24 files changed, 2129 insertions, 1176 deletions

diff --git a/drivers/usb/host/Kconfig b/drivers/usb/host/Kconfig
index be3fd9bce573..e27b79a3c05f 100644
--- a/drivers/usb/host/Kconfig
+++ b/drivers/usb/host/Kconfig
@@ -6,7 +6,7 @@ comment "USB Host Controller Drivers"
 
 config USB_EHCI_HCD
         tristate "EHCI HCD (USB 2.0) support"
-        depends on USB && PCI
+        depends on USB && USB_ARCH_HAS_EHCI
         ---help---
           The Enhanced Host Controller Interface (EHCI) is standard for USB 2.0
           "high speed" (480 Mbit/sec, 60 Mbyte/sec) host controller hardware.
diff --git a/drivers/usb/host/ehci-au1xxx.c b/drivers/usb/host/ehci-au1xxx.c
new file mode 100644
index 000000000000..63eadeec1324
--- /dev/null
+++ b/drivers/usb/host/ehci-au1xxx.c
@@ -0,0 +1,297 @@
+/*
+ * EHCI HCD (Host Controller Driver) for USB.
+ *
+ * (C) Copyright 2000-2004 David Brownell <dbrownell@users.sourceforge.net>
+ *
+ * Bus Glue for AMD Alchemy Au1xxx
+ *
+ * Based on "ohci-au1xxx.c" by Matt Porter <mporter@kernel.crashing.org>
+ *
+ * Modified for AMD Alchemy Au1200 EHC
+ *  by K.Boge <karsten.boge@amd.com>
+ *
+ * This file is licenced under the GPL.
+ */
+
+#include <linux/platform_device.h>
+#include <asm/mach-au1x00/au1000.h>
+
+#ifndef CONFIG_SOC_AU1200
+#error "this Alchemy chip doesn't have EHCI"
+#else                           /* Au1200 */
+
+#define USB_HOST_CONFIG   (USB_MSR_BASE + USB_MSR_MCFG)
+#define USB_MCFG_PFEN     (1<<31)
+#define USB_MCFG_RDCOMB   (1<<30)
+#define USB_MCFG_SSDEN    (1<<23)
+#define USB_MCFG_PHYPLLEN (1<<19)
+#define USB_MCFG_EHCCLKEN (1<<17)
+#define USB_MCFG_UCAM     (1<<7)
+#define USB_MCFG_EBMEN    (1<<3)
+#define USB_MCFG_EMEMEN   (1<<2)
+
+#define USBH_ENABLE_CE    (USB_MCFG_PHYPLLEN | USB_MCFG_EHCCLKEN)
+
+#ifdef CONFIG_DMA_COHERENT
+#define USBH_ENABLE_INIT  (USBH_ENABLE_CE \
+                         | USB_MCFG_PFEN | USB_MCFG_RDCOMB \
+                         | USB_MCFG_SSDEN | USB_MCFG_UCAM \
+                         | USB_MCFG_EBMEN | USB_MCFG_EMEMEN)
+#else
+#define USBH_ENABLE_INIT  (USBH_ENABLE_CE \
+                         | USB_MCFG_PFEN | USB_MCFG_RDCOMB \
+                         | USB_MCFG_SSDEN \
+                         | USB_MCFG_EBMEN | USB_MCFG_EMEMEN)
+#endif
+#define USBH_DISABLE      (USB_MCFG_EBMEN | USB_MCFG_EMEMEN)
+
+#endif                          /* Au1200 */
+
+extern int usb_disabled(void);
+
+/*-------------------------------------------------------------------------*/
+
+static void au1xxx_start_ehc(struct platform_device *dev)
+{
+        pr_debug(__FILE__ ": starting Au1xxx EHCI USB Controller\n");
+
+        /* write HW defaults again in case Yamon cleared them */
+        if (au_readl(USB_HOST_CONFIG) == 0) {
+                au_writel(0x00d02000, USB_HOST_CONFIG);
+                au_readl(USB_HOST_CONFIG);
+                udelay(1000);
+        }
+        /* enable host controller */
+        au_writel(USBH_ENABLE_CE | au_readl(USB_HOST_CONFIG), USB_HOST_CONFIG);
+        au_readl(USB_HOST_CONFIG);
+        udelay(1000);
+        au_writel(USBH_ENABLE_INIT | au_readl(USB_HOST_CONFIG),
+                  USB_HOST_CONFIG);
+        au_readl(USB_HOST_CONFIG);
+        udelay(1000);
+
+        pr_debug(__FILE__ ": Clock to USB host has been enabled\n");
+}
+
+static void au1xxx_stop_ehc(struct platform_device *dev)
+{
+        pr_debug(__FILE__ ": stopping Au1xxx EHCI USB Controller\n");
+
+        /* Disable mem */
+        au_writel(~USBH_DISABLE & au_readl(USB_HOST_CONFIG), USB_HOST_CONFIG);
+        udelay(1000);
+        /* Disable clock */
+        au_writel(~USB_MCFG_EHCCLKEN & au_readl(USB_HOST_CONFIG),
+                  USB_HOST_CONFIG);
+        au_readl(USB_HOST_CONFIG);
+}
+
+/*-------------------------------------------------------------------------*/
+
+/* configure so an HC device and id are always provided */
+/* always called with process context; sleeping is OK */
+
+/**
+ * usb_ehci_au1xxx_probe - initialize Au1xxx-based HCDs
+ * Context: !in_interrupt()
+ *
+ * Allocates basic resources for this USB host controller, and
+ * then invokes the start() method for the HCD associated with it
+ * through the hotplug entry's driver_data.
+ *
+ */
+int usb_ehci_au1xxx_probe(const struct hc_driver *driver,
+                          struct usb_hcd **hcd_out, struct platform_device *dev)
+{
+        int retval;
+        struct usb_hcd *hcd;
+        struct ehci_hcd *ehci;
+
+#if defined(CONFIG_SOC_AU1200) && defined(CONFIG_DMA_COHERENT)
+
+        /* Au1200 AB USB does not support coherent memory */
+        if (!(read_c0_prid() & 0xff)) {
+                pr_info("%s: this is chip revision AB!\n", dev->dev.name);
+                pr_info("%s: update your board or re-configure the kernel\n",
+                        dev->dev.name);
+                return -ENODEV;
+        }
+#endif
+
+        au1xxx_start_ehc(dev);
+
+        if (dev->resource[1].flags != IORESOURCE_IRQ) {
+                pr_debug("resource[1] is not IORESOURCE_IRQ");
+                retval = -ENOMEM;
+        }
+        hcd = usb_create_hcd(driver, &dev->dev, "Au1xxx");
+        if (!hcd)
+                return -ENOMEM;
+        hcd->rsrc_start = dev->resource[0].start;
+        hcd->rsrc_len = dev->resource[0].end - dev->resource[0].start + 1;
+
+        if (!request_mem_region(hcd->rsrc_start, hcd->rsrc_len, hcd_name)) {
+                pr_debug("request_mem_region failed");
+                retval = -EBUSY;
+                goto err1;
+        }
+
+        hcd->regs = ioremap(hcd->rsrc_start, hcd->rsrc_len);
+        if (!hcd->regs) {
+                pr_debug("ioremap failed");
+                retval = -ENOMEM;
+                goto err2;
+        }
+
+        ehci = hcd_to_ehci(hcd);
+        ehci->caps = hcd->regs;
