
 
 static struct usb_device_id id_table [] = {
@@ -300,8 +312,7 @@ static void ch341_close(struct usb_serial_port *port)
 
 
 /* open this device, set default parameters */
-static int ch341_open(struct tty_struct *tty, struct usb_serial_port *port,
-                                struct file *filp)
+static int ch341_open(struct tty_struct *tty, struct usb_serial_port *port)
 {
         struct usb_serial *serial = port->serial;
         struct ch341_private *priv = usb_get_serial_port_data(serial->port[0]);
@@ -333,7 +344,7 @@ static int ch341_open(struct tty_struct *tty, struct usb_serial_port *port,
                 return -EPROTO;
         }
 
-        r = usb_serial_generic_open(tty, port, filp);
+        r = usb_serial_generic_open(tty, port);
 
 out:    return r;
 }
@@ -374,6 +385,45 @@ static void ch341_set_termios(struct tty_struct *tty,
          */
 }
 
+static void ch341_break_ctl(struct tty_struct *tty, int break_state)
+{
+        const uint16_t ch341_break_reg =
+                CH341_REG_BREAK1 | ((uint16_t) CH341_REG_BREAK2 << 8);
+        struct usb_serial_port *port = tty->driver_data;
+        int r;
+        uint16_t reg_contents;
+        uint8_t break_reg[2];
+
+        dbg("%s()", __func__);
+
+        r = ch341_control_in(port->serial->dev, CH341_REQ_READ_REG,
+                        ch341_break_reg, 0, break_reg, sizeof(break_reg));
+        if (r < 0) {
+                printk(KERN_WARNING "%s: USB control read error whilst getting"
+                                " break register contents.\n", __FILE__);
+                return;
+        }
+        dbg("%s - initial ch341 break register contents - reg1: %x, reg2: %x",
+                        __func__, break_reg[0], break_reg[1]);
+        if (break_state != 0) {
+                dbg("%s - Enter break state requested", __func__);
+                break_reg[0] &= ~CH341_NBREAK_BITS_REG1;
+                break_reg[1] &= ~CH341_NBREAK_BITS_REG2;
+        } else {
+                dbg("%s - Leave break state requested", __func__);
+                break_reg[0] |= CH341_NBREAK_BITS_REG1;
+                break_reg[1] |= CH341_NBREAK_BITS_REG2;
+        }
+        dbg("%s - New ch341 break register contents - reg1: %x, reg2: %x",
+                        __func__, break_reg[0], break_reg[1]);
+        reg_contents = (uint16_t)break_reg[0] | ((uint16_t)break_reg[1] << 8);
+        r = ch341_control_out(port->serial->dev, CH341_REQ_WRITE_REG,
+                        ch341_break_reg, reg_contents);
+        if (r < 0)
+                printk(KERN_WARNING "%s: USB control write error whilst setting"
+                                " break register contents.\n", __FILE__);
+}
+
 static int ch341_tiocmset(struct tty_struct *tty, struct file *file,
                           unsigned int set, unsigned int clear)
 {
@@ -577,6 +627,7 @@ static struct usb_serial_driver ch341_device = {
         .close             = ch341_close,
         .ioctl             = ch341_ioctl,
         .set_termios       = ch341_set_termios,
+        .break_ctl         = ch341_break_ctl,
         .tiocmget          = ch341_tiocmget,
         .tiocmset          = ch341_tiocmset,
         .read_int_callback = ch341_read_int_callback,
diff --git a/drivers/usb/serial/console.c b/drivers/usb/serial/console.c
index 0e4f2e41ace5..b22ac3258523 100644
--- a/drivers/usb/serial/console.c
+++ b/drivers/usb/serial/console.c
@@ -16,6 +16,7 @@
 #include <linux/slab.h>
 #include <linux/tty.h>
 #include <linux/console.h>
+#include <linux/serial.h>
 #include <linux/usb.h>
 #include <linux/usb/serial.h>
 
@@ -63,7 +64,7 @@ static int usb_console_setup(struct console *co, char *options)
         char *s;
         struct usb_serial *serial;
         struct usb_serial_port *port;
-        int retval = 0;
+        int retval;
         struct tty_struct *tty = NULL;
         struct ktermios *termios = NULL, dummy;
 
@@ -116,13 +117,17 @@ static int usb_console_setup(struct console *co, char *options)
                 return -ENODEV;
         }
 
-        port = serial->port[0];
+        retval = usb_autopm_get_interface(serial->interface);
+        if (retval)
+                goto error_get_interface;
+
+        port = serial->port[co->index - serial->minor];
         tty_port_tty_set(&port->port, NULL);
 
         info->port = port;
 
         ++port->port.count;
-        if (port->port.count == 1) {
+        if (!test_bit(ASYNCB_INITIALIZED, &port->port.flags)) {
                 if (serial->type->set_termios) {
                         /*
                          * allocate a fake tty so the driver can initialize
@@ -150,9 +155,9 @@ static int usb_console_setup(struct console *co, char *options)
                 /* only call the device specific open if this
                  * is the first time the port is opened */
                 if (serial->type->open)
-                        retval = serial->type->open(NULL, port, NULL);
+                        retval = serial->type->open(NULL, port);
                 else
-                        retval = usb_serial_generic_open(NULL, port, NULL);
+                        retval = usb_serial_generic_open(NULL, port);
 
                 if (retval) {
                         err("could not open USB console port");
@@ -168,6 +173,7 @@ static int usb_console_setup(struct console *co, char *options)
                         kfree(termios);
                         kfree(tty);
                 }
+                set_bit(ASYNCB_INITIALIZED, &port->port.flags);
         }
         /* Now that any required fake tty operations are completed restore
          * the tty port count */
@@ -175,18 +181,22 @@ static int usb_console_setup(struct console *co, char *options)
         /* The console is special in terms of closing the device so
          * indicate this port is now acting as a system console. */
         port->console = 1;
-        retval = 0;
 
-out:
+        mutex_unlock(&serial->disc_mutex);
         return retval;
-free_termios:
+
+ free_termios:
         kfree(termios);
         tty_port_tty_set(&port->port, NULL);
-free_tty:
+ free_tty:
         kfree(tty);
-reset_open_count:
+ reset_open_count:
         port->port.count = 0;
-        goto out;
+        usb_autopm_put_interface(serial->interface);
+ error_get_interface:
+        usb_serial_put(serial);
+        mutex_unlock(&serial->disc_mutex);
+        return retval;
 }
 
 static void usb_console_write(struct console *co,
diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
index 985cbcf48bda..4a208fe85bc9 100644
--- a/drivers/usb/serial/cp210x.c
+++ b/drivers/usb/serial/cp210x.c
@@ -33,8 +33,7 @@
 /*
  * Function Prototypes
  */
-static int cp210x_open(struct tty_struct *, struct usb_serial_port *,
-                                                        struct file *);
+static int cp210x_open(struct tty_struct *tty, struct usb_serial_port *);
 static void cp210x_cleanup(struct usb_serial_port *);
 static void cp210x_close(struct usb_serial_port *);
 static void cp210x_get_termios(struct tty_struct *,
@@ -368,8 +367,7 @@ static unsigned int cp210x_quantise_baudrate(unsigned int baud) {
         return baud;
 }
 
-static int cp210x_open(struct tty_struct *tty, struct usb_serial_port *port,
-                                struct file *filp)
+static int cp210x_open(struct tty_struct *tty, struct usb_serial_port *port)
 {
         struct usb_serial *serial = port->serial;
         int result;
@@ -399,12 +397,6 @@ static int cp210x_open(struct tty_struct *tty, struct usb_serial_port *port,
 
         /* Configure the termios structure */
         cp210x_get_termios(tty, port);
-
-        /* Set the DTR and RTS pins low */
-        cp210x_tiocmset_port(tty ? (struct usb_serial_port *) tty->driver_data
-                        : port,
-                NULL, TIOCM_DTR | TIOCM_RTS, 0);
-
         return 0;
 }
 
diff --git a/drivers/usb/serial/cyberjack.c b/drivers/usb/serial/cyberjack.c
index 336523fd7366..b0f6402a91ca 100644
--- a/drivers/usb/serial/cyberjack.c
+++ b/drivers/usb/serial/cyberjack.c
@@ -61,7 +61,7 @@ static int cyberjack_startup(struct usb_serial *serial);
 static void cyberjack_disconnect(struct usb_serial *serial);
 static void cyberjack_release(struct usb_serial *serial);
 static int  cyberjack_open(struct tty_struct *tty,
-                        struct usb_serial_port *port, struct file *filp);
+        struct usb_serial_port *port);
 static void cyberjack_close(struct usb_serial_port *port);
 static int cyberjack_write(struct tty_struct *tty,
         struct usb_serial_port *port, const unsigned char *buf, int count);
@@ -173,7 +173,7 @@ static void cyberjack_release(struct usb_serial *serial)
 }
 
 static int  cyberjack_open(struct tty_struct *tty,
-                        struct usb_serial_port *port, struct file *filp)
+                                        struct usb_serial_port *port)
 {
         struct cyberjack_private *priv;
         unsigned long flags;
diff --git a/drivers/usb/serial/cypress_m8.c b/drivers/usb/serial/cypress_m8.c
index 59adfe123110..e0a8b715f2f2 100644
--- a/drivers/usb/serial/cypress_m8.c
+++ b/drivers/usb/serial/cypress_m8.c
@@ -172,8 +172,7 @@ static int  cypress_earthmate_startup(struct usb_serial *serial);
 static int  cypress_hidcom_startup(struct usb_serial *serial);
 static int  cypress_ca42v2_startup(struct usb_serial *serial);
 static void cypress_release(struct usb_serial *serial);
-static int  cypress_open(struct tty_struct *tty,
-                        struct usb_serial_port *port, struct file *filp);
+static int  cypress_open(struct tty_struct *tty, struct usb_serial_port *port);
 static void cypress_close(struct usb_serial_port *port);
 static void cypress_dtr_rts(struct usb_serial_port *port, int on);
 static int  cypress_write(struct tty_struct *tty, struct usb_serial_port *port,
@@ -633,8 +632,7 @@ static void cypress_release(struct usb_serial *serial)
 }
 
 
-static int cypress_open(struct tty_struct *tty,
-                        struct usb_serial_port *port, struct file *filp)
+static int cypress_open(struct tty_struct *tty, struct usb_serial_port *port)
 {
         struct cypress_private *priv = usb_get_serial_port_data(port);
         struct usb_serial *serial = port->serial;
@@ -659,15 +657,7 @@ static int cypress_open(struct tty_struct *tty,
         spin_unlock_irqrestore(&priv->lock, flags);
 
         /* Set termios */
-        result = cypress_write(tty, port, NULL, 0);
-
-        if (result) {
-                dev_err(&port->dev,
-                        "%s - failed setting the control lines - error %d\n",
-                                                        __func__, result);
-                return result;
-        } else
-                dbg("%s - success setting the control lines", __func__);
+        cypress_send(port);
 
         if (tty)
                 cypress_set_termios(tty, port, &priv->tmp_termios);
@@ -1005,6 +995,8 @@ static void cypress_set_termios(struct tty_struct *tty,
         dbg("%s - port %d", __func__, port->number);
 
         spin_lock_irqsave(&priv->lock, flags);
+        /* We can't clean this one up as we don't know the device type
+           early enough */
         if (!priv->termios_initialized) {
                 if (priv->chiptype == CT_EARTHMATE) {
                         *(tty->termios) = tty_std_termios;
diff --git a/drivers/usb/serial/cypress_m8.h b/drivers/usb/serial/cypress_m8.h
index e772b01ac3ac..1fd360e04065 100644
--- a/drivers/usb/serial/cypress_m8.h
+++ b/drivers/usb/serial/cypress_m8.h
@@ -57,7 +57,7 @@
 #define UART_RI         0x10    /* ring indicator - modem - device to host */
 #define UART_CD         0x40    /* carrier detect - modem - device to host */
 #define CYP_ERROR       0x08    /* received from input report - device to host */
-/* Note - the below has nothing to to with the "feature report" reset */
+/* Note - the below has nothing to do with the "feature report" reset */
 #define CONTROL_RESET   0x08    /* sent with output report - host to device */
 
 /* End of RS-232 protocol definitions */
diff --git a/drivers/usb/serial/digi_acceleport.c b/drivers/usb/serial/digi_acceleport.c
index f4808091c47c..ab3dd991586b 100644
--- a/drivers/usb/serial/digi_acceleport.c
+++ b/drivers/usb/serial/digi_acceleport.c
@@ -453,8 +453,7 @@ static int digi_write(struct tty_struct *tty, struct usb_serial_port *port,
 static void digi_write_bulk_callback(struct urb *urb);
 static int digi_write_room(struct tty_struct *tty);
 static int digi_chars_in_buffer(struct tty_struct *tty);
-static int digi_open(struct tty_struct *tty, struct usb_serial_port *port,
-        struct file *filp);
+static int digi_open(struct tty_struct *tty, struct usb_serial_port *port);
 static void digi_close(struct usb_serial_port *port);
 static int digi_carrier_raised(struct usb_serial_port *port);
 static void digi_dtr_rts(struct usb_serial_port *port, int on);
@@ -1347,8 +1346,7 @@ static int digi_carrier_raised(struct usb_serial_port *port)
         return 0;
 }
 
-static int digi_open(struct tty_struct *tty, struct usb_serial_port *port,
-                                struct file *filp)
+static int digi_open(struct tty_struct *tty, struct usb_serial_port *port)
 {
         int ret;
         unsigned char buf[32];
diff --git a/drivers/usb/serial/empeg.c b/drivers/usb/serial/empeg.c
index 80cb3471adbe..33c9e9cf9eb2 100644
--- a/drivers/usb/serial/empeg.c
+++ b/drivers/usb/serial/empeg.c
@@ -79,8 +79,7 @@ static int debug;
 #define EMPEG_PRODUCT_ID                0x0001
 
 /* function prototypes for an empeg-car player */
-static int  empeg_open(struct tty_struct *tty, struct usb_serial_port *port,
-                                                struct file *filp);
+static int  empeg_open(struct tty_struct *tty, struct usb_serial_port *port);
 static void empeg_close(struct usb_serial_port *port);
 static int  empeg_write(struct tty_struct *tty, struct usb_serial_port *port,
                                                 const unsigned char *buf,
@@ -90,8 +89,7 @@ static int  empeg_chars_in_buffer(struct tty_struct *tty);
 static void empeg_throttle(struct tty_struct *tty);
 static void empeg_unthrottle(struct tty_struct *tty);
 static int  empeg_startup(struct usb_serial *serial);
-static void empeg_set_termios(struct tty_struct *tty,
-                struct usb_serial_port *port, struct ktermios *old_termios);
+static void empeg_init_termios(struct tty_struct *tty);
 static void empeg_write_bulk_callback(struct urb *urb);
 static void empeg_read_bulk_callback(struct urb *urb);
 
@@ -123,7 +121,7 @@ static struct usb_serial_driver empeg_device = {
         .throttle =             empeg_throttle,
         .unthrottle =           empeg_unthrottle,
         .attach =               empeg_startup,
-        .set_termios =          empeg_set_termios,
+        .init_termios =         empeg_init_termios,
         .write =                empeg_write,
         .write_room =           empeg_write_room,
         .chars_in_buffer =      empeg_chars_in_buffer,
@@ -142,17 +140,13 @@ static int		bytes_out;
 /******************************************************************************
  * Empeg specific driver functions
  ******************************************************************************/
-static int empeg_open(struct tty_struct *tty, struct usb_serial_port *port,
-                                struct file *filp)
+static int empeg_open(struct tty_struct *tty,struct usb_serial_port *port)
 {
         struct usb_serial *serial = port->serial;
         int result = 0;
 
         dbg("%s - port %d", __func__, port->number);
 
-        /* Force default termio settings */
-        empeg_set_termios(tty, port, NULL) ;
-
         bytes_in = 0;
         bytes_out = 0;
 
@@ -425,11 +419,9 @@ static int  empeg_startup(struct usb_serial *serial)
 }
 
 
-static void empeg_set_termios(struct tty_struct *tty,
-                struct usb_serial_port *port, struct ktermios *old_termios)
+static void empeg_init_termios(struct tty_struct *tty)
 {
         struct ktermios *termios = tty->termios;
-        dbg("%s - port %d", __func__, port->number);
 
         /*
          * The empeg-car player wants these particular tty settings.
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index 8fec5d4455c9..4f883b1773d0 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -176,6 +176,9 @@ static struct usb_device_id id_table_combined [] = {
         { USB_DEVICE(FTDI_VID, FTDI_MICRO_CHAMELEON_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_RELAIS_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_OPENDCC_PID) },
+        { USB_DEVICE(FTDI_VID, FTDI_OPENDCC_SNIFFER_PID) },
+        { USB_DEVICE(FTDI_VID, FTDI_OPENDCC_THROTTLE_PID) },
+        { USB_DEVICE(FTDI_VID, FTDI_OPENDCC_GATEWAY_PID) },
         { USB_DEVICE(INTERBIOMETRICS_VID, INTERBIOMETRICS_IOBOARD_PID) },
         { USB_DEVICE(INTERBIOMETRICS_VID, INTERBIOMETRICS_MINI_IOBOARD_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_SPROG_II) },
@@ -694,6 +697,8 @@ static struct usb_device_id id_table_combined [] = {
         { USB_DEVICE(DE_VID, WHT_PID) },
         { USB_DEVICE(ADI_VID, ADI_GNICE_PID),
                 .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
+        { USB_DEVICE(ADI_VID, ADI_GNICEPLUS_PID),
+                .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
         { USB_DEVICE(JETI_VID, JETI_SPC1201_PID) },
         { USB_DEVICE(MARVELL_VID, MARVELL_SHEEVAPLUG_PID),
                 .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
@@ -702,6 +707,8 @@ static struct usb_device_id id_table_combined [] = {
         { USB_DEVICE(BAYER_VID, BAYER_CONTOUR_CABLE_PID) },
         { USB_DEVICE(FTDI_VID, MARVELL_OPENRD_PID),
                 .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
+        { USB_DEVICE(FTDI_VID, HAMEG_HO820_PID) },
+        { USB_DEVICE(FTDI_VID, HAMEG_HO870_PID) },
         { },                                    /* Optional parameter entry */
         { }                                     /* Terminating entry */
 };
@@ -747,8 +754,7 @@ static int  ftdi_sio_probe(struct usb_serial *serial,
                                         const struct usb_device_id *id);
 static int  ftdi_sio_port_probe(struct usb_serial_port *port);
 static int  ftdi_sio_port_remove(struct usb_serial_port *port);
-static int  ftdi_open(struct tty_struct *tty,
-                        struct usb_serial_port *port, struct file *filp);
+static int  ftdi_open(struct tty_struct *tty, struct usb_serial_port *port);
 static void ftdi_close(struct usb_serial_port *port);
 static void ftdi_dtr_rts(struct usb_serial_port *port, int on);
 static int  ftdi_write(struct tty_struct *tty, struct usb_serial_port *port,
@@ -1680,8 +1686,7 @@ static int ftdi_sio_port_remove(struct usb_serial_port *port)
         return 0;
 }
 
-static int ftdi_open(struct tty_struct *tty,
-                        struct usb_serial_port *port, struct file *filp)
+static int ftdi_open(struct tty_struct *tty, struct usb_serial_port *port)
 { /* ftdi_open */
         struct usb_device *dev = port->serial->dev;
         struct ftdi_private *priv = usb_get_serial_port_data(port);
diff --git a/drivers/usb/serial/ftdi_sio.h b/drivers/usb/serial/ftdi_sio.h
index 8c92b88166ae..6f31e0d71898 100644
--- a/drivers/usb/serial/ftdi_sio.h
+++ b/drivers/usb/serial/ftdi_sio.h
@@ -81,6 +81,9 @@
 
 /* OpenDCC (www.opendcc.de) product id */
 #define FTDI_OPENDCC_PID        0xBFD8
+#define FTDI_OPENDCC_SNIFFER_PID        0xBFD9
+#define FTDI_OPENDCC_THROTTLE_PID       0xBFDA
+#define FTDI_OPENDCC_GATEWAY_PID        0xBFDB
 
 /* Sprog II (Andrew Crosland's SprogII DCC interface) */
 #define FTDI_SPROG_II           0xF0C8
@@ -930,6 +933,7 @@
  */
 #define ADI_VID                 0x0456
 #define ADI_GNICE_PID           0xF000
+#define ADI_GNICEPLUS_PID       0xF001
 