+        ehci->regs = hcd->regs + HC_LENGTH(readl(&ehci->caps->hc_capbase));
+        /* cache this readonly data; minimize chip reads */
+        ehci->hcs_params = readl(&ehci->caps->hcs_params);
+
+        /* ehci_hcd_init(hcd_to_ehci(hcd)); */
+
+        retval =
+            usb_add_hcd(hcd, dev->resource[1].start, SA_INTERRUPT | SA_SHIRQ);
+        if (retval == 0)
+                return retval;
+
+        au1xxx_stop_ehc(dev);
+        iounmap(hcd->regs);
+err2:
+        release_mem_region(hcd->rsrc_start, hcd->rsrc_len);
+err1:
+        usb_put_hcd(hcd);
+        return retval;
+}
+
+/* may be called without controller electrically present */
+/* may be called with controller, bus, and devices active */
+
+/**
+ * usb_ehci_hcd_au1xxx_remove - shutdown processing for Au1xxx-based HCDs
+ * @dev: USB Host Controller being removed
+ * Context: !in_interrupt()
+ *
+ * Reverses the effect of usb_ehci_hcd_au1xxx_probe(), first invoking
+ * the HCD's stop() method.  It is always called from a thread
+ * context, normally "rmmod", "apmd", or something similar.
+ *
+ */
+void usb_ehci_au1xxx_remove(struct usb_hcd *hcd, struct platform_device *dev)
+{
+        usb_remove_hcd(hcd);
+        iounmap(hcd->regs);
+        release_mem_region(hcd->rsrc_start, hcd->rsrc_len);
+        usb_put_hcd(hcd);
+        au1xxx_stop_ehc(dev);
+}
+
+/*-------------------------------------------------------------------------*/
+
+static const struct hc_driver ehci_au1xxx_hc_driver = {
+        .description = hcd_name,
+        .product_desc = "Au1xxx EHCI",
+        .hcd_priv_size = sizeof(struct ehci_hcd),
+
+        /*
+         * generic hardware linkage
+         */
+        .irq = ehci_irq,
+        .flags = HCD_MEMORY | HCD_USB2,
+
+        /*
+         * basic lifecycle operations
+         */
+        .reset = ehci_init,
+        .start = ehci_run,
+        .stop = ehci_stop,
+
+        /*
+         * managing i/o requests and associated device resources
+         */
+        .urb_enqueue = ehci_urb_enqueue,
+        .urb_dequeue = ehci_urb_dequeue,
+        .endpoint_disable = ehci_endpoint_disable,
+
+        /*
+         * scheduling support
+         */
+        .get_frame_number = ehci_get_frame,
+
+        /*
+         * root hub support
+         */
+        .hub_status_data = ehci_hub_status_data,
+        .hub_control = ehci_hub_control,
+#ifdef  CONFIG_PM
+        .hub_suspend = ehci_hub_suspend,
+        .hub_resume = ehci_hub_resume,
+#endif
+};
+
+/*-------------------------------------------------------------------------*/
+
+static int ehci_hcd_au1xxx_drv_probe(struct device *dev)
+{
+        struct platform_device *pdev = to_platform_device(dev);
+        struct usb_hcd *hcd = NULL;
+        int ret;
+
+        pr_debug("In ehci_hcd_au1xxx_drv_probe\n");
+
+        if (usb_disabled())
+                return -ENODEV;
+
+        ret = usb_ehci_au1xxx_probe(&ehci_au1xxx_hc_driver, &hcd, pdev);
+        return ret;
+}
+
+static int ehci_hcd_au1xxx_drv_remove(struct device *dev)
+{
+        struct platform_device *pdev = to_platform_device(dev);
+        struct usb_hcd *hcd = dev_get_drvdata(dev);
+
+        usb_ehci_au1xxx_remove(hcd, pdev);
+        return 0;
+}
+
+ /*TBD*/
+/*static int ehci_hcd_au1xxx_drv_suspend(struct device *dev)
+{
+        struct platform_device *pdev = to_platform_device(dev);
+        struct usb_hcd *hcd = dev_get_drvdata(dev);
+
+        return 0;
+}
+static int ehci_hcd_au1xxx_drv_resume(struct device *dev)
+{
+        struct platform_device *pdev = to_platform_device(dev);
+        struct usb_hcd *hcd = dev_get_drvdata(dev);
+
+        return 0;
+}
+*/
+static struct device_driver ehci_hcd_au1xxx_driver = {
+        .name = "au1xxx-ehci",
+        .bus = &platform_bus_type,
+        .probe = ehci_hcd_au1xxx_drv_probe,
+        .remove = ehci_hcd_au1xxx_drv_remove,
+        /*.suspend      = ehci_hcd_au1xxx_drv_suspend, */
+        /*.resume       = ehci_hcd_au1xxx_drv_resume, */
+};
+
+static int __init ehci_hcd_au1xxx_init(void)
+{
+        pr_debug(DRIVER_INFO " (Au1xxx)\n");
+
+        return driver_register(&ehci_hcd_au1xxx_driver);
+}
+
+static void __exit ehci_hcd_au1xxx_cleanup(void)
+{
+        driver_unregister(&ehci_hcd_au1xxx_driver);
+}
+
+module_init(ehci_hcd_au1xxx_init);
+module_exit(ehci_hcd_au1xxx_cleanup);
diff --git a/drivers/usb/host/ehci-fsl.c b/drivers/usb/host/ehci-fsl.c
new file mode 100644
index 000000000000..f985f121a245
--- /dev/null
+++ b/drivers/usb/host/ehci-fsl.c
@@ -0,0 +1,366 @@
+/*
+ * (C) Copyright David Brownell 2000-2002
+ * Copyright (c) 2005 MontaVista Software
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software Foundation,
+ * Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ *
+ * Ported to 834x by Randy Vinson <rvinson@mvista.com> using code provided
+ * by Hunter Wu.
+ */
+
+#include <linux/platform_device.h>
+#include <linux/fsl_devices.h>
+
+#include "ehci-fsl.h"
+
+/* FIXME: Power Managment is un-ported so temporarily disable it */
+#undef CONFIG_PM
+
+/* PCI-based HCs are common, but plenty of non-PCI HCs are used too */
+
+/* configure so an HC device and id are always provided */
+/* always called with process context; sleeping is OK */
+
+/**
+ * usb_hcd_fsl_probe - initialize FSL-based HCDs
+ * @drvier: Driver to be used for this HCD
+ * @pdev: USB Host Controller being probed
+ * Context: !in_interrupt()
+ *
+ * Allocates basic resources for this USB host controller.
+ *
+ */
+int usb_hcd_fsl_probe(const struct hc_driver *driver,
+                      struct platform_device *pdev)
+{
+        struct fsl_usb2_platform_data *pdata;
+        struct usb_hcd *hcd;
+        struct resource *res;
+        int irq;
+        int retval;
+        unsigned int temp;
+
+        pr_debug("initializing FSL-SOC USB Controller\n");
+
+        /* Need platform data for setup */
+        pdata = (struct fsl_usb2_platform_data *)pdev->dev.platform_data;
+        if (!pdata) {
+                dev_err(&pdev->dev,
+                        "No platform data for %s.\n", pdev->dev.bus_id);
+                return -ENODEV;
+        }
+
+        /*
+         * This is a host mode driver, verify that we're supposed to be
+         * in host mode.
+         */
+        if (!((pdata->operating_mode == FSL_USB2_DR_HOST) ||
+              (pdata->operating_mode == FSL_USB2_MPH_HOST))) {
+                dev_err(&pdev->dev,
+                        "Non Host Mode configured for %s. Wrong driver linked.\n",
+                        pdev->dev.bus_id);
+                return -ENODEV;
+        }
+
+        res = platform_get_resource(pdev, IORESOURCE_IRQ, 0);
+        if (!res) {
+                dev_err(&pdev->dev,
+                        "Found HC with no IRQ. Check %s setup!\n",
+                        pdev->dev.bus_id);
+                return -ENODEV;
+        }
+        irq = res->start;
+
+        hcd = usb_create_hcd(driver, &pdev->dev, pdev->dev.bus_id);
+        if (!hcd) {
+                retval = -ENOMEM;
+                goto err1;
+        }
+
+        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        if (!res) {
+                dev_err(&pdev->dev,
+                        "Found HC with no register addr. Check %s setup!\n",
+                        pdev->dev.bus_id);
+                retval = -ENODEV;
+                goto err2;
+        }
+        hcd->rsrc_start = res->start;
+        hcd->rsrc_len = res->end - res->start + 1;
+        if (!request_mem_region(hcd->rsrc_start, hcd->rsrc_len,
+                                driver->description)) {
+                dev_dbg(&pdev->dev, "controller already in use\n");
+                retval = -EBUSY;
+                goto err2;
+        }
+        hcd->regs = ioremap(hcd->rsrc_start, hcd->rsrc_len);
+
+        if (hcd->regs == NULL) {
+                dev_dbg(&pdev->dev, "error mapping memory\n");
+                retval = -EFAULT;
+                goto err3;
+        }
+
+        /* Enable USB controller */
+        temp = in_be32(hcd->regs + 0x500);
+        out_be32(hcd->regs + 0x500, temp | 0x4);
+
+        /* Set to Host mode */
+        temp = in_le32(hcd->regs + 0x1a8);
+        out_le32(hcd->regs + 0x1a8, temp | 0x3);
+
+        retval = usb_add_hcd(hcd, irq, SA_SHIRQ);
+        if (retval != 0)
+                goto err4;
+        return retval;
+
+      err4:
+        iounmap(hcd->regs);
+      err3:
+        release_mem_region(hcd->rsrc_start, hcd->rsrc_len);
+      err2:
+        usb_put_hcd(hcd);
+      err1:
+        dev_err(&pdev->dev, "init %s fail, %d\n", pdev->dev.bus_id, retval);
+        return retval;
+}
+
+/* may be called without controller electrically present */
+/* may be called with controller, bus, and devices active */
+
+/**
+ * usb_hcd_fsl_remove - shutdown processing for FSL-based HCDs
+ * @dev: USB Host Controller being removed
+ * Context: !in_interrupt()
+ *
+ * Reverses the effect of usb_hcd_fsl_probe().
+ *
+ */
+void usb_hcd_fsl_remove(struct usb_hcd *hcd, struct platform_device *pdev)
+{
+        usb_remove_hcd(hcd);
+        iounmap(hcd->regs);
+        release_mem_region(hcd->rsrc_start, hcd->rsrc_len);
+        usb_put_hcd(hcd);
+}
+
+static void mpc83xx_setup_phy(struct ehci_hcd *ehci,
+                              enum fsl_usb2_phy_modes phy_mode,
+                              unsigned int port_offset)
+{
+        u32 portsc = 0;
+        switch (phy_mode) {
+        case FSL_USB2_PHY_ULPI:
+                portsc |= PORT_PTS_ULPI;
+                break;
+        case FSL_USB2_PHY_SERIAL:
+                portsc |= PORT_PTS_SERIAL;
+                break;
+        case FSL_USB2_PHY_UTMI_WIDE:
+                portsc |= PORT_PTS_PTW;
+                /* fall through */
+        case FSL_USB2_PHY_UTMI:
+                portsc |= PORT_PTS_UTMI;
+                break;
+        case FSL_USB2_PHY_NONE:
+                break;
+        }
+        writel(portsc, &ehci->regs->port_status[port_offset]);
+}
+
+static void mpc83xx_usb_setup(struct usb_hcd *hcd)
+{
+        struct ehci_hcd *ehci = hcd_to_ehci(hcd);
+        struct fsl_usb2_platform_data *pdata;
+        void __iomem *non_ehci = hcd->regs;
+
+        pdata =
+            (struct fsl_usb2_platform_data *)hcd->self.controller->
+            platform_data;
+        /* Enable PHY interface in the control reg. */
+        out_be32(non_ehci + FSL_SOC_USB_CTRL, 0x00000004);
+        out_be32(non_ehci + FSL_SOC_USB_SNOOP1, 0x0000001b);
+
+        if (pdata->operating_mode == FSL_USB2_DR_HOST)
+                mpc83xx_setup_phy(ehci, pdata->phy_mode, 0);
+
+        if (pdata->operating_mode == FSL_USB2_MPH_HOST) {
+                unsigned int chip, rev, svr;
+
+                svr = mfspr(SPRN_SVR);
+                chip = svr >> 16;
+                rev = (svr >> 4) & 0xf;
+
+                /* Deal with USB Erratum #14 on MPC834x Rev 1.0 & 1.1 chips */
+                if ((rev == 1) && (chip >= 0x8050) && (chip <= 0x8055))
+                        ehci->has_fsl_port_bug = 1;
+
+                if (pdata->port_enables & FSL_USB2_PORT0_ENABLED)
+                        mpc83xx_setup_phy(ehci, pdata->phy_mode, 0);
+                if (pdata->port_enables & FSL_USB2_PORT1_ENABLED)
+                        mpc83xx_setup_phy(ehci, pdata->phy_mode, 1);
+        }
+
+        /* put controller in host mode. */
+        writel(0x00000003, non_ehci + FSL_SOC_USB_USBMODE);
+        out_be32(non_ehci + FSL_SOC_USB_PRICTRL, 0x0000000c);
+        out_be32(non_ehci + FSL_SOC_USB_AGECNTTHRSH, 0x00000040);
+        out_be32(non_ehci + FSL_SOC_USB_SICTRL, 0x00000001);