 /*
  * JETI SPECTROMETER SPECBOS 1201
@@ -968,6 +972,12 @@
 #define MARVELL_OPENRD_PID      0x9e90
 
 /*
+ * Hameg HO820 and HO870 interface (using VID 0x0403)
+ */
+#define        HAMEG_HO820_PID         0xed74
+#define        HAMEG_HO870_PID         0xed71
+
+/*
  *   BmRequestType:  1100 0000b
  *   bRequest:       FTDI_E2_READ
  *   wValue:         0
diff --git a/drivers/usb/serial/garmin_gps.c b/drivers/usb/serial/garmin_gps.c
index 8839f1c70b7f..20432d345529 100644
--- a/drivers/usb/serial/garmin_gps.c
+++ b/drivers/usb/serial/garmin_gps.c
@@ -933,8 +933,7 @@ static int garmin_init_session(struct usb_serial_port *port)
 
 
 
-static int garmin_open(struct tty_struct *tty,
-                        struct usb_serial_port *port, struct file *filp)
+static int garmin_open(struct tty_struct *tty, struct usb_serial_port *port)
 {
         unsigned long flags;
         int status = 0;
diff --git a/drivers/usb/serial/generic.c b/drivers/usb/serial/generic.c
index ce57f6a32bdf..deba08c7a015 100644
--- a/drivers/usb/serial/generic.c
+++ b/drivers/usb/serial/generic.c
@@ -19,7 +19,7 @@
 #include <linux/usb.h>
 #include <linux/usb/serial.h>
 #include <linux/uaccess.h>
-
+#include <linux/kfifo.h>
 
 static int debug;
 
@@ -114,8 +114,7 @@ void usb_serial_generic_deregister(void)
 #endif
 }
 
-int usb_serial_generic_open(struct tty_struct *tty,
-                        struct usb_serial_port *port, struct file *filp)
+int usb_serial_generic_open(struct tty_struct *tty, struct usb_serial_port *port)
 {
         struct usb_serial *serial = port->serial;
         int result = 0;
@@ -167,24 +166,6 @@ static void generic_cleanup(struct usb_serial_port *port)
         }
 }
 
-int usb_serial_generic_resume(struct usb_serial *serial)
-{
-        struct usb_serial_port *port;
-        int i, c = 0, r;
-
-        for (i = 0; i < serial->num_ports; i++) {
-                port = serial->port[i];
-                if (port->port.count && port->read_urb) {
-                        r = usb_submit_urb(port->read_urb, GFP_NOIO);
-                        if (r < 0)
-                                c++;
-                }
-        }
-
-        return c ? -EIO : 0;
-}
-EXPORT_SYMBOL_GPL(usb_serial_generic_resume);
-
 void usb_serial_generic_close(struct usb_serial_port *port)
 {
         dbg("%s - port %d", __func__, port->number);
@@ -273,12 +254,81 @@ error_no_buffer:
         return bwrite;
 }
 
+/**
+ * usb_serial_generic_write_start - kick off an URB write
+ * @port:       Pointer to the &struct usb_serial_port data
+ *
+ * Returns the number of bytes queued on success. This will be zero if there
+ * was nothing to send. Otherwise, it returns a negative errno value
+ */
+static int usb_serial_generic_write_start(struct usb_serial_port *port)
+{
+        struct usb_serial *serial = port->serial;
+        unsigned char *data;
+        int result;
+        int count;
+        unsigned long flags;
+        bool start_io;
+
+        /* Atomically determine whether we can and need to start a USB
+         * operation. */
+        spin_lock_irqsave(&port->lock, flags);
+        if (port->write_urb_busy)
+                start_io = false;
+        else {
+                start_io = (__kfifo_len(port->write_fifo) != 0);
+                port->write_urb_busy = start_io;
+        }
+        spin_unlock_irqrestore(&port->lock, flags);
+
+        if (!start_io)
+                return 0;
+
+        data = port->write_urb->transfer_buffer;
+        count = kfifo_get(port->write_fifo, data, port->bulk_out_size);
+        usb_serial_debug_data(debug, &port->dev, __func__, count, data);
+
+        /* set up our urb */
+        usb_fill_bulk_urb(port->write_urb, serial->dev,
+                           usb_sndbulkpipe(serial->dev,
+                                port->bulk_out_endpointAddress),
+                           port->write_urb->transfer_buffer, count,
+                           ((serial->type->write_bulk_callback) ?
+                             serial->type->write_bulk_callback :
+                             usb_serial_generic_write_bulk_callback),
+                           port);
+
+        /* send the data out the bulk port */
+        result = usb_submit_urb(port->write_urb, GFP_ATOMIC);
+        if (result) {
+                dev_err(&port->dev,
+                        "%s - failed submitting write urb, error %d\n",
+                                                __func__, result);
+                /* don't have to grab the lock here, as we will
+                   retry if != 0 */
+                port->write_urb_busy = 0;
+        } else
+                result = count;
+
+        return result;
+}
+
+/**
+ * usb_serial_generic_write - generic write function for serial USB devices
+ * @tty:        Pointer to &struct tty_struct for the device
+ * @port:       Pointer to the &usb_serial_port structure for the device
+ * @buf:        Pointer to the data to write
+ * @count:      Number of bytes to write
+ *
+ * Returns the number of characters actually written, which may be anything
+ * from zero to @count. If an error occurs, it returns the negative errno
+ * value.
+ */
 int usb_serial_generic_write(struct tty_struct *tty,
         struct usb_serial_port *port, const unsigned char *buf, int count)
 {
         struct usb_serial *serial = port->serial;
         int result;
-        unsigned char *data;
 
         dbg("%s - port %d", __func__, port->number);
 
@@ -288,57 +338,20 @@ int usb_serial_generic_write(struct tty_struct *tty,
         }
 
         /* only do something if we have a bulk out endpoint */
-        if (serial->num_bulk_out) {
-                unsigned long flags;
-
-                if (serial->type->max_in_flight_urbs)
-                        return usb_serial_multi_urb_write(tty, port,
-                                                          buf, count);
-
-                spin_lock_irqsave(&port->lock, flags);
-                if (port->write_urb_busy) {
-                        spin_unlock_irqrestore(&port->lock, flags);
-                        dbg("%s - already writing", __func__);
-                        return 0;
-                }
-                port->write_urb_busy = 1;
-                spin_unlock_irqrestore(&port->lock, flags);
-
-                count = (count > port->bulk_out_size) ?
-                                        port->bulk_out_size : count;
-
-                memcpy(port->write_urb->transfer_buffer, buf, count);
-                data = port->write_urb->transfer_buffer;
-                usb_serial_debug_data(debug, &port->dev, __func__, count, data);
+        if (!serial->num_bulk_out)
+                return 0;
 
-                /* set up our urb */
-                usb_fill_bulk_urb(port->write_urb, serial->dev,
-                                   usb_sndbulkpipe(serial->dev,
-                                        port->bulk_out_endpointAddress),
-                                   port->write_urb->transfer_buffer, count,
-                                   ((serial->type->write_bulk_callback) ?
-                                     serial->type->write_bulk_callback :
-                                     usb_serial_generic_write_bulk_callback),
-                                   port);
+        if (serial->type->max_in_flight_urbs)
+                return usb_serial_multi_urb_write(tty, port,
+                                                  buf, count);
 
-                /* send the data out the bulk port */
-                port->write_urb_busy = 1;
-                result = usb_submit_urb(port->write_urb, GFP_ATOMIC);
-                if (result) {
-                        dev_err(&port->dev,
-                                "%s - failed submitting write urb, error %d\n",
-                                                        __func__, result);
-                        /* don't have to grab the lock here, as we will
-                           retry if != 0 */
-                        port->write_urb_busy = 0;
-                } else
-                        result = count;
+        count = kfifo_put(port->write_fifo, buf, count);
+        result = usb_serial_generic_write_start(port);
 
-                return result;
-        }
+        if (result >= 0)
+                result = count;
 
-        /* no bulk out, so return 0 bytes written */
-        return 0;
+        return result;
 }
 EXPORT_SYMBOL_GPL(usb_serial_generic_write);
 
@@ -356,9 +369,8 @@ int usb_serial_generic_write_room(struct tty_struct *tty)
                         room = port->bulk_out_size *
                                 (serial->type->max_in_flight_urbs -
                                  port->urbs_in_flight);
-        } else if (serial->num_bulk_out && !(port->write_urb_busy)) {
-                room = port->bulk_out_size;
-        }
+        } else if (serial->num_bulk_out)
+                room = port->write_fifo->size - __kfifo_len(port->write_fifo);
         spin_unlock_irqrestore(&port->lock, flags);
 
         dbg("%s - returns %d", __func__, room);
@@ -378,11 +390,8 @@ int usb_serial_generic_chars_in_buffer(struct tty_struct *tty)
                 spin_lock_irqsave(&port->lock, flags);
                 chars = port->tx_bytes_flight;
                 spin_unlock_irqrestore(&port->lock, flags);
-        } else if (serial->num_bulk_out) {
-                /* FIXME: Locking */
-                if (port->write_urb_busy)
-                        chars = port->write_urb->transfer_buffer_length;
-        }
+        } else if (serial->num_bulk_out)
+                chars = kfifo_len(port->write_fifo);
 
         dbg("%s - returns %d", __func__, chars);
         return chars;
@@ -486,16 +495,23 @@ void usb_serial_generic_write_bulk_callback(struct urb *urb)
                 if (port->urbs_in_flight < 0)
                         port->urbs_in_flight = 0;
                 spin_unlock_irqrestore(&port->lock, flags);
+
+                if (status) {
+                        dbg("%s - nonzero multi-urb write bulk status "
+                                "received: %d", __func__, status);
+                        return;
+                }
         } else {
-                /* Handle the case for single urb mode */
                 port->write_urb_busy = 0;
-        }
 
-        if (status) {
-                dbg("%s - nonzero write bulk status received: %d",
-                    __func__, status);
-                return;
+                if (status) {
+                        dbg("%s - nonzero multi-urb write bulk status "
+                                "received: %d", __func__, status);
+                        kfifo_reset(port->write_fifo);
+                } else
+                        usb_serial_generic_write_start(port);
         }
+
         usb_serial_port_softint(port);
 }
 EXPORT_SYMBOL_GPL(usb_serial_generic_write_bulk_callback);
@@ -560,6 +576,33 @@ int usb_serial_handle_break(struct usb_serial_port *port)
 }
 EXPORT_SYMBOL_GPL(usb_serial_handle_break);
 
+int usb_serial_generic_resume(struct usb_serial *serial)
+{
+        struct usb_serial_port *port;
+        int i, c = 0, r;
+
+        for (i = 0; i < serial->num_ports; i++) {
+                port = serial->port[i];
+                if (!port->port.count)
+                        continue;
+
+                if (port->read_urb) {
+                        r = usb_submit_urb(port->read_urb, GFP_NOIO);
+                        if (r < 0)
+                                c++;
+                }
+
+                if (port->write_urb) {
+                        r = usb_serial_generic_write_start(port);
+                        if (r < 0)
+                                c++;
+                }
+        }
+
+        return c ? -EIO : 0;
+}
+EXPORT_SYMBOL_GPL(usb_serial_generic_resume);
+
 void usb_serial_generic_disconnect(struct usb_serial *serial)
 {
         int i;
diff --git a/drivers/usb/serial/io_edgeport.c b/drivers/usb/serial/io_edgeport.c
index 0191693625d6..b97960ac92f2 100644
--- a/drivers/usb/serial/io_edgeport.c
+++ b/drivers/usb/serial/io_edgeport.c
@@ -205,8 +205,7 @@ static void edge_bulk_out_data_callback(struct urb *urb);
 static void edge_bulk_out_cmd_callback(struct urb *urb);
 
 /* function prototypes for the usbserial callbacks */
-static int edge_open(struct tty_struct *tty, struct usb_serial_port *port,
-                                        struct file *filp);
+static int edge_open(struct tty_struct *tty, struct usb_serial_port *port);
 static void edge_close(struct usb_serial_port *port);
 static int edge_write(struct tty_struct *tty, struct usb_serial_port *port,
                                         const unsigned char *buf, int count);
@@ -852,8 +851,7 @@ static void edge_bulk_out_cmd_callback(struct urb *urb)
  *      If successful, we return 0
  *      Otherwise we return a negative error number.
  *****************************************************************************/
-static int edge_open(struct tty_struct *tty,
-                        struct usb_serial_port *port, struct file *filp)
+static int edge_open(struct tty_struct *tty, struct usb_serial_port *port)
 {
         struct edgeport_port *edge_port = usb_get_serial_port_data(port);
         struct usb_serial *serial;
@@ -2542,7 +2540,7 @@ static int calc_baud_rate_divisor(int baudrate, int *divisor)
 
 /*****************************************************************************
  * send_cmd_write_uart_register
- *  this function builds up a uart register message and sends to to the device.
+ *  this function builds up a uart register message and sends to the device.
  *****************************************************************************/
 static int send_cmd_write_uart_register(struct edgeport_port *edge_port,
                                                 __u8 regNum, __u8 regValue)
diff --git a/drivers/usb/serial/io_ti.c b/drivers/usb/serial/io_ti.c
index e8bc42f92e79..d4cc0f7af400 100644
--- a/drivers/usb/serial/io_ti.c
+++ b/drivers/usb/serial/io_ti.c
@@ -1831,8 +1831,7 @@ static void edge_bulk_out_callback(struct urb *urb)
         tty_kref_put(tty);
 }
 
-static int edge_open(struct tty_struct *tty,
-                        struct usb_serial_port *port, struct file *filp)
+static int edge_open(struct tty_struct *tty, struct usb_serial_port *port)
 {
         struct edgeport_port *edge_port = usb_get_serial_port_data(port);
         struct edgeport_serial *edge_serial;
diff --git a/drivers/usb/serial/ipaq.c b/drivers/usb/serial/ipaq.c
index 2545d45ce16f..24fcc64b837d 100644
--- a/drivers/usb/serial/ipaq.c
+++ b/drivers/usb/serial/ipaq.c
@@ -75,7 +75,7 @@ static int initial_wait;
 
 /* Function prototypes for an ipaq */
 static int  ipaq_open(struct tty_struct *tty,
-                        struct usb_serial_port *port, struct file *filp);
+                        struct usb_serial_port *port);
 static void ipaq_close(struct usb_serial_port *port);
 static int  ipaq_calc_num_ports(struct usb_serial *serial);
 static int  ipaq_startup(struct usb_serial *serial);
@@ -587,7 +587,7 @@ static int		bytes_in;
 static int              bytes_out;
 
 static int ipaq_open(struct tty_struct *tty,
-                        struct usb_serial_port *port, struct file *filp)
+                        struct usb_serial_port *port)
 {
         struct usb_serial       *serial = port->serial;
         struct ipaq_private     *priv;
@@ -628,11 +628,6 @@ static int ipaq_open(struct tty_struct *tty,
                 priv->free_len += PACKET_SIZE;
         }
 
-        if (tty) {
-                /* FIXME: These two are bogus */
-                tty->raw = 1;
-                tty->real_raw = 1;
-        }
         /*
          * Lose the small buffers usbserial provides. Make larger ones.
          */
diff --git a/drivers/usb/serial/ipw.c b/drivers/usb/serial/ipw.c
index 29ad038b9c8d..727d323f092a 100644
--- a/drivers/usb/serial/ipw.c
+++ b/drivers/usb/serial/ipw.c
@@ -193,8 +193,7 @@ static void ipw_read_bulk_callback(struct urb *urb)
         return;
 }
 
-static int ipw_open(struct tty_struct *tty,
-                        struct usb_serial_port *port, struct file *filp)
+static int ipw_open(struct tty_struct *tty, struct usb_serial_port *port)
 {
         struct usb_device *dev = port->serial->dev;
         u8 buf_flow_static[16] = IPW_BYTES_FLOWINIT;
diff --git a/drivers/usb/serial/ir-usb.c b/drivers/usb/serial/ir-usb.c
index 66009b6b763a..95d8d26b9a44 100644
--- a/drivers/usb/serial/ir-usb.c
+++ b/drivers/usb/serial/ir-usb.c
@@ -86,8 +86,7 @@ static int buffer_size;
 static int xbof = -1;
 
 static int  ir_startup (struct usb_serial *serial);
-static int  ir_open(struct tty_struct *tty, struct usb_serial_port *port,
-                                        struct file *filep);
+static int  ir_open(struct tty_struct *tty, struct usb_serial_port *port);
 static void ir_close(struct usb_serial_port *port);
 static int  ir_write(struct tty_struct *tty, struct usb_serial_port *port,
                                         const unsigned char *buf, int count);
@@ -296,8 +295,7 @@ static int ir_startup(struct usb_serial *serial)
         return 0;
 }
 
-static int ir_open(struct tty_struct *tty,
-                        struct usb_serial_port *port, struct file *filp)
+static int ir_open(struct tty_struct *tty, struct usb_serial_port *port)
 {
         char *buffer;
         int result = 0;
diff --git a/drivers/usb/serial/iuu_phoenix.c b/drivers/usb/serial/iuu_phoenix.c
index 96873a7a32b0..e6e02b178d2b 100644
--- a/drivers/usb/serial/iuu_phoenix.c
+++ b/drivers/usb/serial/iuu_phoenix.c
@@ -40,7 +40,7 @@ static int debug;
 /*
  * Version Information
  */
-#define DRIVER_VERSION "v0.10"
+#define DRIVER_VERSION "v0.11"
 #define DRIVER_DESC "Infinity USB Unlimited Phoenix driver"
 
 static struct usb_device_id id_table[] = {
@@ -64,6 +64,7 @@ static int cdmode = 1;
 static int iuu_cardin;
 static int iuu_cardout;
 static int xmas;
+static int vcc_default = 5;
 
 static void read_rxcmd_callback(struct urb *urb);
 
@@ -71,7 +72,6 @@ struct iuu_private {
         spinlock_t lock;        /* store irq state */
         wait_queue_head_t delta_msr_wait;
         u8 line_status;
-        u8 termios_initialized;
         int tiostatus;          /* store IUART SIGNAL for tiocmget call */
         u8 reset;               /* if 1 reset is needed */
         int poll;               /* number of poll */
@@ -80,6 +80,7 @@ struct iuu_private {
         u8 *buf;                /* used for initialize speed */
         u8 *dbgbuf;             /* debug buffer */
         u8 len;
+        int vcc;                /* vcc (either 3 or 5 V) */
 };
 
 
@@ -115,6 +116,7 @@ static int iuu_startup(struct usb_serial *serial)
                 kfree(priv);
                 return -ENOMEM;
         }
+        priv->vcc = vcc_default;
         spin_lock_init(&priv->lock);
         init_waitqueue_head(&priv->delta_msr_wait);
         usb_set_serial_port_data(serial->port[0], priv);
@@ -1010,22 +1012,28 @@ static void iuu_close(struct usb_serial_port *port)
                 usb_kill_urb(port->write_urb);
                 usb_kill_urb(port->read_urb);
                 usb_kill_urb(port->interrupt_in_urb);
-                msleep(1000);
-                /* wait one second to free all buffers */
                 iuu_led(port, 0, 0, 0xF000, 0xFF);
-                msleep(1000);
-                usb_reset_device(port->serial->dev);
         }
 }
 
-static int iuu_open(struct tty_struct *tty,
-                        struct usb_serial_port *port, struct file *filp)
+static void iuu_init_termios(struct tty_struct *tty)
+{
+        *(tty->termios) = tty_std_termios;
+        tty->termios->c_cflag = CLOCAL | CREAD | CS8 | B9600
+                                | TIOCM_CTS | CSTOPB | PARENB;
+        tty->termios->c_ispeed = 9600;
+        tty->termios->c_ospeed = 9600;
+        tty->termios->c_lflag = 0;
+        tty->termios->c_oflag = 0;
+        tty->termios->c_iflag = 0;
+}
+
+static int iuu_open(struct tty_struct *tty, struct usb_serial_port *port)
 {
         struct usb_serial *serial = port->serial;
         u8 *buf;
         int result;
         u32 actual;
-        unsigned long flags;
         struct iuu_private *priv = usb_get_serial_port_data(port);
 
         dbg("%s -  port %d", __func__, port->number);
@@ -1064,21 +1072,7 @@ static int iuu_open(struct tty_struct *tty,
                           port->bulk_in_buffer, 512,
                           NULL, NULL);
 