+}
+
+/* called after powerup, by probe or system-pm "wakeup" */
+static int ehci_fsl_reinit(struct ehci_hcd *ehci)
+{
+        mpc83xx_usb_setup(ehci_to_hcd(ehci));
+        ehci_port_power(ehci, 0);
+
+        return 0;
+}
+
+/* called during probe() after chip reset completes */
+static int ehci_fsl_setup(struct usb_hcd *hcd)
+{
+        struct ehci_hcd *ehci = hcd_to_ehci(hcd);
+        int retval;
+
+        /* EHCI registers start at offset 0x100 */
+        ehci->caps = hcd->regs + 0x100;
+        ehci->regs = hcd->regs + 0x100 +
+            HC_LENGTH(readl(&ehci->caps->hc_capbase));
+        dbg_hcs_params(ehci, "reset");
+        dbg_hcc_params(ehci, "reset");
+
+        /* cache this readonly data; minimize chip reads */
+        ehci->hcs_params = readl(&ehci->caps->hcs_params);
+
+        retval = ehci_halt(ehci);
+        if (retval)
+                return retval;
+
+        /* data structure init */
+        retval = ehci_init(hcd);
+        if (retval)
+                return retval;
+
+        ehci->is_tdi_rh_tt = 1;
+
+        ehci->sbrn = 0x20;
+
+        ehci_reset(ehci);
+
+        retval = ehci_fsl_reinit(ehci);
+        return retval;
+}
+
+static const struct hc_driver ehci_fsl_hc_driver = {
+        .description = hcd_name,
+        .product_desc = "Freescale On-Chip EHCI Host Controller",
+        .hcd_priv_size = sizeof(struct ehci_hcd),
+
+        /*
+         * generic hardware linkage
+         */
+        .irq = ehci_irq,
+        .flags = HCD_USB2,
+
+        /*
+         * basic lifecycle operations
+         */
+        .reset = ehci_fsl_setup,
+        .start = ehci_run,
+#ifdef  CONFIG_PM
+        .suspend = ehci_bus_suspend,
+        .resume = ehci_bus_resume,
+#endif
+        .stop = ehci_stop,
+
+        /*
+         * managing i/o requests and associated device resources
+         */
+        .urb_enqueue = ehci_urb_enqueue,
+        .urb_dequeue = ehci_urb_dequeue,
+        .endpoint_disable = ehci_endpoint_disable,
+
+        /*
+         * scheduling support
+         */
+        .get_frame_number = ehci_get_frame,
+
+        /*
+         * root hub support
+         */
+        .hub_status_data = ehci_hub_status_data,
+        .hub_control = ehci_hub_control,
+        .bus_suspend = ehci_bus_suspend,
+        .bus_resume = ehci_bus_resume,
+};
+
+static int ehci_fsl_drv_probe(struct platform_device *pdev)
+{
+        if (usb_disabled())
+                return -ENODEV;
+
+        return usb_hcd_fsl_probe(&ehci_fsl_hc_driver, pdev);
+}
+
+static int ehci_fsl_drv_remove(struct platform_device *pdev)
+{
+        struct usb_hcd *hcd = platform_get_drvdata(pdev);
+
+        usb_hcd_fsl_remove(hcd, pdev);
+
+        return 0;
+}
+
+static struct platform_driver ehci_fsl_dr_driver = {
+        .probe = ehci_fsl_drv_probe,
+        .remove = ehci_fsl_drv_remove,
+        .driver = {
+                   .name = "fsl-usb2-dr",
+                   },
+};
+
+static struct platform_driver ehci_fsl_mph_driver = {
+        .probe = ehci_fsl_drv_probe,
+        .remove = ehci_fsl_drv_remove,
+        .driver = {
+                   .name = "fsl-usb2-mph",
+                   },
+};
+
+static int __init ehci_fsl_init(void)
+{
+        int retval;
+
+        pr_debug("%s: block sizes: qh %Zd qtd %Zd itd %Zd sitd %Zd\n",
+                 hcd_name,
+                 sizeof(struct ehci_qh), sizeof(struct ehci_qtd),
+                 sizeof(struct ehci_itd), sizeof(struct ehci_sitd));
+
+        retval = platform_driver_register(&ehci_fsl_dr_driver);
+        if (retval)
+                return retval;
+
+        return platform_driver_register(&ehci_fsl_mph_driver);
+}
+
+static void __exit ehci_fsl_cleanup(void)
+{
+        platform_driver_unregister(&ehci_fsl_mph_driver);
+        platform_driver_unregister(&ehci_fsl_dr_driver);
+}
+
+module_init(ehci_fsl_init);
+module_exit(ehci_fsl_cleanup);
diff --git a/drivers/usb/host/ehci-fsl.h b/drivers/usb/host/ehci-fsl.h
new file mode 100644
index 000000000000..caac0d1967d0
--- /dev/null
+++ b/drivers/usb/host/ehci-fsl.h
@@ -0,0 +1,37 @@
+/* Copyright (c) 2005 freescale semiconductor
+ * Copyright (c) 2005 MontaVista Software
+ *
+ * This program is free software; you can redistribute  it and/or modify it
+ * under  the terms of  the GNU General  Public License as published by the
+ * Free Software Foundation;  either version 2 of the  License, or (at your
+ * option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the  GNU General Public License along
+ * with this program; if not, write  to the Free Software Foundation, Inc.,
+ * 675 Mass Ave, Cambridge, MA 02139, USA.
+ */
+#ifndef _EHCI_FSL_H
+#define _EHCI_FSL_H
+
+/* offsets for the non-ehci registers in the FSL SOC USB controller */
+#define FSL_SOC_USB_ULPIVP      0x170
+#define FSL_SOC_USB_PORTSC1     0x184
+#define PORT_PTS_MSK            (3<<30)
+#define PORT_PTS_UTMI           (0<<30)
+#define PORT_PTS_ULPI           (2<<30)
+#define PORT_PTS_SERIAL         (3<<30)
+#define PORT_PTS_PTW            (1<<28)
+#define FSL_SOC_USB_PORTSC2     0x188
+#define FSL_SOC_USB_USBMODE     0x1a8
+#define FSL_SOC_USB_SNOOP1      0x400   /* NOTE: big-endian */
+#define FSL_SOC_USB_SNOOP2      0x404   /* NOTE: big-endian */
+#define FSL_SOC_USB_AGECNTTHRSH 0x408   /* NOTE: big-endian */
+#define FSL_SOC_USB_SICTRL      0x40c   /* NOTE: big-endian */
+#define FSL_SOC_USB_PRICTRL     0x410   /* NOTE: big-endian */
+#define FSL_SOC_USB_CTRL        0x500   /* NOTE: big-endian */
+#endif                          /* _EHCI_FSL_H */
diff --git a/drivers/usb/host/ehci-hcd.c b/drivers/usb/host/ehci-hcd.c
index 9dd3d14c64f3..79f2d8b9bfb6 100644
--- a/drivers/usb/host/ehci-hcd.c
+++ b/drivers/usb/host/ehci-hcd.c
@@ -889,8 +889,19 @@ MODULE_LICENSE ("GPL");
 