-        /* set the termios structure */
-        spin_lock_irqsave(&priv->lock, flags);
-        if (tty && !priv->termios_initialized) {
-                *(tty->termios) = tty_std_termios;
-                tty->termios->c_cflag = CLOCAL | CREAD | CS8 | B9600
-                                        | TIOCM_CTS | CSTOPB | PARENB;
-                tty->termios->c_ispeed = 9600;
-                tty->termios->c_ospeed = 9600;
-                tty->termios->c_lflag = 0;
-                tty->termios->c_oflag = 0;
-                tty->termios->c_iflag = 0;
-                priv->termios_initialized = 1;
-                priv->poll = 0;
-         }
-        spin_unlock_irqrestore(&priv->lock, flags);
+        priv->poll = 0;
 
         /* initialize writebuf */
 #define FISH(a, b, c, d) do { \
@@ -1187,6 +1181,95 @@ static int iuu_open(struct tty_struct *tty,
         return result;
 }
 
+/* how to change VCC */
+static int iuu_vcc_set(struct usb_serial_port *port, unsigned int vcc)
+{
+        int status;
+        u8 *buf;
+
+        buf = kmalloc(5, GFP_KERNEL);
+        if (!buf)
+                return -ENOMEM;
+
+        dbg("%s - enter", __func__);
+
+        buf[0] = IUU_SET_VCC;
+        buf[1] = vcc & 0xFF;
+        buf[2] = (vcc >> 8) & 0xFF;
+        buf[3] = (vcc >> 16) & 0xFF;
+        buf[4] = (vcc >> 24) & 0xFF;
+
+        status = bulk_immediate(port, buf, 5);
+        kfree(buf);
+
+        if (status != IUU_OPERATION_OK)
+                dbg("%s - vcc error status = %2x", __func__, status);
+        else
+                dbg("%s - vcc OK !", __func__);
+
+        return status;
+}
+
+/*
+ * Sysfs Attributes
+ */
+
+static ssize_t show_vcc_mode(struct device *dev,
+        struct device_attribute *attr, char *buf)
+{
+        struct usb_serial_port *port = to_usb_serial_port(dev);
+        struct iuu_private *priv = usb_get_serial_port_data(port);
+
+        return sprintf(buf, "%d\n", priv->vcc);
+}
+
+static ssize_t store_vcc_mode(struct device *dev,
+        struct device_attribute *attr, const char *buf, size_t count)
+{
+        struct usb_serial_port *port = to_usb_serial_port(dev);
+        struct iuu_private *priv = usb_get_serial_port_data(port);
+        unsigned long v;
+
+        if (strict_strtoul(buf, 10, &v)) {
+                dev_err(dev, "%s - vcc_mode: %s is not a unsigned long\n",
+                                __func__, buf);
+                goto fail_store_vcc_mode;
+        }
+
+        dbg("%s: setting vcc_mode = %ld", __func__, v);
+
+        if ((v != 3) && (v != 5)) {
+                dev_err(dev, "%s - vcc_mode %ld is invalid\n", __func__, v);
+        } else {
+                iuu_vcc_set(port, v);
+                priv->vcc = v;
+        }
+fail_store_vcc_mode:
+        return count;
+}
+
+static DEVICE_ATTR(vcc_mode, S_IRUSR | S_IWUSR, show_vcc_mode,
+        store_vcc_mode);
+
+static int iuu_create_sysfs_attrs(struct usb_serial_port *port)
+{
+        dbg("%s", __func__);
+
+        return device_create_file(&port->dev, &dev_attr_vcc_mode);
+}
+
+static int iuu_remove_sysfs_attrs(struct usb_serial_port *port)
+{
+        dbg("%s", __func__);
+
+        device_remove_file(&port->dev, &dev_attr_vcc_mode);
+        return 0;
+}
+
+/*
+ * End Sysfs Attributes
+ */
+
 static struct usb_serial_driver iuu_device = {
         .driver = {
                    .owner = THIS_MODULE,
@@ -1194,6 +1277,8 @@ static struct usb_serial_driver iuu_device = {
                    },
         .id_table = id_table,
         .num_ports = 1,
+        .port_probe = iuu_create_sysfs_attrs,
+        .port_remove = iuu_remove_sysfs_attrs,
         .open = iuu_open,
         .close = iuu_close,
         .write = iuu_uart_write,
@@ -1201,6 +1286,7 @@ static struct usb_serial_driver iuu_device = {
         .tiocmget = iuu_tiocmget,
         .tiocmset = iuu_tiocmset,
         .set_termios = iuu_set_termios,
+        .init_termios = iuu_init_termios,
         .attach = iuu_startup,
         .release = iuu_release,
 };
@@ -1242,14 +1328,19 @@ module_param(debug, bool, S_IRUGO | S_IWUSR);
 MODULE_PARM_DESC(debug, "Debug enabled or not");
 
 module_param(xmas, bool, S_IRUGO | S_IWUSR);
-MODULE_PARM_DESC(xmas, "xmas color enabled or not");
+MODULE_PARM_DESC(xmas, "Xmas colors enabled or not");
 
 module_param(boost, int, S_IRUGO | S_IWUSR);
-MODULE_PARM_DESC(boost, "overclock boost percent 100 to 500");
+MODULE_PARM_DESC(boost, "Card overclock boost (in percent 100-500)");
 
 module_param(clockmode, int, S_IRUGO | S_IWUSR);
-MODULE_PARM_DESC(clockmode, "1=3Mhz579,2=3Mhz680,3=6Mhz");
+MODULE_PARM_DESC(clockmode, "Card clock mode (1=3.579 MHz, 2=3.680 MHz, "
+                "3=6 Mhz)");
 
 module_param(cdmode, int, S_IRUGO | S_IWUSR);
-MODULE_PARM_DESC(cdmode, "Card detect mode 0=none, 1=CD, 2=!CD, 3=DSR, "
-                 "4=!DSR, 5=CTS, 6=!CTS, 7=RING, 8=!RING");
+MODULE_PARM_DESC(cdmode, "Card detect mode (0=none, 1=CD, 2=!CD, 3=DSR, "
+                 "4=!DSR, 5=CTS, 6=!CTS, 7=RING, 8=!RING)");
+
+module_param(vcc_default, int, S_IRUGO | S_IWUSR);
+MODULE_PARM_DESC(vcc_default, "Set default VCC (either 3 for 3.3V or 5 "
+                "for 5V). Default to 5.");
diff --git a/drivers/usb/serial/keyspan.c b/drivers/usb/serial/keyspan.c
index 2594b8743d3f..f8c4b07033ff 100644
--- a/drivers/usb/serial/keyspan.c
+++ b/drivers/usb/serial/keyspan.c
@@ -1209,8 +1209,7 @@ static int keyspan_write_room(struct tty_struct *tty)
 }
 
 
-static int keyspan_open(struct tty_struct *tty,
-                        struct usb_serial_port *port, struct file *filp)
+static int keyspan_open(struct tty_struct *tty, struct usb_serial_port *port)
 {
         struct keyspan_port_private     *p_priv;
         struct keyspan_serial_private   *s_priv;
diff --git a/drivers/usb/serial/keyspan.h b/drivers/usb/serial/keyspan.h
index 3107ed15af64..30771e5b3973 100644
--- a/drivers/usb/serial/keyspan.h
+++ b/drivers/usb/serial/keyspan.h
@@ -36,8 +36,7 @@
 
 /* Function prototypes for Keyspan serial converter */
 static int  keyspan_open                (struct tty_struct *tty,
-                                         struct usb_serial_port *port,
-                                         struct file *filp);
+                                         struct usb_serial_port *port);
 static void keyspan_close               (struct usb_serial_port *port);
 static void keyspan_dtr_rts             (struct usb_serial_port *port, int on);
 static int  keyspan_startup             (struct usb_serial *serial);
diff --git a/drivers/usb/serial/keyspan_pda.c b/drivers/usb/serial/keyspan_pda.c
index d0b12e40c2b1..257c16cc6b2a 100644
--- a/drivers/usb/serial/keyspan_pda.c
+++ b/drivers/usb/serial/keyspan_pda.c
@@ -681,7 +681,7 @@ static int keyspan_pda_carrier_raised(struct usb_serial_port *port)
 
 
 static int keyspan_pda_open(struct tty_struct *tty,
-                        struct usb_serial_port *port, struct file *filp)
+                                        struct usb_serial_port *port)
 {
         struct usb_serial *serial = port->serial;
         unsigned char room;
diff --git a/drivers/usb/serial/kl5kusb105.c b/drivers/usb/serial/kl5kusb105.c
index 0f44bb8e8d4f..f7373371b137 100644
--- a/drivers/usb/serial/kl5kusb105.c
+++ b/drivers/usb/serial/kl5kusb105.c
@@ -38,7 +38,7 @@
  *   0.3a - implemented pools of write URBs
  *   0.3  - alpha version for public testing
  *   0.2  - TIOCMGET works, so autopilot(1) can be used!
- *   0.1  - can be used to to pilot-xfer -p /dev/ttyUSB0 -l
+ *   0.1  - can be used to do pilot-xfer -p /dev/ttyUSB0 -l
  *
  *   The driver skeleton is mainly based on mct_u232.c and various other
  *   pieces of code shamelessly copied from the drivers/usb/serial/ directory.
@@ -75,8 +75,7 @@ static int debug;
 static int  klsi_105_startup(struct usb_serial *serial);
 static void klsi_105_disconnect(struct usb_serial *serial);
 static void klsi_105_release(struct usb_serial *serial);
-static int  klsi_105_open(struct tty_struct *tty,
-                        struct usb_serial_port *port, struct file *filp);
+static int  klsi_105_open(struct tty_struct *tty, struct usb_serial_port *port);
 static void klsi_105_close(struct usb_serial_port *port);
 static int  klsi_105_write(struct tty_struct *tty,
         struct usb_serial_port *port, const unsigned char *buf, int count);
@@ -358,8 +357,7 @@ static void klsi_105_release(struct usb_serial *serial)
         }
 } /* klsi_105_release */
 
-static int  klsi_105_open(struct tty_struct *tty,
-                        struct usb_serial_port *port, struct file *filp)
+static int  klsi_105_open(struct tty_struct *tty, struct usb_serial_port *port)
 {
         struct klsi_105_private *priv = usb_get_serial_port_data(port);
         int retval = 0;
@@ -371,10 +369,6 @@ static int  klsi_105_open(struct tty_struct *tty,
 
         dbg("%s port %d", __func__, port->number);
 
-        /* force low_latency on so that our tty_push actually forces
-         * the data through
-         * tty->low_latency = 1; */
-
         /* Do a defined restart:
          * Set up sane default baud rate and send the 'READ_ON'
          * vendor command.
diff --git a/drivers/usb/serial/kobil_sct.c b/drivers/usb/serial/kobil_sct.c
index 6db0e561f680..45ea694b3ae6 100644
--- a/drivers/usb/serial/kobil_sct.c
+++ b/drivers/usb/serial/kobil_sct.c
@@ -70,8 +70,7 @@ static int debug;
 /* Function prototypes */
 static int  kobil_startup(struct usb_serial *serial);
 static void kobil_release(struct usb_serial *serial);
-static int  kobil_open(struct tty_struct *tty,
-                        struct usb_serial_port *port, struct file *filp);
+static int  kobil_open(struct tty_struct *tty, struct usb_serial_port *port);
 static void kobil_close(struct usb_serial_port *port);
 static int  kobil_write(struct tty_struct *tty, struct usb_serial_port *port,
                          const unsigned char *buf, int count);
@@ -85,7 +84,7 @@ static void kobil_read_int_callback(struct urb *urb);
 static void kobil_write_callback(struct urb *purb);
 static void kobil_set_termios(struct tty_struct *tty,
                         struct usb_serial_port *port, struct ktermios *old);
-
+static void kobil_init_termios(struct tty_struct *tty);
 
 static struct usb_device_id id_table [] = {
         { USB_DEVICE(KOBIL_VENDOR_ID, KOBIL_ADAPTER_B_PRODUCT_ID) },
@@ -120,6 +119,7 @@ static struct usb_serial_driver kobil_device = {
         .release =              kobil_release,
         .ioctl =                kobil_ioctl,
         .set_termios =          kobil_set_termios,
+        .init_termios =         kobil_init_termios,
         .tiocmget =             kobil_tiocmget,
         .tiocmset =             kobil_tiocmset,
         .open =                 kobil_open,
@@ -210,9 +210,17 @@ static void kobil_release(struct usb_serial *serial)
                 kfree(usb_get_serial_port_data(serial->port[i]));
 }
 
+static void kobil_init_termios(struct tty_struct *tty)
+{
+        /* Default to echo off and other sane device settings */
+        tty->termios->c_lflag = 0;
+        tty->termios->c_lflag &= ~(ISIG | ICANON | ECHO | IEXTEN | XCASE);
+        tty->termios->c_iflag = IGNBRK | IGNPAR | IXOFF;
+        /* do NOT translate CR to CR-NL (0x0A -> 0x0A 0x0D) */
+        tty->termios->c_oflag &= ~ONLCR;
+}
 
-static int kobil_open(struct tty_struct *tty,
-                        struct usb_serial_port *port, struct file *filp)
+static int kobil_open(struct tty_struct *tty, struct usb_serial_port *port)
 {
         int result = 0;
         struct kobil_private *priv;
@@ -226,16 +234,6 @@ static int kobil_open(struct tty_struct *tty,
         /* someone sets the dev to 0 if the close method has been called */
         port->interrupt_in_urb->dev = port->serial->dev;
 
-        if (tty) {
-
-                /* Default to echo off and other sane device settings */
-                tty->termios->c_lflag = 0;
-                tty->termios->c_lflag &= ~(ISIG | ICANON | ECHO | IEXTEN |
-                                                                 XCASE);
-                tty->termios->c_iflag = IGNBRK | IGNPAR | IXOFF;
-                /* do NOT translate CR to CR-NL (0x0A -> 0x0A 0x0D) */
-                tty->termios->c_oflag &= ~ONLCR;
-        }
         /* allocate memory for transfer buffer */
         transfer_buffer = kzalloc(transfer_buffer_length, GFP_KERNEL);
         if (!transfer_buffer)
diff --git a/drivers/usb/serial/mct_u232.c b/drivers/usb/serial/mct_u232.c
index d8825e159aa5..ad4998bbf16f 100644
--- a/drivers/usb/serial/mct_u232.c
+++ b/drivers/usb/serial/mct_u232.c
@@ -93,8 +93,7 @@ static int debug;
  */
 static int  mct_u232_startup(struct usb_serial *serial);
 static void mct_u232_release(struct usb_serial *serial);
-static int  mct_u232_open(struct tty_struct *tty,
-                        struct usb_serial_port *port, struct file *filp);
+static int  mct_u232_open(struct tty_struct *tty, struct usb_serial_port *port);
 static void mct_u232_close(struct usb_serial_port *port);
 static void mct_u232_dtr_rts(struct usb_serial_port *port, int on);
 static void mct_u232_read_int_callback(struct urb *urb);
@@ -421,8 +420,7 @@ static void mct_u232_release(struct usb_serial *serial)
         }
 } /* mct_u232_release */
 
-static int  mct_u232_open(struct tty_struct *tty,
-                        struct usb_serial_port *port, struct file *filp)
+static int  mct_u232_open(struct tty_struct *tty, struct usb_serial_port *port)
 {
         struct usb_serial *serial = port->serial;
         struct mct_u232_private *priv = usb_get_serial_port_data(port);
@@ -568,10 +566,13 @@ static void mct_u232_read_int_callback(struct urb *urb)
          * Work-a-round: handle the 'usual' bulk-in pipe here
          */
         if (urb->transfer_buffer_length > 2) {
-                tty = tty_port_tty_get(&port->port);
                 if (urb->actual_length) {
-                        tty_insert_flip_string(tty, data, urb->actual_length);
-                        tty_flip_buffer_push(tty);
+                        tty = tty_port_tty_get(&port->port);
+                        if (tty) {
+                                tty_insert_flip_string(tty, data,
+                                                urb->actual_length);
+                                tty_flip_buffer_push(tty);
+                        }
                         tty_kref_put(tty);
                 }
                 goto exit;
diff --git a/drivers/usb/serial/mos7720.c b/drivers/usb/serial/mos7720.c
index ccd4dd340d2c..763e32a44be0 100644
--- a/drivers/usb/serial/mos7720.c
+++ b/drivers/usb/serial/mos7720.c
@@ -85,7 +85,7 @@ static int debug;
 #define MOSCHIP_DEVICE_ID_7720          0x7720
 #define MOSCHIP_DEVICE_ID_7715          0x7715
 
-static struct usb_device_id moschip_port_id_table [] = {
+static struct usb_device_id moschip_port_id_table[] = {
         { USB_DEVICE(USB_VENDOR_ID_MOSCHIP, MOSCHIP_DEVICE_ID_7720) },
         { } /* terminating entry */
 };
@@ -319,8 +319,7 @@ static int send_mos_cmd(struct usb_serial *serial, __u8 request, __u16 value,
         return status;
 }
 
-static int mos7720_open(struct tty_struct *tty,
-                        struct usb_serial_port *port, struct file *filp)
+static int mos7720_open(struct tty_struct *tty, struct usb_serial_port *port)
 {
         struct usb_serial *serial;
         struct usb_serial_port *port0;
@@ -378,10 +377,14 @@ static int mos7720_open(struct tty_struct *tty,
          /* Initialize MCS7720 -- Write Init values to corresponding Registers
           *
           * Register Index
+          * 0 : THR/RHR
           * 1 : IER
           * 2 : FCR
           * 3 : LCR
           * 4 : MCR
+          * 5 : LSR
+          * 6 : MSR
+          * 7 : SPR
           *
           * 0x08 : SP1/2 Control Reg
           */
@@ -1250,20 +1253,88 @@ static void mos7720_set_termios(struct tty_struct *tty,
 static int get_lsr_info(struct tty_struct *tty,
                 struct moschip_port *mos7720_port, unsigned int __user *value)
 {
-        int count;
+        struct usb_serial_port *port = tty->driver_data;
         unsigned int result = 0;
+        unsigned char data = 0;
+        int port_number = port->number - port->serial->minor;
+        int count;
 
         count = mos7720_chars_in_buffer(tty);
         if (count == 0) {
-                dbg("%s -- Empty", __func__);
-                result = TIOCSER_TEMT;
+                send_mos_cmd(port->serial, MOS_READ, port_number,
+                                                        UART_LSR, &data);
+                if ((data & (UART_LSR_TEMT | UART_LSR_THRE))
+                                        == (UART_LSR_TEMT | UART_LSR_THRE)) {
+                        dbg("%s -- Empty", __func__);
+                        result = TIOCSER_TEMT;
+                }
         }
-
         if (copy_to_user(value, &result, sizeof(int)))
                 return -EFAULT;
         return 0;
 }
 