 #ifdef CONFIG_PCI
 #include "ehci-pci.c"
+#define EHCI_BUS_GLUED
 #endif
 
-#if !defined(CONFIG_PCI)
+#ifdef CONFIG_PPC_83xx
+#include "ehci-fsl.c"
+#define EHCI_BUS_GLUED
+#endif
+
+#ifdef CONFIG_SOC_AU1X00
+#include "ehci-au1xxx.c"
+#define EHCI_BUS_GLUED
+#endif
+
+#ifndef EHCI_BUS_GLUED
 #error "missing bus glue for ehci-hcd"
 #endif
diff --git a/drivers/usb/host/ehci-hub.c b/drivers/usb/host/ehci-hub.c
index 69b0b9be7a64..d03e3cad5ca8 100644
--- a/drivers/usb/host/ehci-hub.c
+++ b/drivers/usb/host/ehci-hub.c
@@ -359,6 +359,8 @@ static int ehci_hub_control (
                 case USB_PORT_FEAT_SUSPEND:
                         if (temp & PORT_RESET)
                                 goto error;
+                        if (ehci->no_selective_suspend)
+                                break;
                         if (temp & PORT_SUSPEND) {
                                 if ((temp & PORT_PE) == 0)
                                         goto error;
@@ -514,6 +516,8 @@ static int ehci_hub_control (
                 temp &= ~PORT_RWC_BITS;
                 switch (wValue) {
                 case USB_PORT_FEAT_SUSPEND:
+                        if (ehci->no_selective_suspend)
+                                break;
                         if ((temp & PORT_PE) == 0
                                         || (temp & PORT_RESET) != 0)
                                 goto error;
diff --git a/drivers/usb/host/ehci-mem.c b/drivers/usb/host/ehci-mem.c
index 91c2ab43cbcc..766061e0260a 100644
--- a/drivers/usb/host/ehci-mem.c
+++ b/drivers/usb/host/ehci-mem.c
@@ -75,7 +75,6 @@ static void qh_destroy (struct kref *kref)
         }
         if (qh->dummy)
                 ehci_qtd_free (ehci, qh->dummy);
-        usb_put_dev (qh->dev);
         dma_pool_free (ehci->qh_pool, qh, qh->qh_dma);
 }
 
@@ -221,13 +220,9 @@ static int ehci_mem_init (struct ehci_hcd *ehci, gfp_t flags)
                 ehci->periodic [i] = EHCI_LIST_END;
 
         /* software shadow of hardware table */
-        ehci->pshadow = kmalloc (ehci->periodic_size * sizeof (void *), flags);
-        if (ehci->pshadow == NULL) {
-                goto fail;
-        }
-        memset (ehci->pshadow, 0, ehci->periodic_size * sizeof (void *));
-
-        return 0;
+        ehci->pshadow = kcalloc(ehci->periodic_size, sizeof(void *), flags);
+        if (ehci->pshadow != NULL)
+                return 0;
 
 fail:
         ehci_dbg (ehci, "couldn't init memory\n");
diff --git a/drivers/usb/host/ehci-pci.c b/drivers/usb/host/ehci-pci.c
index 3a6687df5594..1e03f1a5a5fd 100644
--- a/drivers/usb/host/ehci-pci.c
+++ b/drivers/usb/host/ehci-pci.c
@@ -106,11 +106,11 @@ static int ehci_pci_setup(struct usb_hcd *hcd)
                 }
                 break;
         case PCI_VENDOR_ID_NVIDIA:
+                switch (pdev->device) {
                 /* NVidia reports that certain chips don't handle
                  * QH, ITD, or SITD addresses above 2GB.  (But TD,
                  * data buffer, and periodic schedule are normal.)
                  */
-                switch (pdev->device) {
                 case 0x003c:    /* MCP04 */
                 case 0x005b:    /* CK804 */
                 case 0x00d8:    /* CK8 */
@@ -120,6 +120,14 @@ static int ehci_pci_setup(struct usb_hcd *hcd)
                                 ehci_warn(ehci, "can't enable NVidia "
                                         "workaround for >2GB RAM\n");
                         break;
+                /* Some NForce2 chips have problems with selective suspend;
+                 * fixed in newer silicon.
+                 */
+                case 0x0068:
+                        pci_read_config_dword(pdev, PCI_REVISION_ID, &temp);
+                        if ((temp & 0xff) < 0xa4)
+                                ehci->no_selective_suspend = 1;
+                        break;
                 }
                 break;
         }
@@ -163,6 +171,21 @@ static int ehci_pci_setup(struct usb_hcd *hcd)
                         device_init_wakeup(&pdev->dev, 1);
         }
 
+#ifdef  CONFIG_USB_SUSPEND
+        /* REVISIT: the controller works fine for wakeup iff the root hub
+         * itself is "globally" suspended, but usbcore currently doesn't
+         * understand such things.
+         *
+         * System suspend currently expects to be able to suspend the entire
+         * device tree, device-at-a-time.  If we failed selective suspend
+         * reports, system suspend would fail; so the root hub code must claim
+         * success.  That's lying to usbcore, and it matters for for runtime
+         * PM scenarios with selective suspend and remote wakeup...
+         */
+        if (ehci->no_selective_suspend && device_can_wakeup(&pdev->dev))
+                ehci_warn(ehci, "selective suspend/wakeup unavailable\n");
+#endif
+
         retval = ehci_pci_reinit(ehci, pdev);
 done:
         return retval;
diff --git a/drivers/usb/host/ehci-q.c b/drivers/usb/host/ehci-q.c
index 9b13bf2fa98d..e469221e7ec3 100644
--- a/drivers/usb/host/ehci-q.c
+++ b/drivers/usb/host/ehci-q.c
@@ -702,7 +702,7 @@ qh_make (
         }
 
         /* support for tt scheduling, and access to toggles */
-        qh->dev = usb_get_dev (urb->dev);
+        qh->dev = urb->dev;
 
         /* using TT? */
         switch (urb->dev->speed) {
@@ -721,7 +721,14 @@ qh_make (
                 info1 |= maxp << 16;
 
                 info2 |= (EHCI_TUNE_MULT_TT << 30);
-                info2 |= urb->dev->ttport << 23;
+
+                /* Some Freescale processors have an erratum in which the
+                 * port number in the queue head was 0..N-1 instead of 1..N.
+                 */
+                if (ehci_has_fsl_portno_bug(ehci))
+                        info2 |= (urb->dev->ttport-1) << 23;
+                else
+                        info2 |= urb->dev->ttport << 23;
 
                 /* set the address of the TT; for TDI's integrated
                  * root hub tt, leave it zeroed.
@@ -1015,12 +1022,14 @@ static void start_unlink_async (struct ehci_hcd *ehci, struct ehci_qh *qh)
         /* stop async schedule right now? */
         if (unlikely (qh == ehci->async)) {
                 /* can't get here without STS_ASS set */
-                if (ehci_to_hcd(ehci)->state != HC_STATE_HALT) {
+                if (ehci_to_hcd(ehci)->state != HC_STATE_HALT
+                                && !ehci->reclaim) {
+                        /* ... and CMD_IAAD clear */
                         writel (cmd & ~CMD_ASE, &ehci->regs->command);
                         wmb ();
                         // handshake later, if we need to
+                        timer_action_done (ehci, TIMER_ASYNC_OFF);
                 }
-                timer_action_done (ehci, TIMER_ASYNC_OFF);
                 return;
         } 
 
diff --git a/drivers/usb/host/ehci-sched.c b/drivers/usb/host/ehci-sched.c
index ebcca9700671..5871944e6145 100644
--- a/drivers/usb/host/ehci-sched.c
+++ b/drivers/usb/host/ehci-sched.c
@@ -707,6 +707,7 @@ iso_stream_init (
         } else {
                 u32             addr;
                 int             think_time;
+                int             hs_transfers;
 
                 addr = dev->ttport << 24;
                 if (!ehci_is_TDI(ehci)
@@ -719,6 +720,7 @@ iso_stream_init (
                 think_time = dev->tt ? dev->tt->think_time : 0;
                 stream->tt_usecs = NS_TO_US (think_time + usb_calc_bus_time (
                                 dev->speed, is_input, 1, maxp));
+                hs_transfers = max (1u, (maxp + 187) / 188);
                 if (is_input) {
                         u32     tmp;
 
@@ -727,12 +729,11 @@ iso_stream_init (
                         stream->usecs = HS_USECS_ISO (1);
                         stream->raw_mask = 1;
 
-                        /* pessimistic c-mask */
-                        tmp = usb_calc_bus_time (USB_SPEED_FULL, 1, 0, maxp)
-                                        / (125 * 1000);
-                        stream->raw_mask |= 3 << (tmp + 9);
+                        /* c-mask as specified in USB 2.0 11.18.4 3.c */
+                        tmp = (1 << (hs_transfers + 2)) - 1;
+                        stream->raw_mask |= tmp << (8 + 2);
                 } else
-                        stream->raw_mask = smask_out [maxp / 188];
+                        stream->raw_mask = smask_out [hs_transfers - 1];
                 bandwidth = stream->usecs + stream->c_usecs;
                 bandwidth /= 1 << (interval + 2);
 
@@ -863,9 +864,8 @@ iso_sched_alloc (unsigned packets, gfp_t mem_flags)
         int                     size = sizeof *iso_sched;
 
         size += packets * sizeof (struct ehci_iso_packet);
-        iso_sched = kmalloc (size, mem_flags);
+        iso_sched = kzalloc(size, mem_flags);
         if (likely (iso_sched != NULL)) {
-                memset(iso_sched, 0, size);
                 INIT_LIST_HEAD (&iso_sched->td_list);
         }
         return iso_sched;
@@ -1398,7 +1398,7 @@ itd_complete (
          */
 
         /* give urb back to the driver ... can be out-of-order */
-        dev = usb_get_dev (urb->dev);
+        dev = urb->dev;
         ehci_urb_done (ehci, urb, regs);
         urb = NULL;
 
@@ -1417,7 +1417,6 @@ itd_complete (
                         (stream->bEndpointAddress & USB_DIR_IN) ? "in" : "out");
         }
         iso_stream_put (ehci, stream);
-        usb_put_dev (dev);
 
         return 1;
 }
@@ -1764,7 +1763,7 @@ sitd_complete (
          */
 
         /* give urb back to the driver */
-        dev = usb_get_dev (urb->dev);
+        dev = urb->dev;
         ehci_urb_done (ehci, urb, regs);
         urb = NULL;
 
@@ -1783,7 +1782,6 @@ sitd_complete (
                         (stream->bEndpointAddress & USB_DIR_IN) ? "in" : "out");
         }
         iso_stream_put (ehci, stream);
-        usb_put_dev (dev);
 
         return 1;
 }
diff --git a/drivers/usb/host/ehci.h b/drivers/usb/host/ehci.h
index 18e257c2bdb5..679c1cdcc915 100644
--- a/drivers/usb/host/ehci.h
+++ b/drivers/usb/host/ehci.h
@@ -88,7 +88,12 @@ struct ehci_hcd {			/* one per controller */
         unsigned long           next_statechange;
         u32                     command;
 
+        /* SILICON QUIRKS */
         unsigned                is_tdi_rh_tt:1; /* TDI roothub with TT */
+        unsigned                no_selective_suspend:1;
+        unsigned                has_fsl_port_bug:1; /* FreeScale */
+
+        u8                      sbrn;           /* packed release number */
 
         /* irq statistics */
 #ifdef EHCI_STATS
@@ -97,7 +102,6 @@ struct ehci_hcd {			/* one per controller */
 #else
 #       define COUNT(x) do {} while (0)
 #endif
-        u8                      sbrn;           /* packed release number */
 };
 
 /* convert between an HCD pointer and the corresponding EHCI_HCD */ 
@@ -638,6 +642,18 @@ ehci_port_speed(struct ehci_hcd *ehci, unsigned int portsc)
 
 /*-------------------------------------------------------------------------*/
 
+#ifdef CONFIG_PPC_83xx
+/* Some Freescale processors have an erratum in which the TT
+ * port number in the queue head was 0..N-1 instead of 1..N.
+ */
+#define ehci_has_fsl_portno_bug(e)              ((e)->has_fsl_port_bug)
+#else
+#define ehci_has_fsl_portno_bug(e)              (0)
+#endif
+
+
+/*-------------------------------------------------------------------------*/
+
 #ifndef DEBUG
 #define STUB_DEBUG_FILES
 #endif  /* DEBUG */
diff --git a/drivers/usb/host/hc_crisv10.c b/drivers/usb/host/hc_crisv10.c
index 641268d7e6f3..2fe7fd19437b 100644
--- a/drivers/usb/host/hc_crisv10.c
+++ b/drivers/usb/host/hc_crisv10.c
@@ -2137,10 +2137,9 @@ static int etrax_usb_submit_bulk_urb(struct urb *urb)
         urb->status = -EINPROGRESS;
 
         /* Setup the hcpriv data. */
-        urb_priv = kmalloc(sizeof(etrax_urb_priv_t), KMALLOC_FLAG);
+        urb_priv = kzalloc(sizeof(etrax_urb_priv_t), KMALLOC_FLAG);
         assert(urb_priv != NULL);
         /* This sets rx_offset to 0. */
-        memset(urb_priv, 0, sizeof(etrax_urb_priv_t));
         urb_priv->urb_state = NOT_STARTED;
         urb->hcpriv = urb_priv;
 
@@ -2475,10 +2474,9 @@ static int etrax_usb_submit_ctrl_urb(struct urb *urb)
         urb->status = -EINPROGRESS;
 