+static int mos7720_tiocmget(struct tty_struct *tty, struct file *file)
+{
+        struct usb_serial_port *port = tty->driver_data;
+        struct moschip_port *mos7720_port = usb_get_serial_port_data(port);
+        unsigned int result = 0;
+        unsigned int mcr ;
+        unsigned int msr ;
+
+        dbg("%s - port %d", __func__, port->number);
+
+        mcr = mos7720_port->shadowMCR;
+        msr = mos7720_port->shadowMSR;
+
+        result = ((mcr & UART_MCR_DTR)  ? TIOCM_DTR : 0)   /* 0x002 */
+          | ((mcr & UART_MCR_RTS)   ? TIOCM_RTS : 0)   /* 0x004 */
+          | ((msr & UART_MSR_CTS)   ? TIOCM_CTS : 0)   /* 0x020 */
+          | ((msr & UART_MSR_DCD)   ? TIOCM_CAR : 0)   /* 0x040 */
+          | ((msr & UART_MSR_RI)    ? TIOCM_RI :  0)   /* 0x080 */
+          | ((msr & UART_MSR_DSR)   ? TIOCM_DSR : 0);  /* 0x100 */
+
+        dbg("%s -- %x", __func__, result);
+
+        return result;
+}
+
+static int mos7720_tiocmset(struct tty_struct *tty, struct file *file,
+                                        unsigned int set, unsigned int clear)
+{
+        struct usb_serial_port *port = tty->driver_data;
+        struct moschip_port *mos7720_port = usb_get_serial_port_data(port);
+        unsigned int mcr ;
+        unsigned char lmcr;
+
+        dbg("%s - port %d", __func__, port->number);
+        dbg("he was at tiocmget");
+
+        mcr = mos7720_port->shadowMCR;
+
+        if (set & TIOCM_RTS)
+                mcr |= UART_MCR_RTS;
+        if (set & TIOCM_DTR)
+                mcr |= UART_MCR_DTR;
+        if (set & TIOCM_LOOP)
+                mcr |= UART_MCR_LOOP;
+
+        if (clear & TIOCM_RTS)
+                mcr &= ~UART_MCR_RTS;
+        if (clear & TIOCM_DTR)
+                mcr &= ~UART_MCR_DTR;
+        if (clear & TIOCM_LOOP)
+                mcr &= ~UART_MCR_LOOP;
+
+        mos7720_port->shadowMCR = mcr;
+        lmcr = mos7720_port->shadowMCR;
+
+        send_mos_cmd(port->serial, MOS_WRITE,
+                port->number - port->serial->minor, UART_MCR, &lmcr);
+
+        return 0;
+}
+
 static int set_modem_info(struct moschip_port *mos7720_port, unsigned int cmd,
                           unsigned int __user *value)
 {
@@ -1301,14 +1372,6 @@ static int set_modem_info(struct moschip_port *mos7720_port, unsigned int cmd,
                         mcr &= ~UART_MCR_LOOP;
                 break;
 
-        case TIOCMSET:
-                /* turn off the RTS and DTR and LOOPBACK
-                 * and then only turn on what was asked to */
-                mcr &=  ~(UART_MCR_RTS | UART_MCR_DTR | UART_MCR_LOOP);
-                mcr |= ((arg & TIOCM_RTS) ? UART_MCR_RTS : 0);
-                mcr |= ((arg & TIOCM_DTR) ? UART_MCR_DTR : 0);
-                mcr |= ((arg & TIOCM_LOOP) ? UART_MCR_LOOP : 0);
-                break;
         }
 
         mos7720_port->shadowMCR = mcr;
@@ -1320,28 +1383,6 @@ static int set_modem_info(struct moschip_port *mos7720_port, unsigned int cmd,
         return 0;
 }
 
-static int get_modem_info(struct moschip_port *mos7720_port,
-                          unsigned int __user *value)
-{
-        unsigned int result = 0;
-        unsigned int msr = mos7720_port->shadowMSR;
-        unsigned int mcr = mos7720_port->shadowMCR;
-
-        result = ((mcr & UART_MCR_DTR)  ? TIOCM_DTR: 0)   /* 0x002 */
-                  | ((mcr & UART_MCR_RTS)       ? TIOCM_RTS: 0)   /* 0x004 */
-                  | ((msr & UART_MSR_CTS)       ? TIOCM_CTS: 0)   /* 0x020 */
-                  | ((msr & UART_MSR_DCD)       ? TIOCM_CAR: 0)   /* 0x040 */
-                  | ((msr & UART_MSR_RI)        ? TIOCM_RI:  0)   /* 0x080 */
-                  | ((msr & UART_MSR_DSR)       ? TIOCM_DSR: 0);  /* 0x100 */
-
-
-        dbg("%s -- %x", __func__, result);
-
-        if (copy_to_user(value, &result, sizeof(int)))
-                return -EFAULT;
-        return 0;
-}
-
 static int get_serial_info(struct moschip_port *mos7720_port,
                            struct serial_struct __user *retinfo)
 {
@@ -1392,17 +1433,11 @@ static int mos7720_ioctl(struct tty_struct *tty, struct file *file,
         /* FIXME: These should be using the mode methods */
         case TIOCMBIS:
         case TIOCMBIC:
-        case TIOCMSET:
                 dbg("%s (%d) TIOCMSET/TIOCMBIC/TIOCMSET",
                                         __func__, port->number);
                 return set_modem_info(mos7720_port, cmd,
                                       (unsigned int __user *)arg);
 
-        case TIOCMGET:
-                dbg("%s (%d) TIOCMGET", __func__,  port->number);
-                return get_modem_info(mos7720_port,
-                                      (unsigned int __user *)arg);
-
         case TIOCGSERIAL:
                 dbg("%s (%d) TIOCGSERIAL", __func__,  port->number);
                 return get_serial_info(mos7720_port,
@@ -1557,6 +1592,8 @@ static struct usb_serial_driver moschip7720_2port_driver = {
         .attach                 = mos7720_startup,
         .release                = mos7720_release,
         .ioctl                  = mos7720_ioctl,
+        .tiocmget               = mos7720_tiocmget,
+        .tiocmset               = mos7720_tiocmset,
         .set_termios            = mos7720_set_termios,
         .write                  = mos7720_write,
         .write_room             = mos7720_write_room,
diff --git a/drivers/usb/serial/mos7840.c b/drivers/usb/serial/mos7840.c
index 270009afdf77..f11abf52be7d 100644
--- a/drivers/usb/serial/mos7840.c
+++ b/drivers/usb/serial/mos7840.c
@@ -824,8 +824,7 @@ static int mos7840_serial_probe(struct usb_serial *serial,
  *      Otherwise we return a negative error number.
  *****************************************************************************/
 
-static int mos7840_open(struct tty_struct *tty,
-                        struct usb_serial_port *port, struct file *filp)
+static int mos7840_open(struct tty_struct *tty, struct usb_serial_port *port)
 {
         int response;
         int j;
@@ -2134,106 +2133,6 @@ static int mos7840_get_lsr_info(struct tty_struct *tty,
 }
 
 /*****************************************************************************
- * mos7840_set_modem_info
- *      function to set modem info
- *****************************************************************************/
-
-/* FIXME: Should be using the model control hooks */
-
-static int mos7840_set_modem_info(struct moschip_port *mos7840_port,
-                                  unsigned int cmd, unsigned int __user *value)
-{
-        unsigned int mcr;
-        unsigned int arg;
-        __u16 Data;
-        int status;
-        struct usb_serial_port *port;
-
-        if (mos7840_port == NULL)
-                return -1;
-
-        port = (struct usb_serial_port *)mos7840_port->port;
-        if (mos7840_port_paranoia_check(port, __func__)) {
-                dbg("%s", "Invalid port");
-                return -1;
-        }
-
-        mcr = mos7840_port->shadowMCR;
-
-        if (copy_from_user(&arg, value, sizeof(int)))
-                return -EFAULT;
-
-        switch (cmd) {
-        case TIOCMBIS:
-                if (arg & TIOCM_RTS)
-                        mcr |= MCR_RTS;
-                if (arg & TIOCM_DTR)
-                        mcr |= MCR_RTS;
-                if (arg & TIOCM_LOOP)
-                        mcr |= MCR_LOOPBACK;
-                break;
-
-        case TIOCMBIC:
-                if (arg & TIOCM_RTS)
-                        mcr &= ~MCR_RTS;
-                if (arg & TIOCM_DTR)
-                        mcr &= ~MCR_RTS;
-                if (arg & TIOCM_LOOP)
-                        mcr &= ~MCR_LOOPBACK;
-                break;
-
-        case TIOCMSET:
-                /* turn off the RTS and DTR and LOOPBACK
-                 * and then only turn on what was asked to */
-                mcr &= ~(MCR_RTS | MCR_DTR | MCR_LOOPBACK);
-                mcr |= ((arg & TIOCM_RTS) ? MCR_RTS : 0);
-                mcr |= ((arg & TIOCM_DTR) ? MCR_DTR : 0);
-                mcr |= ((arg & TIOCM_LOOP) ? MCR_LOOPBACK : 0);
-                break;
-        }
-
-        lock_kernel();
-        mos7840_port->shadowMCR = mcr;
-
-        Data = mos7840_port->shadowMCR;
-        status = mos7840_set_uart_reg(port, MODEM_CONTROL_REGISTER, Data);
-        unlock_kernel();
-        if (status < 0) {
-                dbg("setting MODEM_CONTROL_REGISTER Failed");
-                return -1;
-        }
-
-        return 0;
-}
-
-/*****************************************************************************
- * mos7840_get_modem_info
- *      function to get modem info
- *****************************************************************************/
-
-static int mos7840_get_modem_info(struct moschip_port *mos7840_port,
-                                  unsigned int __user *value)
-{
-        unsigned int result = 0;
-        __u16 msr;
-        unsigned int mcr = mos7840_port->shadowMCR;
-        mos7840_get_uart_reg(mos7840_port->port,
-                                                MODEM_STATUS_REGISTER, &msr);
-        result = ((mcr & MCR_DTR) ? TIOCM_DTR : 0)      /* 0x002 */
-            |((mcr & MCR_RTS) ? TIOCM_RTS : 0)  /* 0x004 */
-            |((msr & MOS7840_MSR_CTS) ? TIOCM_CTS : 0)  /* 0x020 */
-            |((msr & MOS7840_MSR_CD) ? TIOCM_CAR : 0)   /* 0x040 */
-            |((msr & MOS7840_MSR_RI) ? TIOCM_RI : 0)    /* 0x080 */
-            |((msr & MOS7840_MSR_DSR) ? TIOCM_DSR : 0); /* 0x100 */
-
-        dbg("%s -- %x", __func__, result);
-
-        if (copy_to_user(value, &result, sizeof(int)))
-                return -EFAULT;
-        return 0;
-}
-
-/*****************************************************************************
  * mos7840_get_serial_info
  *      function to get information about serial port
  *****************************************************************************/
@@ -2281,7 +2180,6 @@ static int mos7840_ioctl(struct tty_struct *tty, struct file *file,
         struct async_icount cnow;
         struct async_icount cprev;
         struct serial_icounter_struct icount;
-        int mosret = 0;
 
         if (mos7840_port_paranoia_check(port, __func__)) {
                 dbg("%s", "Invalid port");
@@ -2303,20 +2201,6 @@ static int mos7840_ioctl(struct tty_struct *tty, struct file *file,
                 return mos7840_get_lsr_info(tty, argp);
                 return 0;
 
-        /* FIXME: use the modem hooks and remove this */
-        case TIOCMBIS:
-        case TIOCMBIC:
-        case TIOCMSET:
-                dbg("%s (%d) TIOCMSET/TIOCMBIC/TIOCMSET", __func__,
-                    port->number);
-                mosret =
-                    mos7840_set_modem_info(mos7840_port, cmd, argp);
-                return mosret;
-
-        case TIOCMGET:
-                dbg("%s (%d) TIOCMGET", __func__, port->number);
-                return mos7840_get_modem_info(mos7840_port, argp);
-
         case TIOCGSERIAL:
                 dbg("%s (%d) TIOCGSERIAL", __func__, port->number);
                 return mos7840_get_serial_info(mos7840_port, argp);
diff --git a/drivers/usb/serial/moto_modem.c b/drivers/usb/serial/moto_modem.c
index b66b71ccd12b..99bd00f5188a 100644
--- a/drivers/usb/serial/moto_modem.c
+++ b/drivers/usb/serial/moto_modem.c
@@ -8,7 +8,7 @@
  *  published by the Free Software Foundation.
  *
  * {sigh}
- * Mororola should be using the CDC ACM USB spec, but instead
+ * Motorola should be using the CDC ACM USB spec, but instead
  * they try to just "do their own thing"...  This driver should handle a
  * few phones in which a basic "dumb serial connection" is needed to be
  * able to get a connection through to them.
diff --git a/drivers/usb/serial/navman.c b/drivers/usb/serial/navman.c
index f5f3751a888c..5ceaa4c6be09 100644
--- a/drivers/usb/serial/navman.c
+++ b/drivers/usb/serial/navman.c
@@ -80,8 +80,7 @@ exit:
                         __func__, result);
 }
 
-static int navman_open(struct tty_struct *tty,
-                        struct usb_serial_port *port, struct file *filp)
+static int navman_open(struct tty_struct *tty, struct usb_serial_port *port)
 {
         int result = 0;
 
diff --git a/drivers/usb/serial/omninet.c b/drivers/usb/serial/omninet.c
index 56857ddbd70b..062265038bf0 100644
--- a/drivers/usb/serial/omninet.c
+++ b/drivers/usb/serial/omninet.c
@@ -64,8 +64,7 @@ static int debug;
 #define BT_IGNITIONPRO_ID       0x2000
 
 /* function prototypes */
-static int  omninet_open(struct tty_struct *tty, struct usb_serial_port *port,
-                                                        struct file *filp);
+static int  omninet_open(struct tty_struct *tty, struct usb_serial_port *port);
 static void omninet_close(struct usb_serial_port *port);
 static void omninet_read_bulk_callback(struct urb *urb);
 static void omninet_write_bulk_callback(struct urb *urb);
@@ -163,8 +162,7 @@ static int omninet_attach(struct usb_serial *serial)
         return 0;
 }
 
-static int omninet_open(struct tty_struct *tty,
-                        struct usb_serial_port *port, struct file *filp)
+static int omninet_open(struct tty_struct *tty, struct usb_serial_port *port)
 {
         struct usb_serial       *serial = port->serial;
         struct usb_serial_port  *wport;
diff --git a/drivers/usb/serial/opticon.c b/drivers/usb/serial/opticon.c
index 336bba79ad32..1085a577c5c1 100644
--- a/drivers/usb/serial/opticon.c
+++ b/drivers/usb/serial/opticon.c
@@ -144,8 +144,7 @@ exit:
         spin_unlock(&priv->lock);
 }
 
-static int opticon_open(struct tty_struct *tty, struct usb_serial_port *port,
-                        struct file *filp)
+static int opticon_open(struct tty_struct *tty, struct usb_serial_port *port)
 {
         struct opticon_private *priv = usb_get_serial_data(port->serial);
         unsigned long flags;
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index c784ddbe7b61..f66e39883218 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -45,8 +45,7 @@
 /* Function prototypes */
 static int  option_probe(struct usb_serial *serial,
                         const struct usb_device_id *id);
-static int  option_open(struct tty_struct *tty, struct usb_serial_port *port,
-                                                        struct file *filp);
+static int  option_open(struct tty_struct *tty, struct usb_serial_port *port);
 static void option_close(struct usb_serial_port *port);
 static void option_dtr_rts(struct usb_serial_port *port, int on);
 
@@ -292,6 +291,7 @@ static int  option_resume(struct usb_serial *serial);
 
 #define TELIT_VENDOR_ID                         0x1bc7
 #define TELIT_PRODUCT_UC864E                    0x1003
+#define TELIT_PRODUCT_UC864G                    0x1004
 
 /* ZTE PRODUCTS */
 #define ZTE_VENDOR_ID                           0x19d2
@@ -300,6 +300,7 @@ static int  option_resume(struct usb_serial *serial);
 #define ZTE_PRODUCT_MF626                       0x0031
 #define ZTE_PRODUCT_CDMA_TECH                   0xfffe
 #define ZTE_PRODUCT_AC8710                      0xfff1
+#define ZTE_PRODUCT_AC2726                      0xfff5
 
 #define BENQ_VENDOR_ID                          0x04a5
 #define BENQ_PRODUCT_H10                        0x4068
@@ -503,6 +504,7 @@ static struct usb_device_id option_ids[] = {
         { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x6613)}, /* Onda H600/ZTE MF330 */
         { USB_DEVICE(MAXON_VENDOR_ID, 0x6280) }, /* BP3-USB & BP3-EXT HSDPA */
         { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_UC864E) },
+        { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_UC864G) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MF622, 0xff, 0xff, 0xff) }, /* ZTE WCDMA products */
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0002, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0003, 0xff, 0xff, 0xff) },
@@ -572,6 +574,7 @@ static struct usb_device_id option_ids[] = {
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0073, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_CDMA_TECH, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_AC8710, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_AC2726, 0xff, 0xff, 0xff) },
         { USB_DEVICE(BENQ_VENDOR_ID, BENQ_PRODUCT_H10) },
         { USB_DEVICE(DLINK_VENDOR_ID, DLINK_PRODUCT_DWM_652) },
         { USB_DEVICE(QISDA_VENDOR_ID, QISDA_PRODUCT_H21_4512) },
@@ -593,6 +596,7 @@ static struct usb_driver option_driver = {
 #ifdef CONFIG_PM
         .suspend    = usb_serial_suspend,
         .resume     = usb_serial_resume,
+        .supports_autosuspend = 1,
 #endif
         .id_table   = option_ids,
         .no_dynamic_id =        1,
@@ -640,6 +644,12 @@ static int debug;
 #define IN_BUFLEN 4096
 #define OUT_BUFLEN 4096
 
+struct option_intf_private {
+        spinlock_t susp_lock;
+        unsigned int suspended:1;
+        int in_flight;
+};
+
 struct option_port_private {
         /* Input endpoints and buffer for this port */
         struct urb *in_urbs[N_IN_URB];
@@ -648,6 +658,8 @@ struct option_port_private {
         struct urb *out_urbs[N_OUT_URB];
         u8 *out_buffer[N_OUT_URB];
         unsigned long out_busy;         /* Bit vector of URBs in use */
+        int opened;
+        struct usb_anchor delayed;
 
         /* Settings for the port */
         int rts_state;  /* Handshaking pins (outputs) */
@@ -694,12 +706,17 @@ module_exit(option_exit);
 static int option_probe(struct usb_serial *serial,
                         const struct usb_device_id *id)
 {
+        struct option_intf_private *data;
         /* D-Link DWM 652 still exposes CD-Rom emulation interface in modem mode */
         if (serial->dev->descriptor.idVendor == DLINK_VENDOR_ID &&
                 serial->dev->descriptor.idProduct == DLINK_PRODUCT_DWM_652 &&
                 serial->interface->cur_altsetting->desc.bInterfaceClass == 0x8)
                 return -ENODEV;
 
+        data = serial->private = kzalloc(sizeof(struct option_intf_private), GFP_KERNEL);
+        if (!data)
+                return -ENOMEM;
+        spin_lock_init(&data->susp_lock);
         return 0;
 }
 
@@ -756,12 +773,15 @@ static int option_write(struct tty_struct *tty, struct usb_serial_port *port,
                         const unsigned char *buf, int count)
 {
         struct option_port_private *portdata;
+        struct option_intf_private *intfdata;
         int i;
         int left, todo;
         struct urb *this_urb = NULL; /* spurious */
         int err;
+        unsigned long flags;
 
         portdata = usb_get_serial_port_data(port);
+        intfdata = port->serial->private;
 
         dbg("%s: write (%d chars)", __func__, count);
 
@@ -783,17 +803,33 @@ static int option_write(struct tty_struct *tty, struct usb_serial_port *port,
                 dbg("%s: endpoint %d buf %d", __func__,
                         usb_pipeendpoint(this_urb->pipe), i);
 
+                err = usb_autopm_get_interface_async(port->serial->interface);
+                if (err < 0)
+                        break;
+
                 /* send the data */
                 memcpy(this_urb->transfer_buffer, buf, todo);
                 this_urb->transfer_buffer_length = todo;
 
-                err = usb_submit_urb(this_urb, GFP_ATOMIC);
-                if (err) {
-                        dbg("usb_submit_urb %p (write bulk) failed "
-                                "(%d)", this_urb, err);
-                        clear_bit(i, &portdata->out_busy);
-                        continue;
+                spin_lock_irqsave(&intfdata->susp_lock, flags);
+                if (intfdata->suspended) {
+                        usb_anchor_urb(this_urb, &portdata->delayed);
+                        spin_unlock_irqrestore(&intfdata->susp_lock, flags);
+                } else {
+                        intfdata->in_flight++;
+                        spin_unlock_irqrestore(&intfdata->susp_lock, flags);
+                        err = usb_submit_urb(this_urb, GFP_ATOMIC);
+                        if (err) {
+                                dbg("usb_submit_urb %p (write bulk) failed "
+                                        "(%d)", this_urb, err);
+                                clear_bit(i, &portdata->out_busy);
+                                spin_lock_irqsave(&intfdata->susp_lock, flags);
+                                intfdata->in_flight--;
+                                spin_unlock_irqrestore(&intfdata->susp_lock, flags);
+                                continue;
+                        }
                 }
+
                 portdata->tx_start_time[i] = jiffies;
                 buf += todo;
                 left -= todo;
@@ -837,7 +873,10 @@ static void option_indat_callback(struct urb *urb)
                         if (err)
                                 printk(KERN_ERR "%s: resubmit read urb failed. "
                                         "(%d)", __func__, err);
+                        else
+                                usb_mark_last_busy(port->serial->dev);
                 }
+
         }
         return;
 }
@@ -846,15 +885,21 @@ static void option_outdat_callback(struct urb *urb)
 {
         struct usb_serial_port *port;
         struct option_port_private *portdata;
+        struct option_intf_private *intfdata;
         int i;
 
         dbg("%s", __func__);
 
         port =  urb->context;
+        intfdata = port->serial->private;
 
         usb_serial_port_softint(port);
-
+        usb_autopm_put_interface_async(port->serial->interface);
         portdata = usb_get_serial_port_data(port);
+        spin_lock(&intfdata->susp_lock);
+        intfdata->in_flight--;
+        spin_unlock(&intfdata->susp_lock);
+
         for (i = 0; i < N_OUT_URB; ++i) {
                 if (portdata->out_urbs[i] == urb) {
                         smp_mb__before_clear_bit();
@@ -961,14 +1006,16 @@ static int option_chars_in_buffer(struct tty_struct *tty)
         return data_len;
 }
 
-static int option_open(struct tty_struct *tty,
-                        struct usb_serial_port *port, struct file *filp)
+static int option_open(struct tty_struct *tty, struct usb_serial_port *port)
 {
         struct option_port_private *portdata;
+        struct option_intf_private *intfdata;
+        struct usb_serial *serial = port->serial;
         int i, err;
         struct urb *urb;
 
         portdata = usb_get_serial_port_data(port);
+        intfdata = serial->private;
 
         dbg("%s", __func__);
 
@@ -987,6 +1034,12 @@ static int option_open(struct tty_struct *tty,
 
         option_send_setup(port);
 
+        serial->interface->needs_remote_wakeup = 1;
+        spin_lock_irq(&intfdata->susp_lock);
+        portdata->opened = 1;
+        spin_unlock_irq(&intfdata->susp_lock);
+        usb_autopm_put_interface(serial->interface);
+
         return 0;
 }
 
@@ -1011,16 +1064,23 @@ static void option_close(struct usb_serial_port *port)
         int i;
         struct usb_serial *serial = port->serial;
         struct option_port_private *portdata;
+        struct option_intf_private *intfdata = port->serial->private;
 
         dbg("%s", __func__);
         portdata = usb_get_serial_port_data(port);
 
         if (serial->dev) {
                 /* Stop reading/writing urbs */
+                spin_lock_irq(&intfdata->susp_lock);
+                portdata->opened = 0;
+                spin_unlock_irq(&intfdata->susp_lock);
+
                 for (i = 0; i < N_IN_URB; i++)
                         usb_kill_urb(portdata->in_urbs[i]);
                 for (i = 0; i < N_OUT_URB; i++)
                         usb_kill_urb(portdata->out_urbs[i]);
+                usb_autopm_get_interface(serial->interface);
+                serial->interface->needs_remote_wakeup = 0;
         }
 }
 
@@ -1125,6 +1185,7 @@ static int option_startup(struct usb_serial *serial)
                                         __func__, i);
                         return 1;
                 }
+                init_usb_anchor(&portdata->delayed);
 
                 for (j = 0; j < N_IN_URB; j++) {
                         buffer = (u8 *)__get_free_page(GFP_KERNEL);
@@ -1227,18 +1288,52 @@ static void option_release(struct usb_serial *serial)
 #ifdef CONFIG_PM
 static int option_suspend(struct usb_serial *serial, pm_message_t message)
 {
+        struct option_intf_private *intfdata = serial->private;
+        int b;
+
         dbg("%s entered", __func__);
+
+        if (serial->dev->auto_pm) {
+                spin_lock_irq(&intfdata->susp_lock);
+                b = intfdata->in_flight;
+                spin_unlock_irq(&intfdata->susp_lock);
+
+                if (b)
+                        return -EBUSY;
+        }
+
+        spin_lock_irq(&intfdata->susp_lock);
+        intfdata->suspended = 1;
+        spin_unlock_irq(&intfdata->susp_lock);
         stop_read_write_urbs(serial);
 
         return 0;
 }
 
+static void play_delayed(struct usb_serial_port *port)
+{
+        struct option_intf_private *data;
+        struct option_port_private *portdata;
+        struct urb *urb;
+        int err;
+
+        portdata = usb_get_serial_port_data(port);
+        data = port->serial->private;
+        while ((urb = usb_get_from_anchor(&portdata->delayed))) {
+                err = usb_submit_urb(urb, GFP_ATOMIC);
+                if (!err)
+                        data->in_flight++;
+        }
+}
+
 static int option_resume(struct usb_serial *serial)
 {
-        int err, i, j;
+        int i, j;
         struct usb_serial_port *port;
-        struct urb *urb;
+        struct option_intf_private *intfdata = serial->private;
         struct option_port_private *portdata;
+        struct urb *urb;
+        int err = 0;
 
         dbg("%s entered", __func__);
         /* get the interrupt URBs resubmitted unconditionally */
@@ -1253,7 +1348,7 @@ static int option_resume(struct usb_serial *serial)
                 if (err < 0) {
                         err("%s: Error %d for interrupt URB of port%d",
                                  __func__, err, i);
-                        return err;
+                        goto err_out;
                 }
         }
 
@@ -1261,27 +1356,32 @@ static int option_resume(struct usb_serial *serial)
                 /* walk all ports */
                 port = serial->port[i];
                 portdata = usb_get_serial_port_data(port);
-                mutex_lock(&port->mutex);
 
                 /* skip closed ports */
-                if (!port->port.count) {
-                        mutex_unlock(&port->mutex);
+                spin_lock_irq(&intfdata->susp_lock);
+                if (!portdata->opened) {
+                        spin_unlock_irq(&intfdata->susp_lock);
                         continue;
                 }
 
                 for (j = 0; j < N_IN_URB; j++) {
                         urb = portdata->in_urbs[j];
-                        err = usb_submit_urb(urb, GFP_NOIO);
+                        err = usb_submit_urb(urb, GFP_ATOMIC);
                         if (err < 0) {
-                                mutex_unlock(&port->mutex);
                                 err("%s: Error %d for bulk URB %d",
                                          __func__, err, i);
-                                return err;
+                                spin_unlock_irq(&intfdata->susp_lock);
+                                goto err_out;
                         }
                 }
-                mutex_unlock(&port->mutex);
+                play_delayed(port);
+                spin_unlock_irq(&intfdata->susp_lock);
         }
-        return 0;
+        spin_lock_irq(&intfdata->susp_lock);
+        intfdata->suspended = 0;
+        spin_unlock_irq(&intfdata->susp_lock);
+err_out:
+        return err;
 }
 #endif
 
diff --git a/drivers/usb/serial/oti6858.c b/drivers/usb/serial/oti6858.c
index 3cece27325e7..0f4a70ce3823 100644
--- a/drivers/usb/serial/oti6858.c
+++ b/drivers/usb/serial/oti6858.c
@@ -141,11 +141,11 @@ struct oti6858_control_pkt {
           && ((a)->frame_fmt == (priv)->pending_setup.frame_fmt))
 
 /* function prototypes */
-static int oti6858_open(struct tty_struct *tty,
-                        struct usb_serial_port *port, struct file *filp);
+static int oti6858_open(struct tty_struct *tty, struct usb_serial_port *port);
 static void oti6858_close(struct usb_serial_port *port);
 static void oti6858_set_termios(struct tty_struct *tty,
                         struct usb_serial_port *port, struct ktermios *old);
+static void oti6858_init_termios(struct tty_struct *tty);
 static int oti6858_ioctl(struct tty_struct *tty, struct file *file,
                         unsigned int cmd, unsigned long arg);
 static void oti6858_read_int_callback(struct urb *urb);
@@ -186,6 +186,7 @@ static struct usb_serial_driver oti6858_device = {
         .write =                oti6858_write,
         .ioctl =                oti6858_ioctl,
         .set_termios =          oti6858_set_termios,
+        .init_termios =         oti6858_init_termios,
         .tiocmget =             oti6858_tiocmget,
         .tiocmset =             oti6858_tiocmset,
         .read_bulk_callback =   oti6858_read_bulk_callback,
@@ -206,7 +207,6 @@ struct oti6858_private {
         struct {
                 u8 read_urb_in_use;
                 u8 write_urb_in_use;
-                u8 termios_initialized;
         } flags;
         struct delayed_work delayed_write_work;
 
@@ -447,6 +447,14 @@ static int oti6858_chars_in_buffer(struct tty_struct *tty)
         return chars;
 }
 
+static void oti6858_init_termios(struct tty_struct *tty)
+{
+        *(tty->termios) = tty_std_termios;
+        tty->termios->c_cflag = B38400 | CS8 | CREAD | HUPCL | CLOCAL;
+        tty->termios->c_ispeed = 38400;
+        tty->termios->c_ospeed = 38400;
+}
+
 static void oti6858_set_termios(struct tty_struct *tty,
                 struct usb_serial_port *port, struct ktermios *old_termios)
 {
@@ -464,16 +472,6 @@ static void oti6858_set_termios(struct tty_struct *tty,
                 return;
         }
 
-        spin_lock_irqsave(&priv->lock, flags);
-        if (!priv->flags.termios_initialized) {
-                *(tty->termios) = tty_std_termios;
-                tty->termios->c_cflag = B38400 | CS8 | CREAD | HUPCL | CLOCAL;
-                tty->termios->c_ispeed = 38400;
-                tty->termios->c_ospeed = 38400;
-                priv->flags.termios_initialized = 1;
-        }
-        spin_unlock_irqrestore(&priv->lock, flags);
-
         cflag = tty->termios->c_cflag;
 
         spin_lock_irqsave(&priv->lock, flags);
@@ -566,8 +564,7 @@ static void oti6858_set_termios(struct tty_struct *tty,
         spin_unlock_irqrestore(&priv->lock, flags);
 }
 
-static int oti6858_open(struct tty_struct *tty,
-                        struct usb_serial_port *port, struct file *filp)
+static int oti6858_open(struct tty_struct *tty, struct usb_serial_port *port)
 {
         struct oti6858_private *priv = usb_get_serial_port_data(port);
         struct ktermios tmp_termios;
diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c
index 3e86815b2705..1128e01525b1 100644
--- a/drivers/usb/serial/pl2303.c
+++ b/drivers/usb/serial/pl2303.c
@@ -96,6 +96,7 @@ static struct usb_device_id id_table [] = {
         { USB_DEVICE(HP_VENDOR_ID, HP_LD220_PRODUCT_ID) },
         { USB_DEVICE(CRESSI_VENDOR_ID, CRESSI_EDY_PRODUCT_ID) },
         { USB_DEVICE(SONY_VENDOR_ID, SONY_QN3USB_PRODUCT_ID) },
+        { USB_DEVICE(SANWA_VENDOR_ID, SANWA_PRODUCT_ID) },
         { }                                     /* Terminating entry */
 };
 
@@ -527,6 +528,12 @@ static void pl2303_set_termios(struct tty_struct *tty,
         int baud;
         int i;
         u8 control;
+        const int baud_sup[] = { 75, 150, 300, 600, 1200, 1800, 2400, 3600,
+                                 4800, 7200, 9600, 14400, 19200, 28800, 38400,
+                                 57600, 115200, 230400, 460800, 614400,
+                                 921600, 1228800, 2457600, 3000000, 6000000 };
+        int baud_floor, baud_ceil;
+        int k;
 
         dbg("%s -  port %d", __func__, port->number);
 
@@ -572,9 +579,39 @@ static void pl2303_set_termios(struct tty_struct *tty,
                 dbg("%s - data bits = %d", __func__, buf[6]);
         }
 
+        /* For reference buf[0]:buf[3] baud rate value */
+        /* NOTE: Only the values defined in baud_sup are supported !
+         *       => if unsupported values are set, the PL2303 seems to use
+         *          9600 baud (at least my PL2303X always does)
+         */
         baud = tty_get_baud_rate(tty);
-        dbg("%s - baud = %d", __func__, baud);
+        dbg("%s - baud requested = %d", __func__, baud);
         if (baud) {
+                /* Set baudrate to nearest supported value */
+                for (k=0; k<ARRAY_SIZE(baud_sup); k++) {
+                        if (baud_sup[k] / baud) {
+                                baud_ceil = baud_sup[k];
+                                if (k==0) {
+                                        baud = baud_ceil;
+                                } else {
+                                        baud_floor = baud_sup[k-1];
+                                        if ((baud_ceil % baud)
+                                            > (baud % baud_floor))
+                                                baud = baud_floor;
+                                        else
+                                                baud = baud_ceil;
+                                }
+                                break;
+                        }
+                }
+                if (baud > 1228800) {
+                        /* type_0, type_1 only support up to 1228800 baud */
+                        if (priv->type != HX)
+                                baud = 1228800;
+                        else if (baud > 6000000)
+                                baud = 6000000;
+                }
+                dbg("%s - baud set = %d", __func__, baud);
                 buf[0] = baud & 0xff;
                 buf[1] = (baud >> 8) & 0xff;
                 buf[2] = (baud >> 16) & 0xff;
@@ -585,8 +622,16 @@ static void pl2303_set_termios(struct tty_struct *tty,
         /* For reference buf[4]=1 is 1.5 stop bits */
         /* For reference buf[4]=2 is 2 stop bits */
         if (cflag & CSTOPB) {
-                buf[4] = 2;
-                dbg("%s - stop bits = 2", __func__);
+                /* NOTE: Comply with "real" UARTs / RS232:
+                 *       use 1.5 instead of 2 stop bits with 5 data bits
+                 */
+                if ((cflag & CSIZE) == CS5) {
+                        buf[4] = 1;
+                        dbg("%s - stop bits = 1.5", __func__);
+                } else {
+                        buf[4] = 2;
+                        dbg("%s - stop bits = 2", __func__);
+                }
         } else {
                 buf[4] = 0;
                 dbg("%s - stop bits = 1", __func__);
@@ -599,11 +644,21 @@ static void pl2303_set_termios(struct tty_struct *tty,
                 /* For reference buf[5]=3 is mark parity */
                 /* For reference buf[5]=4 is space parity */
                 if (cflag & PARODD) {
-                        buf[5] = 1;
-                        dbg("%s - parity = odd", __func__);
+                        if (cflag & CMSPAR) {
+                                buf[5] = 3;
+                                dbg("%s - parity = mark", __func__);
+                        } else {
+                                buf[5] = 1;
+                                dbg("%s - parity = odd", __func__);
+                        }
                 } else {
-                        buf[5] = 2;
-                        dbg("%s - parity = even", __func__);
+                        if (cflag & CMSPAR) {
+                                buf[5] = 4;
+                                dbg("%s - parity = space", __func__);
+                        } else {
+                                buf[5] = 2;
+                                dbg("%s - parity = even", __func__);
+                        }
                 }
         } else {
                 buf[5] = 0;
@@ -647,7 +702,7 @@ static void pl2303_set_termios(struct tty_struct *tty,
                 pl2303_vendor_write(0x0, 0x0, serial);
         }
 
-        /* FIXME: Need to read back resulting baud rate */
+        /* Save resulting baud rate */
         if (baud)
                 tty_encode_baud_rate(tty, baud, baud);
 
@@ -691,8 +746,7 @@ static void pl2303_close(struct usb_serial_port *port)
 
 }
 
-static int pl2303_open(struct tty_struct *tty,
-                        struct usb_serial_port *port, struct file *filp)
+static int pl2303_open(struct tty_struct *tty, struct usb_serial_port *port)
 {
         struct ktermios tmp_termios;
         struct usb_serial *serial = port->serial;
@@ -714,8 +768,6 @@ static int pl2303_open(struct tty_struct *tty,
         if (tty)
                 pl2303_set_termios(tty, port, &tmp_termios);
 
-        /* FIXME: need to assert RTS and DTR if CRTSCTS off */
-
         dbg("%s - submitting read urb", __func__);
         port->read_urb->dev = serial->dev;
         result = usb_submit_urb(port->read_urb, GFP_KERNEL);
diff --git a/drivers/usb/serial/pl2303.h b/drivers/usb/serial/pl2303.h
index ee9505e1dd92..d640dc951568 100644
--- a/drivers/usb/serial/pl2303.h
+++ b/drivers/usb/serial/pl2303.h
@@ -130,3 +130,7 @@
 /* Sony, USB data cable for CMD-Jxx mobile phones */
 #define SONY_VENDOR_ID          0x054c
 #define SONY_QN3USB_PRODUCT_ID  0x0437
+
+/* Sanwa KB-USB2 multimeter cable (ID: 11ad:0001) */
+#define SANWA_VENDOR_ID         0x11ad
+#define SANWA_PRODUCT_ID        0x0001
diff --git a/drivers/usb/serial/sierra.c b/drivers/usb/serial/sierra.c
index f48d05e0acc1..8c075b2416bb 100644
--- a/drivers/usb/serial/sierra.c
+++ b/drivers/usb/serial/sierra.c
@@ -51,6 +51,12 @@ struct sierra_iface_info {
         const u8  *ifaceinfo;   /* pointer to the array holding the numbers */
 };
 
+struct sierra_intf_private {
+        spinlock_t susp_lock;
+        unsigned int suspended:1;
+        int in_flight;
+};
+
 static int sierra_set_power_state(struct usb_device *udev, __u16 swiState)
 {
         int result;
@@ -144,6 +150,7 @@ static int sierra_probe(struct usb_serial *serial,
 {
         int result = 0;
         struct usb_device *udev;
+        struct sierra_intf_private *data;
         u8 ifnum;
 
         udev = serial->dev;
@@ -171,6 +178,11 @@ static int sierra_probe(struct usb_serial *serial,
                 return -ENODEV;
         }
 
+        data = serial->private = kzalloc(sizeof(struct sierra_intf_private), GFP_KERNEL);
+        if (!data)
+                return -ENOMEM;
+        spin_lock_init(&data->susp_lock);
+
         return result;
 }
 
@@ -261,13 +273,18 @@ static struct usb_driver sierra_driver = {
         .name       = "sierra",
         .probe      = usb_serial_probe,
         .disconnect = usb_serial_disconnect,
+        .suspend    = usb_serial_suspend,
+        .resume     = usb_serial_resume,
         .id_table   = id_table,
         .no_dynamic_id =        1,
+        .supports_autosuspend = 1,
 };
 
 struct sierra_port_private {
         spinlock_t lock;        /* lock the structure */
         int outstanding_urbs;   /* number of out urbs in flight */
+        struct usb_anchor active;
+        struct usb_anchor delayed;
 
         /* Input endpoints and buffers for this port */
         struct urb *in_urbs[N_IN_URB];
@@ -279,6 +296,8 @@ struct sierra_port_private {
         int dsr_state;
         int dcd_state;
         int ri_state;
+
+        unsigned int opened:1;
 };
 
 static int sierra_send_setup(struct usb_serial_port *port)
@@ -390,21 +409,25 @@ static void sierra_outdat_callback(struct urb *urb)
 {
         struct usb_serial_port *port = urb->context;
         struct sierra_port_private *portdata = usb_get_serial_port_data(port);
+        struct sierra_intf_private *intfdata;
         int status = urb->status;
-        unsigned long flags;
 
         dev_dbg(&port->dev, "%s - port %d\n", __func__, port->number);
+        intfdata = port->serial->private;
 
         /* free up the transfer buffer, as usb_free_urb() does not do this */
         kfree(urb->transfer_buffer);
-
+        usb_autopm_put_interface_async(port->serial->interface);
         if (status)
                 dev_dbg(&port->dev, "%s - nonzero write bulk status "
                     "received: %d\n", __func__, status);
 
-        spin_lock_irqsave(&portdata->lock, flags);
+        spin_lock(&portdata->lock);
         --portdata->outstanding_urbs;
-        spin_unlock_irqrestore(&portdata->lock, flags);
+        spin_unlock(&portdata->lock);
+        spin_lock(&intfdata->susp_lock);
+        --intfdata->in_flight;
+        spin_unlock(&intfdata->susp_lock);
 
         usb_serial_port_softint(port);
 }
@@ -414,6 +437,7 @@ static int sierra_write(struct tty_struct *tty, struct usb_serial_port *port,
                                         const unsigned char *buf, int count)
 {
         struct sierra_port_private *portdata = usb_get_serial_port_data(port);
+        struct sierra_intf_private *intfdata;
         struct usb_serial *serial = port->serial;
         unsigned long flags;
         unsigned char *buffer;
@@ -426,9 +450,9 @@ static int sierra_write(struct tty_struct *tty, struct usb_serial_port *port,
                 return 0;
 
         portdata = usb_get_serial_port_data(port);
+        intfdata = serial->private;
 
         dev_dbg(&port->dev, "%s: write (%zd bytes)\n", __func__, writesize);
-
         spin_lock_irqsave(&portdata->lock, flags);
         dev_dbg(&port->dev, "%s - outstanding_urbs: %d\n", __func__,
                 portdata->outstanding_urbs);
@@ -442,6 +466,14 @@ static int sierra_write(struct tty_struct *tty, struct usb_serial_port *port,
                 portdata->outstanding_urbs);
         spin_unlock_irqrestore(&portdata->lock, flags);
 