         /* Setup the hcpriv data. */
-        urb_priv = kmalloc(sizeof(etrax_urb_priv_t), KMALLOC_FLAG);
+        urb_priv = kzalloc(sizeof(etrax_urb_priv_t), KMALLOC_FLAG);
         assert(urb_priv != NULL);
         /* This sets rx_offset to 0. */
-        memset(urb_priv, 0, sizeof(etrax_urb_priv_t));
         urb_priv->urb_state = NOT_STARTED;
         urb->hcpriv = urb_priv;
 
@@ -2767,9 +2765,8 @@ static void etrax_usb_add_to_intr_sb_list(struct urb *urb, int epid)
         maxlen = usb_maxpacket(urb->dev, urb->pipe, usb_pipeout(urb->pipe));
         interval = urb->interval;
 
-        urb_priv = kmalloc(sizeof(etrax_urb_priv_t), KMALLOC_FLAG);
+        urb_priv = kzalloc(sizeof(etrax_urb_priv_t), KMALLOC_FLAG);
         assert(urb_priv != NULL);
-        memset(urb_priv, 0, sizeof(etrax_urb_priv_t));
         urb->hcpriv = urb_priv;
 
         first_ep = &TxIntrEPList[0];
@@ -2997,9 +2994,8 @@ static void etrax_usb_add_to_isoc_sb_list(struct urb *urb, int epid)
 
         prev_sb_desc = next_sb_desc = temp_sb_desc = NULL;
 
-        urb_priv = kmalloc(sizeof(etrax_urb_priv_t), GFP_ATOMIC);
+        urb_priv = kzalloc(sizeof(etrax_urb_priv_t), GFP_ATOMIC);
         assert(urb_priv != NULL);
-        memset(urb_priv, 0, sizeof(etrax_urb_priv_t));
 
         urb->hcpriv = urb_priv;
         urb_priv->epid = epid;
diff --git a/drivers/usb/host/isp116x-hcd.c b/drivers/usb/host/isp116x-hcd.c
index 972ce04889f8..e99210b7909b 100644
--- a/drivers/usb/host/isp116x-hcd.c
+++ b/drivers/usb/host/isp116x-hcd.c
@@ -724,7 +724,7 @@ static int isp116x_urb_enqueue(struct usb_hcd *hcd,
                 ep = hep->hcpriv;
         else {
                 INIT_LIST_HEAD(&ep->schedule);
-                ep->udev = usb_get_dev(udev);
+                ep->udev = udev;
                 ep->epnum = epnum;
                 ep->maxpacket = usb_maxpacket(udev, urb->pipe, is_out);
                 usb_settoggle(udev, epnum, is_out, 0);
@@ -891,7 +891,6 @@ static void isp116x_endpoint_disable(struct usb_hcd *hcd,
         if (!list_empty(&hep->urb_list))
                 WARN("ep %p not empty?\n", ep);
 
-        usb_put_dev(ep->udev);
         kfree(ep);
         hep->hcpriv = NULL;
 }
@@ -1553,7 +1552,7 @@ static struct hc_driver isp116x_hc_driver = {
 