+        retval = usb_autopm_get_interface_async(serial->interface);
+        if (retval < 0) {
+                spin_lock_irqsave(&portdata->lock, flags);
+                portdata->outstanding_urbs--;
+                spin_unlock_irqrestore(&portdata->lock, flags);
+                goto error_simple;
+        }
+
         buffer = kmalloc(writesize, GFP_ATOMIC);
         if (!buffer) {
                 dev_err(&port->dev, "out of memory\n");
@@ -468,14 +500,29 @@ static int sierra_write(struct tty_struct *tty, struct usb_serial_port *port,
         /* Handle the need to send a zero length packet */
         urb->transfer_flags |= URB_ZERO_PACKET;
 
+        spin_lock_irqsave(&intfdata->susp_lock, flags);
+
+        if (intfdata->suspended) {
+                usb_anchor_urb(urb, &portdata->delayed);
+                spin_unlock_irqrestore(&intfdata->susp_lock, flags);
+                goto skip_power;
+        } else {
+                usb_anchor_urb(urb, &portdata->active);
+        }
         /* send it down the pipe */
         retval = usb_submit_urb(urb, GFP_ATOMIC);
         if (retval) {
+                usb_unanchor_urb(urb);
+                spin_unlock_irqrestore(&intfdata->susp_lock, flags);
                 dev_err(&port->dev, "%s - usb_submit_urb(write bulk) failed "
                         "with status = %d\n", __func__, retval);
                 goto error;
+        } else {
+                intfdata->in_flight++;
+                spin_unlock_irqrestore(&intfdata->susp_lock, flags);
         }
 
+skip_power:
         /* we are done with this urb, so let the host driver
          * really free it when it is finished with it */
         usb_free_urb(urb);
@@ -491,6 +538,8 @@ error_no_buffer:
         dev_dbg(&port->dev, "%s - 2. outstanding_urbs: %d\n", __func__,
                 portdata->outstanding_urbs);
         spin_unlock_irqrestore(&portdata->lock, flags);
+        usb_autopm_put_interface_async(serial->interface);
+error_simple:
         return retval;
 }
 
@@ -530,6 +579,7 @@ static void sierra_indat_callback(struct urb *urb)
 
         /* Resubmit urb so we continue receiving */
         if (port->port.count && status != -ESHUTDOWN && status != -EPERM) {
+                usb_mark_last_busy(port->serial->dev);
                 err = usb_submit_urb(urb, GFP_ATOMIC);
                 if (err)
                         dev_err(&port->dev, "resubmit read urb failed."
@@ -591,6 +641,7 @@ static void sierra_instat_callback(struct urb *urb)
 
         /* Resubmit urb so we continue receiving IRQ data */
         if (port->port.count && status != -ESHUTDOWN && status != -ENOENT) {
+                usb_mark_last_busy(serial->dev);
                 urb->dev = serial->dev;
                 err = usb_submit_urb(urb, GFP_ATOMIC);
                 if (err)
@@ -711,6 +762,8 @@ static void sierra_close(struct usb_serial_port *port)
         int i;
         struct usb_serial *serial = port->serial;
         struct sierra_port_private *portdata;
+        struct sierra_intf_private *intfdata = port->serial->private;
+
 
         dev_dbg(&port->dev, "%s\n", __func__);
         portdata = usb_get_serial_port_data(port);
@@ -723,6 +776,10 @@ static void sierra_close(struct usb_serial_port *port)
                 if (!serial->disconnected)
                         sierra_send_setup(port);
                 mutex_unlock(&serial->disc_mutex);
+                spin_lock_irq(&intfdata->susp_lock);
+                portdata->opened = 0;
+                spin_unlock_irq(&intfdata->susp_lock);
+
 
                 /* Stop reading urbs */
                 sierra_stop_rx_urbs(port);
@@ -731,14 +788,16 @@ static void sierra_close(struct usb_serial_port *port)
                         sierra_release_urb(portdata->in_urbs[i]);
                         portdata->in_urbs[i] = NULL;
                 }
+                usb_autopm_get_interface(serial->interface);
+                serial->interface->needs_remote_wakeup = 0;
         }
 }
 
-static int sierra_open(struct tty_struct *tty,
-                        struct usb_serial_port *port, struct file *filp)
+static int sierra_open(struct tty_struct *tty, struct usb_serial_port *port)
 {
         struct sierra_port_private *portdata;
         struct usb_serial *serial = port->serial;
+        struct sierra_intf_private *intfdata = serial->private;
         int i;
         int err;
         int endpoint;
@@ -772,6 +831,12 @@ static int sierra_open(struct tty_struct *tty,
         }
         sierra_send_setup(port);
 
+        serial->interface->needs_remote_wakeup = 1;
+        spin_lock_irq(&intfdata->susp_lock);
+        portdata->opened = 1;
+        spin_unlock_irq(&intfdata->susp_lock);
+        usb_autopm_put_interface(serial->interface);
+
         return 0;
 }
 
@@ -819,6 +884,8 @@ static int sierra_startup(struct usb_serial *serial)
                         return -ENOMEM;
                 }
                 spin_lock_init(&portdata->lock);
+                init_usb_anchor(&portdata->active);
+                init_usb_anchor(&portdata->delayed);
                 /* Set the port private data pointer */
                 usb_set_serial_port_data(port, portdata);
         }
@@ -845,6 +912,88 @@ static void sierra_release(struct usb_serial *serial)
         }
 }
 
+#ifdef CONFIG_PM
+static void stop_read_write_urbs(struct usb_serial *serial)
+{
+        int i, j;
+        struct usb_serial_port *port;
+        struct sierra_port_private *portdata;
+
+        /* Stop reading/writing urbs */
+        for (i = 0; i < serial->num_ports; ++i) {
+                port = serial->port[i];
+                portdata = usb_get_serial_port_data(port);
+                for (j = 0; j < N_IN_URB; j++)
+                        usb_kill_urb(portdata->in_urbs[j]);
+                usb_kill_anchored_urbs(&portdata->active);
+        }
+}
+
+static int sierra_suspend(struct usb_serial *serial, pm_message_t message)
+{
+        struct sierra_intf_private *intfdata;
+        int b;
+
+        if (serial->dev->auto_pm) {
+                intfdata = serial->private;
+                spin_lock_irq(&intfdata->susp_lock);
+                b = intfdata->in_flight;
+
+                if (b) {
+                        spin_unlock_irq(&intfdata->susp_lock);
+                        return -EBUSY;
+                } else {
+                        intfdata->suspended = 1;
+                        spin_unlock_irq(&intfdata->susp_lock);
+                }
+        }
+        stop_read_write_urbs(serial);
+
+        return 0;
+}
+
+static int sierra_resume(struct usb_serial *serial)
+{
+        struct usb_serial_port *port;
+        struct sierra_intf_private *intfdata = serial->private;
+        struct sierra_port_private *portdata;
+        struct urb *urb;
+        int ec = 0;
+        int i, err;
+
+        spin_lock_irq(&intfdata->susp_lock);
+        for (i = 0; i < serial->num_ports; i++) {
+                port = serial->port[i];
+                portdata = usb_get_serial_port_data(port);
+
+                while ((urb = usb_get_from_anchor(&portdata->delayed))) {
+                        usb_anchor_urb(urb, &portdata->active);
+                        intfdata->in_flight++;
+                        err = usb_submit_urb(urb, GFP_ATOMIC);
+                        if (err < 0) {
+                                intfdata->in_flight--;
+                                usb_unanchor_urb(urb);
+                                usb_scuttle_anchored_urbs(&portdata->delayed);
+                                break;
+                        }
+                }
+
+                if (portdata->opened) {
+                        err = sierra_submit_rx_urbs(port, GFP_ATOMIC);
+                        if (err)
+                                ec++;
+                }
+        }
+        intfdata->suspended = 0;
+        spin_unlock_irq(&intfdata->susp_lock);
+
+        return ec ? -EIO : 0;
+}
+#else
+#define sierra_suspend NULL
+#define sierra_resume NULL
+#endif
+
 static struct usb_serial_driver sierra_device = {
         .driver = {
                 .owner =        THIS_MODULE,
@@ -865,6 +1014,8 @@ static struct usb_serial_driver sierra_device = {
         .tiocmset          = sierra_tiocmset,
         .attach            = sierra_startup,
         .release           = sierra_release,
+        .suspend           = sierra_suspend,
+        .resume            = sierra_resume,
         .read_int_callback = sierra_instat_callback,
 };
 
diff --git a/drivers/usb/serial/spcp8x5.c b/drivers/usb/serial/spcp8x5.c
index 3c249d8e8b8e..1e58220403d1 100644
--- a/drivers/usb/serial/spcp8x5.c
+++ b/drivers/usb/serial/spcp8x5.c
@@ -299,7 +299,6 @@ struct spcp8x5_private {
         wait_queue_head_t       delta_msr_wait;
         u8                      line_control;
         u8                      line_status;
-        u8                      termios_initialized;
 };
 
 /* desc : when device plug in,this function would be called.
@@ -498,6 +497,15 @@ static void spcp8x5_close(struct usb_serial_port *port)
                 dev_dbg(&port->dev, "usb_unlink_urb(read_urb) = %d\n", result);
 }
 
+static void spcp8x5_init_termios(struct tty_struct *tty)
+{
+        /* for the 1st time call this function */
+        *(tty->termios) = tty_std_termios;
+        tty->termios->c_cflag = B115200 | CS8 | CREAD | HUPCL | CLOCAL;
+        tty->termios->c_ispeed = 115200;
+        tty->termios->c_ospeed = 115200;
+}
+
 /* set the serial param for transfer. we should check if we really need to
  * transfer. if we set flow control we should do this too. */
 static void spcp8x5_set_termios(struct tty_struct *tty,
@@ -514,16 +522,6 @@ static void spcp8x5_set_termios(struct tty_struct *tty,
         int i;
         u8 control;
 
-        /* for the 1st time call this function */
-        spin_lock_irqsave(&priv->lock, flags);
-        if (!priv->termios_initialized) {
-                *(tty->termios) = tty_std_termios;
-                tty->termios->c_cflag = B115200 | CS8 | CREAD | HUPCL | CLOCAL;
-                tty->termios->c_ispeed = 115200;
-                tty->termios->c_ospeed = 115200;
-                priv->termios_initialized = 1;
-        }
-        spin_unlock_irqrestore(&priv->lock, flags);
 
         /* check that they really want us to change something */
         if (!tty_termios_hw_change(tty->termios, old_termios))
@@ -546,7 +544,7 @@ static void spcp8x5_set_termios(struct tty_struct *tty,
         }
 
         /* Set Baud Rate */
-        baud = tty_get_baud_rate(tty);;
+        baud = tty_get_baud_rate(tty);
         switch (baud) {
         case 300:       buf[0] = 0x00;  break;
         case 600:       buf[0] = 0x01;  break;
@@ -623,8 +621,7 @@ static void spcp8x5_set_termios(struct tty_struct *tty,
 
 /* open the serial port. do some usb system call. set termios and get the line
  * status of the device. then submit the read urb */
-static int spcp8x5_open(struct tty_struct *tty,
-                        struct usb_serial_port *port, struct file *filp)
+static int spcp8x5_open(struct tty_struct *tty, struct usb_serial_port *port)
 {
         struct ktermios tmp_termios;
         struct usb_serial *serial = port->serial;
@@ -658,8 +655,6 @@ static int spcp8x5_open(struct tty_struct *tty,
         priv->line_status = status & 0xf0 ;
         spin_unlock_irqrestore(&priv->lock, flags);
 
-        /* FIXME: need to assert RTS and DTR if CRTSCTS off */
-
         dbg("%s - submitting read urb", __func__);
         port->read_urb->dev = serial->dev;
         ret = usb_submit_urb(port->read_urb, GFP_KERNEL);
@@ -1011,6 +1006,7 @@ static struct usb_serial_driver spcp8x5_device = {
         .carrier_raised         = spcp8x5_carrier_raised,
         .write                  = spcp8x5_write,
         .set_termios            = spcp8x5_set_termios,
+        .init_termios           = spcp8x5_init_termios,
         .ioctl                  = spcp8x5_ioctl,
         .tiocmget               = spcp8x5_tiocmget,
         .tiocmset               = spcp8x5_tiocmset,
diff --git a/drivers/usb/serial/symbolserial.c b/drivers/usb/serial/symbolserial.c
index 6157fac9366b..cb7e95f9fcbf 100644
--- a/drivers/usb/serial/symbolserial.c
+++ b/drivers/usb/serial/symbolserial.c
@@ -124,8 +124,7 @@ exit:
         spin_unlock(&priv->lock);
 }
 
-static int symbol_open(struct tty_struct *tty, struct usb_serial_port *port,
-                        struct file *filp)
+static int symbol_open(struct tty_struct *tty, struct usb_serial_port *port)
 {
         struct symbol_private *priv = usb_get_serial_data(port->serial);
         unsigned long flags;
diff --git a/drivers/usb/serial/ti_usb_3410_5052.c b/drivers/usb/serial/ti_usb_3410_5052.c
index 3bc609fe2242..1e9dc8821698 100644
--- a/drivers/usb/serial/ti_usb_3410_5052.c
+++ b/drivers/usb/serial/ti_usb_3410_5052.c
@@ -98,8 +98,7 @@ struct ti_device {
 
 static int ti_startup(struct usb_serial *serial);
 static void ti_release(struct usb_serial *serial);
-static int ti_open(struct tty_struct *tty, struct usb_serial_port *port,
-                struct file *file);
+static int ti_open(struct tty_struct *tty, struct usb_serial_port *port);
 static void ti_close(struct usb_serial_port *port);
 static int ti_write(struct tty_struct *tty, struct usb_serial_port *port,
                 const unsigned char *data, int count);
@@ -492,8 +491,7 @@ static void ti_release(struct usb_serial *serial)
 }
 
 
-static int ti_open(struct tty_struct *tty,
-                        struct usb_serial_port *port, struct file *file)
+static int ti_open(struct tty_struct *tty, struct usb_serial_port *port)
 {
         struct ti_port *tport = usb_get_serial_port_data(port);
         struct ti_device *tdev;
diff --git a/drivers/usb/serial/usb-serial.c b/drivers/usb/serial/usb-serial.c
index 99188c92068b..ff75a3589e7e 100644
--- a/drivers/usb/serial/usb-serial.c
+++ b/drivers/usb/serial/usb-serial.c
@@ -35,6 +35,7 @@
 #include <linux/serial.h>
 #include <linux/usb.h>
 #include <linux/usb/serial.h>
+#include <linux/kfifo.h>
 #include "pl2303.h"
 
 /*
@@ -43,8 +44,6 @@
 #define DRIVER_AUTHOR "Greg Kroah-Hartman, greg@kroah.com, http://www.kroah.com/linux/"
 #define DRIVER_DESC "USB Serial Driver core"
 
-static void port_free(struct usb_serial_port *port);
-
 /* Driver structure we register with the USB core */
 static struct usb_driver usb_serial_driver = {
         .name =         "usbserial",
@@ -68,6 +67,11 @@ static struct usb_serial *serial_table[SERIAL_TTY_MINORS];
 static DEFINE_MUTEX(table_lock);
 static LIST_HEAD(usb_serial_driver_list);
 
+/*
+ * Look up the serial structure.  If it is found and it hasn't been
+ * disconnected, return with its disc_mutex held and its refcount
+ * incremented.  Otherwise return NULL.
+ */
 struct usb_serial *usb_serial_get_by_index(unsigned index)
 {
         struct usb_serial *serial;
@@ -75,8 +79,15 @@ struct usb_serial *usb_serial_get_by_index(unsigned index)
         mutex_lock(&table_lock);
         serial = serial_table[index];
 
-        if (serial)
-                kref_get(&serial->kref);
+        if (serial) {
+                mutex_lock(&serial->disc_mutex);
+                if (serial->disconnected) {
+                        mutex_unlock(&serial->disc_mutex);
+                        serial = NULL;
+                } else {
+                        kref_get(&serial->kref);
+                }
+        }
         mutex_unlock(&table_lock);
         return serial;
 }
@@ -125,8 +136,10 @@ static void return_serial(struct usb_serial *serial)
 
         dbg("%s", __func__);
 
+        mutex_lock(&table_lock);
         for (i = 0; i < serial->num_ports; ++i)
                 serial_table[serial->minor + i] = NULL;
+        mutex_unlock(&table_lock);
 }
 
 static void destroy_serial(struct kref *kref)
@@ -145,244 +158,224 @@ static void destroy_serial(struct kref *kref)
 
         serial->type->release(serial);
 
-        for (i = 0; i < serial->num_ports; ++i) {
+        /* Now that nothing is using the ports, they can be freed */
+        for (i = 0; i < serial->num_port_pointers; ++i) {
                 port = serial->port[i];
-                if (port)
+                if (port) {
+                        port->serial = NULL;
                         put_device(&port->dev);
-        }
-
-        /* If this is a "fake" port, we have to clean it up here, as it will
-         * not get cleaned up in port_release() as it was never registered with
-         * the driver core */
-        if (serial->num_ports < serial->num_port_pointers) {
-                for (i = serial->num_ports;
-                                        i < serial->num_port_pointers; ++i) {
-                        port = serial->port[i];
-                        if (port)
-                                port_free(port);
                 }
         }
 
         usb_put_dev(serial->dev);
-
-        /* free up any memory that we allocated */
         kfree(serial);
 }
 
 void usb_serial_put(struct usb_serial *serial)
 {
-        mutex_lock(&table_lock);
         kref_put(&serial->kref, destroy_serial);
-        mutex_unlock(&table_lock);
 }
 
 /*****************************************************************************
  * Driver tty interface functions
  *****************************************************************************/
-static int serial_open (struct tty_struct *tty, struct file *filp)
+
+/**
+ * serial_install - install tty
+ * @driver: the driver (USB in our case)
+ * @tty: the tty being created
+ *
+ * Create the termios objects for this tty.  We use the default
+ * USB serial settings but permit them to be overridden by
+ * serial->type->init_termios.
+ *
+ * This is the first place a new tty gets used.  Hence this is where we
+ * acquire references to the usb_serial structure and the driver module,
+ * where we store a pointer to the port, and where we do an autoresume.
+ * All these actions are reversed in serial_release().
+ */
+static int serial_install(struct tty_driver *driver, struct tty_struct *tty)
 {
+        int idx = tty->index;
         struct usb_serial *serial;
         struct usb_serial_port *port;
-        unsigned int portNumber;
-        int retval = 0;
-        int first = 0;
+        int retval = -ENODEV;
 
         dbg("%s", __func__);
 
-        /* get the serial object associated with this tty pointer */
-        serial = usb_serial_get_by_index(tty->index);
-        if (!serial) {
-                tty->driver_data = NULL;
-                return -ENODEV;
-        }
+        serial = usb_serial_get_by_index(idx);
+        if (!serial)
+                return retval;
 
-        mutex_lock(&serial->disc_mutex);
-        portNumber = tty->index - serial->minor;
-        port = serial->port[portNumber];
-        if (!port || serial->disconnected)
-                retval = -ENODEV;
-        else
-                get_device(&port->dev);
-        /*
-         * Note: Our locking order requirement does not allow port->mutex
-         * to be acquired while serial->disc_mutex is held.
-         */
-        mutex_unlock(&serial->disc_mutex);
+        port = serial->port[idx - serial->minor];
+        if (!port)
+                goto error_no_port;
+        if (!try_module_get(serial->type->driver.owner))
+                goto error_module_get;
+
+        /* perform the standard setup */
+        retval = tty_init_termios(tty);
         if (retval)
-                goto bailout_serial_put;
+                goto error_init_termios;
 
-        if (mutex_lock_interruptible(&port->mutex)) {
-                retval = -ERESTARTSYS;
-                goto bailout_port_put;
-        }
+        retval = usb_autopm_get_interface(serial->interface);
+        if (retval)
+                goto error_get_interface;
 
-        ++port->port.count;
+        mutex_unlock(&serial->disc_mutex);
+
+        /* allow the driver to update the settings */
+        if (serial->type->init_termios)
+                serial->type->init_termios(tty);
 
-        /* set up our port structure making the tty driver
-         * remember our port object, and us it */
         tty->driver_data = port;
-        tty_port_tty_set(&port->port, tty);
 
-        /* If the console is attached, the device is already open */
-        if (port->port.count == 1 && !port->console) {
-                first = 1;
-                /* lock this module before we call it
-                 * this may fail, which means we must bail out,
-                 * safe because we are called with BKL held */
-                if (!try_module_get(serial->type->driver.owner)) {
-                        retval = -ENODEV;
-                        goto bailout_mutex_unlock;
-                }
+        /* Final install (we use the default method) */
+        tty_driver_kref_get(driver);
+        tty->count++;
+        driver->ttys[idx] = tty;
+        return retval;
+
+ error_get_interface:
+ error_init_termios:
+        module_put(serial->type->driver.owner);
+ error_module_get:
+ error_no_port:
+        usb_serial_put(serial);
+        mutex_unlock(&serial->disc_mutex);
+        return retval;
+}
 
+static int serial_open(struct tty_struct *tty, struct file *filp)
+{
+        struct usb_serial_port *port = tty->driver_data;
+        struct usb_serial *serial = port->serial;
+        int retval;
+
+        dbg("%s - port %d", __func__, port->number);
+
+        spin_lock_irq(&port->port.lock);
+        if (!tty_hung_up_p(filp))
+                ++port->port.count;
+        spin_unlock_irq(&port->port.lock);
+        tty_port_tty_set(&port->port, tty);
+
+        /* Do the device-specific open only if the hardware isn't
+         * already initialized.
+         */
+        if (!test_bit(ASYNCB_INITIALIZED, &port->port.flags)) {
+                if (mutex_lock_interruptible(&port->mutex))
+                        return -ERESTARTSYS;
                 mutex_lock(&serial->disc_mutex);
                 if (serial->disconnected)
                         retval = -ENODEV;
                 else
-                        retval = usb_autopm_get_interface(serial->interface);
-                if (retval)
-                        goto bailout_module_put;
-
-                /* only call the device specific open if this
-                 * is the first time the port is opened */
-                retval = serial->type->open(tty, port, filp);
-                if (retval)
-                        goto bailout_interface_put;
+                        retval = port->serial->type->open(tty, port);
                 mutex_unlock(&serial->disc_mutex);
+                mutex_unlock(&port->mutex);
+                if (retval)
+                        return retval;
                 set_bit(ASYNCB_INITIALIZED, &port->port.flags);
         }
-        mutex_unlock(&port->mutex);
+
         /* Now do the correct tty layer semantics */
         retval = tty_port_block_til_ready(&port->port, tty, filp);
-        if (retval == 0) {
-                if (!first)
-                        usb_serial_put(serial);
-                return 0;
-        }
-        mutex_lock(&port->mutex);
-        if (first == 0)
-                goto bailout_mutex_unlock;
-        /* Undo the initial port actions */
-        mutex_lock(&serial->disc_mutex);
-bailout_interface_put:
-        usb_autopm_put_interface(serial->interface);
-bailout_module_put:
-        mutex_unlock(&serial->disc_mutex);
-        module_put(serial->type->driver.owner);
-bailout_mutex_unlock:
-        port->port.count = 0;
-        tty->driver_data = NULL;
-        tty_port_tty_set(&port->port, NULL);
-        mutex_unlock(&port->mutex);
-bailout_port_put:
-        put_device(&port->dev);
-bailout_serial_put:
-        usb_serial_put(serial);
         return retval;
 }
 
 /**
- *      serial_do_down          -       shut down hardware
- *      @port: port to shut down
- *
- *      Shut down a USB port unless it is the console. We never shut down the
- *      console hardware as it will always be in use.
+ * serial_down - shut down hardware
+ * @port: port to shut down
  *
- *      Don't free any resources at this point
+ * Shut down a USB serial port unless it is the console.  We never
+ * shut down the console hardware as it will always be in use.
  */
-static void serial_do_down(struct usb_serial_port *port)
+static void serial_down(struct usb_serial_port *port)
 {
         struct usb_serial_driver *drv = port->serial->type;
-        struct usb_serial *serial;
-        struct module *owner;
 
-        /* The console is magical, do not hang up the console hardware
-           or there will be tears */
+        /*
+         * The console is magical.  Do not hang up the console hardware
+         * or there will be tears.
+         */
         if (port->console)
                 return;
 
-        mutex_lock(&port->mutex);
-        serial = port->serial;
-        owner = serial->type->driver.owner;
+        /* Don't call the close method if the hardware hasn't been
+         * initialized.
+         */
+        if (!test_and_clear_bit(ASYNCB_INITIALIZED, &port->port.flags))
+                return;
 
+        mutex_lock(&port->mutex);
         if (drv->close)
                 drv->close(port);
-
         mutex_unlock(&port->mutex);
 }
 
-/**
- *      serial_do_free          -       free resources post close/hangup
- *      @port: port to free up
- *
- *      Do the resource freeing and refcount dropping for the port. We must
- *      be careful about ordering and we must avoid freeing up the console.
- */
-
-static void serial_do_free(struct usb_serial_port *port)
+static void serial_hangup(struct tty_struct *tty)
 {
-        struct usb_serial *serial;
-        struct module *owner;
+        struct usb_serial_port *port = tty->driver_data;
 
-        /* The console is magical, do not hang up the console hardware
-           or there will be tears */
-        if (port->console)
-                return;
+        dbg("%s - port %d", __func__, port->number);
 
-        serial = port->serial;
-        owner = serial->type->driver.owner;
-        put_device(&port->dev);
-        /* Mustn't dereference port any more */
-        mutex_lock(&serial->disc_mutex);
-        if (!serial->disconnected)
-                usb_autopm_put_interface(serial->interface);
-        mutex_unlock(&serial->disc_mutex);
-        usb_serial_put(serial);
-        /* Mustn't dereference serial any more */
-        module_put(owner);
+        serial_down(port);
+        tty_port_hangup(&port->port);
 }
 
 static void serial_close(struct tty_struct *tty, struct file *filp)
 {
         struct usb_serial_port *port = tty->driver_data;
 
-        if (!port)
-                return;
-
         dbg("%s - port %d", __func__, port->number);
 
-        /* FIXME:
-           This leaves a very narrow race. Really we should do the
-           serial_do_free() on tty->shutdown(), but tty->shutdown can
-           be called from IRQ context and serial_do_free can sleep.
-
-           The right fix is probably to make the tty free (which is rare)
-           and thus tty->shutdown() occur via a work queue and simplify all
-           the drivers that use it.
-        */
-        if (tty_hung_up_p(filp)) {
-                /* serial_hangup already called serial_down at this point.
-                   Another user may have already reopened the port but
-                   serial_do_free is refcounted */
-                serial_do_free(port);
+        if (tty_hung_up_p(filp))
                 return;
-        }
-
         if (tty_port_close_start(&port->port, tty, filp) == 0)
                 return;
-
-        serial_do_down(port);           
+        serial_down(port);
         tty_port_close_end(&port->port, tty);
         tty_port_tty_set(&port->port, NULL);
-        serial_do_free(port);
 }
 
-static void serial_hangup(struct tty_struct *tty)
+/**
+ * serial_release - free resources post close/hangup
+ * @port: port to free up
+ *
+ * Do the resource freeing and refcount dropping for the port.
+ * Avoid freeing the console.
+ *
+ * Called when the last tty kref is dropped.
+ */
+static void serial_release(struct tty_struct *tty)
 {
         struct usb_serial_port *port = tty->driver_data;
-        serial_do_down(port);
-        tty_port_hangup(&port->port);
-        /* We must not free port yet - the USB serial layer depends on it's
-           continued existence */
+        struct usb_serial *serial;
+        struct module *owner;
+
+        /* The console is magical.  Do not hang up the console hardware
+         * or there will be tears.
+         */
+        if (port->console)
+                return;
+
+        dbg("%s - port %d", __func__, port->number);
+
+        /* Standard shutdown processing */
+        tty_shutdown(tty);
+
+        tty->driver_data = NULL;
+
+        serial = port->serial;
+        owner = serial->type->driver.owner;
+
+        mutex_lock(&serial->disc_mutex);
+        if (!serial->disconnected)
+                usb_autopm_put_interface(serial->interface);
+        mutex_unlock(&serial->disc_mutex);
+
+        usb_serial_put(serial);
+        module_put(owner);
 }
 
 static int serial_write(struct tty_struct *tty, const unsigned char *buf,
@@ -527,6 +520,7 @@ static int serial_proc_show(struct seq_file *m, void *v)
 
                 seq_putc(m, '\n');
                 usb_serial_put(serial);
+                mutex_unlock(&serial->disc_mutex);
         }
         return 0;
 }
@@ -596,14 +590,6 @@ static void usb_serial_port_work(struct work_struct *work)
         tty_kref_put(tty);
 }
 
-static void port_release(struct device *dev)
-{
-        struct usb_serial_port *port = to_usb_serial_port(dev);
-
-        dbg ("%s - %s", __func__, dev_name(dev));
-        port_free(port);
-}
-
 static void kill_traffic(struct usb_serial_port *port)
 {
         usb_kill_urb(port->read_urb);
@@ -623,8 +609,12 @@ static void kill_traffic(struct usb_serial_port *port)
         usb_kill_urb(port->interrupt_out_urb);
 }
 
-static void port_free(struct usb_serial_port *port)
+static void port_release(struct device *dev)
 {
+        struct usb_serial_port *port = to_usb_serial_port(dev);
+
+        dbg ("%s - %s", __func__, dev_name(dev));
+
         /*
          * Stop all the traffic before cancelling the work, so that
          * nobody will restart it by calling usb_serial_port_softint.
@@ -636,6 +626,8 @@ static void port_free(struct usb_serial_port *port)
         usb_free_urb(port->write_urb);
         usb_free_urb(port->interrupt_in_urb);
         usb_free_urb(port->interrupt_out_urb);
+        if (!IS_ERR(port->write_fifo) && port->write_fifo)
+                kfifo_free(port->write_fifo);
         kfree(port->bulk_in_buffer);
         kfree(port->bulk_out_buffer);
         kfree(port->interrupt_in_buffer);
@@ -935,6 +927,11 @@ int usb_serial_probe(struct usb_interface *interface,
                 mutex_init(&port->mutex);
                 INIT_WORK(&port->work, usb_serial_port_work);
                 serial->port[i] = port;
+                port->dev.parent = &interface->dev;
+                port->dev.driver = NULL;
+                port->dev.bus = &usb_serial_bus_type;
+                port->dev.release = &port_release;
+                device_initialize(&port->dev);
         }
 
         /* set up the endpoint information */
@@ -970,6 +967,10 @@ int usb_serial_probe(struct usb_interface *interface,
                         dev_err(&interface->dev, "No free urbs available\n");
                         goto probe_error;
                 }
+                port->write_fifo = kfifo_alloc(PAGE_SIZE, GFP_KERNEL,
+                        &port->lock);
+                if (IS_ERR(port->write_fifo))
+                        goto probe_error;
                 buffer_size = le16_to_cpu(endpoint->wMaxPacketSize);
                 port->bulk_out_size = buffer_size;
                 port->bulk_out_endpointAddress = endpoint->bEndpointAddress;
@@ -1077,15 +1078,10 @@ int usb_serial_probe(struct usb_interface *interface,
         /* register all of the individual ports with the driver core */
         for (i = 0; i < num_ports; ++i) {
                 port = serial->port[i];
-                port->dev.parent = &interface->dev;
-                port->dev.driver = NULL;
-                port->dev.bus = &usb_serial_bus_type;
-                port->dev.release = &port_release;
-
                 dev_set_name(&port->dev, "ttyUSB%d", port->number);
                 dbg ("%s - registering %s", __func__, dev_name(&port->dev));
                 port->dev_state = PORT_REGISTERING;
-                retval = device_register(&port->dev);
+                retval = device_add(&port->dev);
                 if (retval) {
                         dev_err(&port->dev, "Error registering port device, "
                                 "continuing\n");
@@ -1103,39 +1099,7 @@ exit:
         return 0;
 
 probe_error:
-        for (i = 0; i < num_bulk_in; ++i) {
-                port = serial->port[i];
-                if (!port)
-                        continue;
-                usb_free_urb(port->read_urb);
-                kfree(port->bulk_in_buffer);
-        }
-        for (i = 0; i < num_bulk_out; ++i) {
-                port = serial->port[i];
-                if (!port)
-                        continue;
-                usb_free_urb(port->write_urb);
-                kfree(port->bulk_out_buffer);
-        }
-        for (i = 0; i < num_interrupt_in; ++i) {
-                port = serial->port[i];
-                if (!port)
-                        continue;
-                usb_free_urb(port->interrupt_in_urb);
-                kfree(port->interrupt_in_buffer);
-        }
-        for (i = 0; i < num_interrupt_out; ++i) {
-                port = serial->port[i];
-                if (!port)
-                        continue;
-                usb_free_urb(port->interrupt_out_urb);
-                kfree(port->interrupt_out_buffer);
-        }
-
-        /* free up any memory that we allocated */
-        for (i = 0; i < serial->num_port_pointers; ++i)
-                kfree(serial->port[i]);
-        kfree(serial);
+        usb_serial_put(serial);
         return -EIO;
 }
 EXPORT_SYMBOL_GPL(usb_serial_probe);
@@ -1161,10 +1125,7 @@ void usb_serial_disconnect(struct usb_interface *interface)
                 if (port) {
                         struct tty_struct *tty = tty_port_tty_get(&port->port);
                         if (tty) {
-                                /* The hangup will occur asynchronously but
-                                   the object refcounts will sort out all the
-                                   cleanup */
-                                tty_hangup(tty);
+                                tty_vhangup(tty);
                                 tty_kref_put(tty);
                         }
                         kill_traffic(port);
@@ -1189,8 +1150,7 @@ void usb_serial_disconnect(struct usb_interface *interface)
         }
         serial->type->disconnect(serial);
 
-        /* let the last holder of this object
-         * cause it to be cleaned up */
+        /* let the last holder of this object cause it to be cleaned up */
         usb_serial_put(serial);
         dev_info(dev, "device disconnected\n");
 }
@@ -1204,15 +1164,19 @@ int usb_serial_suspend(struct usb_interface *intf, pm_message_t message)
 
         serial->suspending = 1;
 
+        if (serial->type->suspend) {
+                r = serial->type->suspend(serial, message);
+                if (r < 0)
+                        goto err_out;
+        }
+
         for (i = 0; i < serial->num_ports; ++i) {
                 port = serial->port[i];
                 if (port)
                         kill_traffic(port);
         }
 
-        if (serial->type->suspend)
-                r = serial->type->suspend(serial, message);
-
+err_out:
         return r;
 }
 EXPORT_SYMBOL(usb_serial_suspend);
@@ -1246,6 +1210,8 @@ static const struct tty_operations serial_ops = {
         .chars_in_buffer =      serial_chars_in_buffer,
         .tiocmget =             serial_tiocmget,
         .tiocmset =             serial_tiocmset,
+        .shutdown =             serial_release,
+        .install =              serial_install,
         .proc_fops =            &serial_proc_fops,
 };
 
diff --git a/drivers/usb/serial/usb_debug.c b/drivers/usb/serial/usb_debug.c
index 614800972dc3..7b5bfc4edd3d 100644
--- a/drivers/usb/serial/usb_debug.c
+++ b/drivers/usb/serial/usb_debug.c
@@ -43,11 +43,10 @@ static struct usb_driver debug_driver = {
         .no_dynamic_id =        1,
 };
 
-static int usb_debug_open(struct tty_struct *tty, struct usb_serial_port *port,
-                                                        struct file *filp)
+static int usb_debug_open(struct tty_struct *tty, struct usb_serial_port *port)
 {
         port->bulk_out_size = USB_DEBUG_MAX_PACKET_SIZE;
-        return usb_serial_generic_open(tty, port, filp);
+        return usb_serial_generic_open(tty, port);
 }
 
 /* This HW really does not support a serial break, so one will be
diff --git a/drivers/usb/serial/visor.c b/drivers/usb/serial/visor.c
index f5d0f64dcc52..1aa5d20a5d99 100644
--- a/drivers/usb/serial/visor.c
+++ b/drivers/usb/serial/visor.c
@@ -36,8 +36,7 @@
 #define DRIVER_DESC "USB HandSpring Visor / Palm OS driver"
 
 /* function prototypes for a handspring visor */
-static int  visor_open(struct tty_struct *tty, struct usb_serial_port *port,
-                                        struct file *filp);
+static int  visor_open(struct tty_struct *tty, struct usb_serial_port *port);
 static void visor_close(struct usb_serial_port *port);
 static int  visor_write(struct tty_struct *tty, struct usb_serial_port *port,
                                         const unsigned char *buf, int count);
@@ -273,8 +272,7 @@ static int stats;
 /******************************************************************************
  * Handspring Visor specific driver functions
  ******************************************************************************/
-static int visor_open(struct tty_struct *tty, struct usb_serial_port *port,
-                                                        struct file *filp)
+static int visor_open(struct tty_struct *tty, struct usb_serial_port *port)
 {
         struct usb_serial *serial = port->serial;
         struct visor_private *priv = usb_get_serial_port_data(port);
diff --git a/drivers/usb/serial/whiteheat.c b/drivers/usb/serial/whiteheat.c
index 8d126dd7a02e..62424eec33ec 100644
--- a/drivers/usb/serial/whiteheat.c
+++ b/drivers/usb/serial/whiteheat.c
@@ -146,7 +146,7 @@ static int  whiteheat_firmware_attach(struct usb_serial *serial);
 static int  whiteheat_attach(struct usb_serial *serial);
 static void whiteheat_release(struct usb_serial *serial);
 static int  whiteheat_open(struct tty_struct *tty,
-                        struct usb_serial_port *port, struct file *filp);
+                        struct usb_serial_port *port);
 static void whiteheat_close(struct usb_serial_port *port);
 static int  whiteheat_write(struct tty_struct *tty,
                         struct usb_serial_port *port,
@@ -259,7 +259,7 @@ static int firm_send_command(struct usb_serial_port *port, __u8 command,
                                                 __u8 *data, __u8 datasize);
 static int firm_open(struct usb_serial_port *port);
 static int firm_close(struct usb_serial_port *port);
-static int firm_setup_port(struct tty_struct *tty);
+static void firm_setup_port(struct tty_struct *tty);
 static int firm_set_rts(struct usb_serial_port *port, __u8 onoff);
 static int firm_set_dtr(struct usb_serial_port *port, __u8 onoff);
 static int firm_set_break(struct usb_serial_port *port, __u8 onoff);
@@ -659,8 +659,7 @@ static void whiteheat_release(struct usb_serial *serial)
         return;
 }
 
-static int whiteheat_open(struct tty_struct *tty,
-                        struct usb_serial_port *port, struct file *filp)
+static int whiteheat_open(struct tty_struct *tty, struct usb_serial_port *port)
 {
         int             retval = 0;
 
@@ -1211,7 +1210,7 @@ static int firm_close(struct usb_serial_port *port)
 }
 
 
-static int firm_setup_port(struct tty_struct *tty)
+static void firm_setup_port(struct tty_struct *tty)
 {
         struct usb_serial_port *port = tty->driver_data;
         struct whiteheat_port_settings port_settings;
@@ -1286,7 +1285,7 @@ static int firm_setup_port(struct tty_struct *tty)
         port_settings.lloop = 0;
 
         /* now send the message to the device */
-        return firm_send_command(port, WHITEHEAT_SETUP_PORT,
+        firm_send_command(port, WHITEHEAT_SETUP_PORT,
                         (__u8 *)&port_settings, sizeof(port_settings));
 }
 
diff --git a/drivers/usb/storage/datafab.c b/drivers/usb/storage/datafab.c
index 2b6e565262c2..ded836b02d7b 100644
--- a/drivers/usb/storage/datafab.c
+++ b/drivers/usb/storage/datafab.c
@@ -334,7 +334,7 @@ static int datafab_determine_lun(struct us_data *us,
         unsigned char *buf;
         int count = 0, rc;
 
-        if (!us || !info)
+        if (!info)
                 return USB_STOR_TRANSPORT_ERROR;
 
         memcpy(command, scommand, 8);
@@ -399,7 +399,7 @@ static int datafab_id_device(struct us_data *us,
         unsigned char *reply;
         int rc;
 
-        if (!us || !info)
+        if (!info)
                 return USB_STOR_TRANSPORT_ERROR;
 
         if (info->lun == -1) {
diff --git a/drivers/usb/storage/initializers.c b/drivers/usb/storage/initializers.c
index ec17c96371af..105d900150c1 100644
--- a/drivers/usb/storage/initializers.c
+++ b/drivers/usb/storage/initializers.c
@@ -102,5 +102,5 @@ int usb_stor_huawei_e220_init(struct us_data *us)
                                       USB_TYPE_STANDARD | USB_RECIP_DEVICE,
                                       0x01, 0x0, NULL, 0x0, 1000);
         US_DEBUGP("Huawei mode set result is %d\n", result);
-        return (result ? 0 : -ENODEV);
+        return 0;
 }
diff --git a/drivers/usb/storage/jumpshot.c b/drivers/usb/storage/jumpshot.c
index 1c69420e3acf..6168596c5ac6 100644
--- a/drivers/usb/storage/jumpshot.c
+++ b/drivers/usb/storage/jumpshot.c
@@ -335,7 +335,7 @@ static int jumpshot_id_device(struct us_data *us,
         unsigned char *reply;
         int      rc;
 
-        if (!us || !info)
+        if (!info)
                 return USB_STOR_TRANSPORT_ERROR;
 
         command[0] = 0xE0;
diff --git a/drivers/usb/storage/onetouch.c b/drivers/usb/storage/onetouch.c
index 380233bd6a39..80e65f29921c 100644
--- a/drivers/usb/storage/onetouch.c
+++ b/drivers/usb/storage/onetouch.c
@@ -163,7 +163,7 @@ static void usb_onetouch_pm_hook(struct us_data *us, int action)
                         usb_kill_urb(onetouch->irq);
                         break;
                 case US_RESUME:
-                        if (usb_submit_urb(onetouch->irq, GFP_KERNEL) != 0)
+                        if (usb_submit_urb(onetouch->irq, GFP_NOIO) != 0)
                                 dev_err(&onetouch->irq->dev->dev,
                                         "usb_submit_urb failed\n");
                         break;
diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
index 7477d411959f..079ae0f7bec1 100644
--- a/drivers/usb/storage/unusual_devs.h
+++ b/drivers/usb/storage/unusual_devs.h
@@ -66,13 +66,6 @@ UNUSUAL_DEV(  0x03eb, 0x2002, 0x0100, 0x0100,
                 US_SC_DEVICE, US_PR_DEVICE, NULL,
                 US_FL_IGNORE_RESIDUE),
 
-/* modified by Tobias Lorenz <tobias.lorenz@gmx.net> */
-UNUSUAL_DEV(  0x03ee, 0x6901, 0x0000, 0x0200,
-                "Mitsumi",
-                "USB FDD",
-                US_SC_DEVICE, US_PR_DEVICE, NULL,
-                US_FL_SINGLE_LUN ),
-
 /* Reported by Rodolfo Quesada <rquesada@roqz.net> */
 UNUSUAL_DEV(  0x03ee, 0x6906, 0x0003, 0x0003,
                 "VIA Technologies Inc.",
@@ -233,13 +226,6 @@ UNUSUAL_DEV(  0x0421, 0x0495, 0x0370, 0x0370,
                 US_SC_DEVICE, US_PR_DEVICE, NULL,
                 US_FL_MAX_SECTORS_64 ),
 
-/* Reported by Olaf Hering <olh@suse.de> from novell bug #105878 */
-UNUSUAL_DEV(  0x0424, 0x0fdc, 0x0210, 0x0210,
-                "SMSC",
-                "FDC GOLD-2.30",
-                US_SC_DEVICE, US_PR_DEVICE, NULL,
-                US_FL_SINGLE_LUN ),
-
 #ifdef NO_SDDR09
 UNUSUAL_DEV(  0x0436, 0x0005, 0x0100, 0x0100,
                 "Microtech",
@@ -664,19 +650,13 @@ UNUSUAL_DEV(  0x055d, 0x2020, 0x0000, 0x0210,
                 US_SC_DEVICE, US_PR_DEVICE, NULL,
                 US_FL_SINGLE_LUN ),
 
-                
+/* We keep this entry to force the transport; firmware 3.00 and later is ok. */
 UNUSUAL_DEV(  0x057b, 0x0000, 0x0000, 0x0299,
                 "Y-E Data",
                 "Flashbuster-U",
                 US_SC_DEVICE,  US_PR_CB, NULL,
                 US_FL_SINGLE_LUN),
 
-UNUSUAL_DEV(  0x057b, 0x0000, 0x0300, 0x9999,
-                "Y-E Data",
-                "Flashbuster-U",
-                US_SC_DEVICE,  US_PR_DEVICE, NULL,
-                US_FL_SINGLE_LUN),
-
 /* Reported by Johann Cardon <johann.cardon@free.fr>
  * This entry is needed only because the device reports
  * bInterfaceClass = 0xff (vendor-specific)
diff --git a/drivers/usb/usb-skeleton.c b/drivers/usb/usb-skeleton.c
index 60ba631e99c2..b62f2bc064f6 100644
--- a/drivers/usb/usb-skeleton.c
+++ b/drivers/usb/usb-skeleton.c
@@ -18,7 +18,7 @@
 #include <linux/slab.h>
 #include <linux/module.h>
 #include <linux/kref.h>
-#include <asm/uaccess.h>
+#include <linux/uaccess.h>
 #include <linux/usb.h>
 #include <linux/mutex.h>
 
@@ -28,7 +28,7 @@
 #define USB_SKEL_PRODUCT_ID     0xfff0
 
 /* table of devices that work with this driver */
-static struct usb_device_id skel_table [] = {
+static struct usb_device_id skel_table[] = {
         { USB_DEVICE(USB_SKEL_VENDOR_ID, USB_SKEL_PRODUCT_ID) },
         { }                                     /* Terminating entry */
 };
@@ -52,15 +52,21 @@ struct usb_skel {
         struct usb_interface    *interface;             /* the interface for this device */
         struct semaphore        limit_sem;              /* limiting the number of writes in progress */
         struct usb_anchor       submitted;              /* in case we need to retract our submissions */
+        struct urb              *bulk_in_urb;           /* the urb to read data with */
         unsigned char           *bulk_in_buffer;        /* the buffer to receive data */
         size_t                  bulk_in_size;           /* the size of the receive buffer */
+        size_t                  bulk_in_filled;         /* number of bytes in the buffer */
+        size_t                  bulk_in_copied;         /* already copied to user space */
         __u8                    bulk_in_endpointAddr;   /* the address of the bulk in endpoint */
         __u8                    bulk_out_endpointAddr;  /* the address of the bulk out endpoint */
         int                     errors;                 /* the last request tanked */
         int                     open_count;             /* count the number of openers */
+        bool                    ongoing_read;           /* a read is going on */
+        bool                    processed_urb;          /* indicates we haven't processed the urb */
         spinlock_t              err_lock;               /* lock for errors */
         struct kref             kref;
         struct mutex            io_mutex;               /* synchronize I/O with disconnect */
+        struct completion       bulk_in_completion;     /* to wait for an ongoing read */
 };
 #define to_skel_dev(d) container_of(d, struct usb_skel, kref)
 
@@ -71,6 +77,7 @@ static void skel_delete(struct kref *kref)
 {
         struct usb_skel *dev = to_skel_dev(kref);
 
+        usb_free_urb(dev->bulk_in_urb);
         usb_put_dev(dev->udev);
         kfree(dev->bulk_in_buffer);
         kfree(dev);
@@ -87,7 +94,7 @@ static int skel_open(struct inode *inode, struct file *file)
 
         interface = usb_find_interface(&skel_driver, subminor);
         if (!interface) {
-                err ("%s - error, can't find device for minor %d",
+                err("%s - error, can't find device for minor %d",
                      __func__, subminor);
                 retval = -ENODEV;
                 goto exit;
@@ -174,38 +181,190 @@ static int skel_flush(struct file *file, fl_owner_t id)
         return res;
 }
 
-static ssize_t skel_read(struct file *file, char *buffer, size_t count, loff_t *ppos)
+static void skel_read_bulk_callback(struct urb *urb)
 {
         struct usb_skel *dev;
-        int retval;
-        int bytes_read;
+
+        dev = urb->context;
+
+        spin_lock(&dev->err_lock);
+        /* sync/async unlink faults aren't errors */
+        if (urb->status) {
+                if (!(urb->status == -ENOENT ||
+                    urb->status == -ECONNRESET ||
+                    urb->status == -ESHUTDOWN))
+                        err("%s - nonzero write bulk status received: %d",
+                            __func__, urb->status);
+
+                dev->errors = urb->status;
+        } else {
+                dev->bulk_in_filled = urb->actual_length;
+        }
+        dev->ongoing_read = 0;
+        spin_unlock(&dev->err_lock);
+
+        complete(&dev->bulk_in_completion);
+}
+
+static int skel_do_read_io(struct usb_skel *dev, size_t count)
+{
+        int rv;
+
+        /* prepare a read */
+        usb_fill_bulk_urb(dev->bulk_in_urb,
+                        dev->udev,
+                        usb_rcvbulkpipe(dev->udev,
+                                dev->bulk_in_endpointAddr),
+                        dev->bulk_in_buffer,
+                        min(dev->bulk_in_size, count),
+                        skel_read_bulk_callback,
+                        dev);
+        /* tell everybody to leave the URB alone */
+        spin_lock_irq(&dev->err_lock);
+        dev->ongoing_read = 1;
+        spin_unlock_irq(&dev->err_lock);
+
+        /* do it */
+        rv = usb_submit_urb(dev->bulk_in_urb, GFP_KERNEL);
+        if (rv < 0) {
+                err("%s - failed submitting read urb, error %d",
+                        __func__, rv);
+                dev->bulk_in_filled = 0;
+                rv = (rv == -ENOMEM) ? rv : -EIO;
+                spin_lock_irq(&dev->err_lock);
+                dev->ongoing_read = 0;
+                spin_unlock_irq(&dev->err_lock);
+        }
+
+        return rv;
+}
+
+static ssize_t skel_read(struct file *file, char *buffer, size_t count,
+                         loff_t *ppos)
+{
+        struct usb_skel *dev;
+        int rv;
+        bool ongoing_io;
 
         dev = (struct usb_skel *)file->private_data;
 
-        mutex_lock(&dev->io_mutex);
+        /* if we cannot read at all, return EOF */
+        if (!dev->bulk_in_urb || !count)
+                return 0;
+
+        /* no concurrent readers */
+        rv = mutex_lock_interruptible(&dev->io_mutex);
+        if (rv < 0)
+                return rv;
+
         if (!dev->interface) {          /* disconnect() was called */
-                retval = -ENODEV;
+                rv = -ENODEV;
                 goto exit;
         }
 
-        /* do a blocking bulk read to get data from the device */
-        retval = usb_bulk_msg(dev->udev,
-                              usb_rcvbulkpipe(dev->udev, dev->bulk_in_endpointAddr),
-                              dev->bulk_in_buffer,
-                              min(dev->bulk_in_size, count),
-                              &bytes_read, 10000);
-
-        /* if the read was successful, copy the data to userspace */
-        if (!retval) {
-                if (copy_to_user(buffer, dev->bulk_in_buffer, bytes_read))
-                        retval = -EFAULT;
-                else
-                        retval = bytes_read;
+        /* if IO is under way, we must not touch things */
+retry:
+        spin_lock_irq(&dev->err_lock);
+        ongoing_io = dev->ongoing_read;
+        spin_unlock_irq(&dev->err_lock);
+
+        if (ongoing_io) {
+                /* nonblocking IO shall not wait */
+                if (file->f_flags & O_NONBLOCK) {
+                        rv = -EAGAIN;
+                        goto exit;
+                }
+                /*
+                 * IO may take forever
+                 * hence wait in an interruptible state
+                 */
+                rv = wait_for_completion_interruptible(&dev->bulk_in_completion);
+                if (rv < 0)
+                        goto exit;
+                /*
+                 * by waiting we also semiprocessed the urb
+                 * we must finish now
+                 */
+                dev->bulk_in_copied = 0;
+                dev->processed_urb = 1;
+        }
+
+        if (!dev->processed_urb) {
+                /*
+                 * the URB hasn't been processed
+                 * do it now
+                 */
+                wait_for_completion(&dev->bulk_in_completion);
+                dev->bulk_in_copied = 0;
+                dev->processed_urb = 1;
+        }
+
+        /* errors must be reported */
+        rv = dev->errors;
+        if (rv < 0) {
+                /* any error is reported once */
+                dev->errors = 0;
+                /* to preserve notifications about reset */
+                rv = (rv == -EPIPE) ? rv : -EIO;
+                /* no data to deliver */
+                dev->bulk_in_filled = 0;
+                /* report it */
+                goto exit;
         }
 
+        /*
+         * if the buffer is filled we may satisfy the read
+         * else we need to start IO
+         */
+
+        if (dev->bulk_in_filled) {
+                /* we had read data */
+                size_t available = dev->bulk_in_filled - dev->bulk_in_copied;
+                size_t chunk = min(available, count);
+
+                if (!available) {
+                        /*
+                         * all data has been used
+                         * actual IO needs to be done
+                         */
+                        rv = skel_do_read_io(dev, count);
+                        if (rv < 0)
+                                goto exit;
+                        else
+                                goto retry;
+                }
+                /*
+                 * data is available
+                 * chunk tells us how much shall be copied
+                 */
+
+                if (copy_to_user(buffer,
+                                 dev->bulk_in_buffer + dev->bulk_in_copied,
+                                 chunk))
+                        rv = -EFAULT;
+                else
+                        rv = chunk;
+
+                dev->bulk_in_copied += chunk;
+
+                /*
+                 * if we are asked for more than we have,
+                 * we start IO but don't wait
+                 */
+                if (available < count)
+                        skel_do_read_io(dev, count - chunk);
+        } else {
+                /* no data in the buffer */
+                rv = skel_do_read_io(dev, count);
+                if (rv < 0)
+                        goto exit;
+                else if (!file->f_flags & O_NONBLOCK)
+                        goto retry;
+                rv = -EAGAIN;
+        }
 exit:
         mutex_unlock(&dev->io_mutex);
-        return retval;
+        return rv;
 }
 
 static void skel_write_bulk_callback(struct urb *urb)
@@ -216,7 +375,7 @@ static void skel_write_bulk_callback(struct urb *urb)
 
         /* sync/async unlink faults aren't errors */
         if (urb->status) {
-                if(!(urb->status == -ENOENT ||
+                if (!(urb->status == -ENOENT ||
                     urb->status == -ECONNRESET ||
                     urb->status == -ESHUTDOWN))
                         err("%s - nonzero write bulk status received: %d",
@@ -233,7 +392,8 @@ static void skel_write_bulk_callback(struct urb *urb)
         up(&dev->limit_sem);
 }
 
-static ssize_t skel_write(struct file *file, const char *user_buffer, size_t count, loff_t *ppos)
+static ssize_t skel_write(struct file *file, const char *user_buffer,
+                          size_t count, loff_t *ppos)
 {
         struct usb_skel *dev;
         int retval = 0;
@@ -247,14 +407,25 @@ static ssize_t skel_write(struct file *file, const char *user_buffer, size_t cou
         if (count == 0)
                 goto exit;
 
-        /* limit the number of URBs in flight to stop a user from using up all RAM */
-        if (down_interruptible(&dev->limit_sem)) {
-                retval = -ERESTARTSYS;
-                goto exit;
+        /*
+         * limit the number of URBs in flight to stop a user from using up all
+         * RAM
+         */
+        if (!file->f_flags & O_NONBLOCK) {
+                if (down_interruptible(&dev->limit_sem)) {
+                        retval = -ERESTARTSYS;
+                        goto exit;
+                }
+        } else {
+                if (down_trylock(&dev->limit_sem)) {
+                        retval = -EAGAIN;
+                        goto exit;
+                }
         }
 
         spin_lock_irq(&dev->err_lock);
-        if ((retval = dev->errors) < 0) {
+        retval = dev->errors;
+        if (retval < 0) {
                 /* any error is reported once */
                 dev->errors = 0;
                 /* to preserve notifications about reset */
@@ -271,7 +442,8 @@ static ssize_t skel_write(struct file *file, const char *user_buffer, size_t cou
                 goto error;
         }
 
-        buf = usb_buffer_alloc(dev->udev, writesize, GFP_KERNEL, &urb->transfer_dma);
+        buf = usb_buffer_alloc(dev->udev, writesize, GFP_KERNEL,
+                               &urb->transfer_dma);
         if (!buf) {
                 retval = -ENOMEM;
                 goto error;
@@ -301,11 +473,15 @@ static ssize_t skel_write(struct file *file, const char *user_buffer, size_t cou
         retval = usb_submit_urb(urb, GFP_KERNEL);
         mutex_unlock(&dev->io_mutex);
         if (retval) {
-                err("%s - failed submitting write urb, error %d", __func__, retval);
+                err("%s - failed submitting write urb, error %d", __func__,
+                    retval);
                 goto error_unanchor;
         }
 
-        /* release our reference to this urb, the USB core will eventually free it entirely */
+        /*
+         * release our reference to this urb, the USB core will eventually free
+         * it entirely
+         */
         usb_free_urb(urb);
 
 
@@ -343,7 +519,8 @@ static struct usb_class_driver skel_class = {
         .minor_base =   USB_SKEL_MINOR_BASE,
 };
 
-static int skel_probe(struct usb_interface *interface, const struct usb_device_id *id)
+static int skel_probe(struct usb_interface *interface,
+                      const struct usb_device_id *id)
 {
         struct usb_skel *dev;
         struct usb_host_interface *iface_desc;
@@ -363,6 +540,7 @@ static int skel_probe(struct usb_interface *interface, const struct usb_device_i
         mutex_init(&dev->io_mutex);
         spin_lock_init(&dev->err_lock);
         init_usb_anchor(&dev->submitted);
+        init_completion(&dev->bulk_in_completion);
 
         dev->udev = usb_get_dev(interface_to_usbdev(interface));
         dev->interface = interface;
@@ -384,6 +562,11 @@ static int skel_probe(struct usb_interface *interface, const struct usb_device_i
                                 err("Could not allocate bulk_in_buffer");
                                 goto error;
                         }
+                        dev->bulk_in_urb = usb_alloc_urb(0, GFP_KERNEL);
+                        if (!dev->bulk_in_urb) {
+                                err("Could not allocate bulk_in_urb");
+                                goto error;
+                        }
                 }
 
                 if (!dev->bulk_out_endpointAddr &&
@@ -453,6 +636,7 @@ static void skel_draw_down(struct usb_skel *dev)
         time = usb_wait_anchor_empty_timeout(&dev->submitted, 1000);
         if (!time)
                 usb_kill_anchored_urbs(&dev->submitted);
+        usb_kill_urb(dev->bulk_in_urb);
 }
 
 static int skel_suspend(struct usb_interface *intf, pm_message_t message)
@@ -465,7 +649,7 @@ static int skel_suspend(struct usb_interface *intf, pm_message_t message)
         return 0;
 }
 
-static int skel_resume (struct usb_interface *intf)
+static int skel_resume(struct usb_interface *intf)
 {
         return 0;
 }
diff --git a/drivers/usb/wusbcore/wa-hc.h b/drivers/usb/wusbcore/wa-hc.h
index 586d350cdb4d..d6bea3e0b54a 100644
--- a/drivers/usb/wusbcore/wa-hc.h
+++ b/drivers/usb/wusbcore/wa-hc.h
@@ -47,7 +47,7 @@
  *             to an endpoint on a WUSB device that is connected to a
  *             HWA RC.
  *
- *  xfer       Transfer managment -- this is all the code that gets a
+ *  xfer       Transfer management -- this is all the code that gets a
  *             buffer and pushes it to a device (or viceversa). *
  *
  * Some day a lot of this code will be shared between this driver and