 /*----------------------------------------------------------------*/
 
-static int __init_or_module isp116x_remove(struct platform_device *pdev)
+static int isp116x_remove(struct platform_device *pdev)
 {
         struct usb_hcd *hcd = platform_get_drvdata(pdev);
         struct isp116x *isp116x;
diff --git a/drivers/usb/host/ohci-at91.c b/drivers/usb/host/ohci-at91.c
new file mode 100644
index 000000000000..980030d684d5
--- /dev/null
+++ b/drivers/usb/host/ohci-at91.c
@@ -0,0 +1,306 @@
+/*
+ * OHCI HCD (Host Controller Driver) for USB.
+ *
+ *  Copyright (C) 2004 SAN People (Pty) Ltd.
+ *  Copyright (C) 2005 Thibaut VARENE <varenet@parisc-linux.org>
+ *
+ * AT91RM9200 Bus Glue
+ *
+ * Based on fragments of 2.4 driver by Rick Bronson.
+ * Based on ohci-omap.c
+ *
+ * This file is licenced under the GPL.
+ */
+
+#include <linux/clk.h>
+#include <linux/platform_device.h>
+
+#include <asm/mach-types.h>
+#include <asm/hardware.h>
+#include <asm/arch/board.h>
+
+#ifndef CONFIG_ARCH_AT91RM9200
+#error "This file is AT91RM9200 bus glue.  CONFIG_ARCH_AT91RM9200 must be defined."
+#endif
+
+/* interface and function clocks */
+static struct clk *iclk, *fclk;
+
+extern int usb_disabled(void);
+
+/*-------------------------------------------------------------------------*/
+
+static void at91_start_hc(struct platform_device *pdev)
+{
+        struct usb_hcd *hcd = platform_get_drvdata(pdev);
+        struct ohci_regs __iomem *regs = hcd->regs;
+
+        dev_dbg(&pdev->dev, "starting AT91RM9200 OHCI USB Controller\n");
+
+        /*
+         * Start the USB clocks.
+         */
+        clk_enable(iclk);
+        clk_enable(fclk);
+
+        /*
+         * The USB host controller must remain in reset.
+         */
+        writel(0, &regs->control);
+}
+
+static void at91_stop_hc(struct platform_device *pdev)
+{
+        struct usb_hcd *hcd = platform_get_drvdata(pdev);
+        struct ohci_regs __iomem *regs = hcd->regs;
+
+        dev_dbg(&pdev->dev, "stopping AT91RM9200 OHCI USB Controller\n");
+
+        /*
+         * Put the USB host controller into reset.
+         */
+        writel(0, &regs->control);
+
+        /*
+         * Stop the USB clocks.
+         */
+        clk_disable(fclk);
+        clk_disable(iclk);
+}
+
+
+/*-------------------------------------------------------------------------*/
+
+static int usb_hcd_at91_remove (struct usb_hcd *, struct platform_device *);
+
+/* configure so an HC device and id are always provided */
+/* always called with process context; sleeping is OK */
+
+
+/**
+ * usb_hcd_at91_probe - initialize AT91RM9200-based HCDs
+ * Context: !in_interrupt()
+ *
+ * Allocates basic resources for this USB host controller, and
+ * then invokes the start() method for the HCD associated with it
+ * through the hotplug entry's driver_data.
+ *
+ * Store this function in the HCD's struct pci_driver as probe().
+ */
+int usb_hcd_at91_probe (const struct hc_driver *driver, struct platform_device *pdev)
+{
+        int retval;
+        struct usb_hcd *hcd = NULL;
+
+        if (pdev->num_resources != 2) {
+                pr_debug("hcd probe: invalid num_resources");
+                return -ENODEV;
+        }
+
+        if ((pdev->resource[0].flags != IORESOURCE_MEM) || (pdev->resource[1].flags != IORESOURCE_IRQ)) {
+                pr_debug("hcd probe: invalid resource type\n");
+                return -ENODEV;
+        }
+
+        hcd = usb_create_hcd(driver, &pdev->dev, "at91rm9200");
+        if (!hcd)
+                return -ENOMEM;
+        hcd->rsrc_start = pdev->resource[0].start;
+        hcd->rsrc_len = pdev->resource[0].end - pdev->resource[0].start + 1;
+
+        if (!request_mem_region(hcd->rsrc_start, hcd->rsrc_len, hcd_name)) {
+                pr_debug("request_mem_region failed\n");
+                retval = -EBUSY;
+                goto err1;
+        }
+
+        hcd->regs = ioremap(hcd->rsrc_start, hcd->rsrc_len);
+        if (!hcd->regs) {
+                pr_debug("ioremap failed\n");
+                retval = -EIO;
+                goto err2;
+        }
+
+        iclk = clk_get(&pdev->dev, "ohci_clk");
+        fclk = clk_get(&pdev->dev, "uhpck");
+
+        at91_start_hc(pdev);
+        ohci_hcd_init(hcd_to_ohci(hcd));
+
+        retval = usb_add_hcd(hcd, pdev->resource[1].start, SA_INTERRUPT);
+        if (retval == 0)
+                return retval;
+
+        /* Error handling */
+        at91_stop_hc(pdev);
+
+        clk_put(fclk);
+        clk_put(iclk);
+
+        iounmap(hcd->regs);
+
+ err2:
+        release_mem_region(hcd->rsrc_start, hcd->rsrc_len);
+
+ err1:
+        usb_put_hcd(hcd);
+        return retval;
+}
+
+
+/* may be called without controller electrically present */
+/* may be called with controller, bus, and devices active */
+
+/**
+ * usb_hcd_at91_remove - shutdown processing for AT91RM9200-based HCDs
+ * @dev: USB Host Controller being removed
+ * Context: !in_interrupt()
+ *
+ * Reverses the effect of usb_hcd_at91_probe(), first invoking
+ * the HCD's stop() method.  It is always called from a thread
+ * context, normally "rmmod", "apmd", or something similar.
+ *
+ */
+static int usb_hcd_at91_remove (struct usb_hcd *hcd, struct platform_device *pdev)
+{
+        usb_remove_hcd(hcd);
+        at91_stop_hc(pdev);
+        iounmap(hcd->regs);
+        release_mem_region(hcd->rsrc_start, hcd->rsrc_len);
+
+        clk_put(fclk);
+        clk_put(iclk);
+        fclk = iclk = NULL;
+
+        dev_set_drvdata(&pdev->dev, NULL);
+        return 0;
+}
+
+/*-------------------------------------------------------------------------*/
+
+static int __devinit
+ohci_at91_start (struct usb_hcd *hcd)
+{
+//      struct at91_ohci_data   *board = hcd->self.controller->platform_data;
+        struct ohci_hcd         *ohci = hcd_to_ohci (hcd);
+        int                     ret;
+
+        if ((ret = ohci_init(ohci)) < 0)
+                return ret;
+
+        if ((ret = ohci_run(ohci)) < 0) {
+                err("can't start %s", hcd->self.bus_name);
+                ohci_stop(hcd);
+                return ret;
+        }
+//      hcd->self.root_hub->maxchild = board->ports;
+        return 0;
+}
+
+/*-------------------------------------------------------------------------*/
+
+static const struct hc_driver ohci_at91_hc_driver = {
+        .description =          hcd_name,
+        .product_desc =         "AT91RM9200 OHCI",
+        .hcd_priv_size =        sizeof(struct ohci_hcd),
+
+        /*
+         * generic hardware linkage
+         */
+        .irq =                  ohci_irq,
+        .flags =                HCD_USB11 | HCD_MEMORY,
+
+        /*
+         * basic lifecycle operations
+         */
+        .start =                ohci_at91_start,
+        .stop =                 ohci_stop,
+
+        /*
+         * managing i/o requests and associated device resources
+         */
+        .urb_enqueue =          ohci_urb_enqueue,
+        .urb_dequeue =          ohci_urb_dequeue,
+        .endpoint_disable =     ohci_endpoint_disable,
+
+        /*
+         * scheduling support
+         */
+        .get_frame_number =     ohci_get_frame,
+
+        /*
+         * root hub support
+         */
+        .hub_status_data =      ohci_hub_status_data,
+        .hub_control =          ohci_hub_control,
+
+#ifdef CONFIG_PM
+        .hub_suspend =          ohci_hub_suspend,
+        .hub_resume =           ohci_hub_resume,
+#endif
+        .start_port_reset =     ohci_start_port_reset,
+};
+
+/*-------------------------------------------------------------------------*/
+
+static int ohci_hcd_at91_drv_probe(struct platform_device *dev)
+{
+        return usb_hcd_at91_probe(&ohci_at91_hc_driver, dev);
+}
+
+static int ohci_hcd_at91_drv_remove(struct platform_device *dev)
+{
+        return usb_hcd_at91_remove(platform_get_drvdata(dev), dev);
+}
+
+#ifdef CONFIG_PM
+static int ohci_hcd_at91_drv_suspend(struct platform_device *dev, u32 state, u32 level)
+{
+        printk("%s(%s:%d): not implemented yet\n",
+                __func__, __FILE__, __LINE__);
+
+        clk_disable(fclk);
+
+        return 0;
+}
+
+static int ohci_hcd_at91_drv_resume(struct platform_device *dev, u32 state)
+{
+        printk("%s(%s:%d): not implemented yet\n",
+                __func__, __FILE__, __LINE__);
+
+        clk_enable(fclk);
+
+        return 0;
+}
+#else
+#define ohci_hcd_at91_drv_suspend NULL
+#define ohci_hcd_at91_drv_resume  NULL
+#endif
+
+static struct platform_driver ohci_hcd_at91_driver = {
+        .probe          = ohci_hcd_at91_drv_probe,
+        .remove         = ohci_hcd_at91_drv_remove,
+        .suspend        = ohci_hcd_at91_drv_suspend,
+        .resume         = ohci_hcd_at91_drv_resume,
+        .driver         = {
+                .name   = "at91rm9200-ohci",
+                .owner  = THIS_MODULE,
+        },
+};
+
+static int __init ohci_hcd_at91_init (void)
+{
+        if (usb_disabled())
+                return -ENODEV;
+
+        return platform_driver_register(&ohci_hcd_at91_driver);
+}
+
+static void __exit ohci_hcd_at91_cleanup (void)
+{
+        platform_driver_unregister(&ohci_hcd_at91_driver);
+}
+
+module_init (ohci_hcd_at91_init);
+module_exit (ohci_hcd_at91_cleanup);
diff --git a/drivers/usb/host/ohci-au1xxx.c b/drivers/usb/host/ohci-au1xxx.c
index db280ca7b7a0..a1c8b3b2fcc7 100644
--- a/drivers/usb/host/ohci-au1xxx.c
+++ b/drivers/usb/host/ohci-au1xxx.c
@@ -23,6 +23,8 @@
 
 #include <asm/mach-au1x00/au1000.h>
 
+#ifndef CONFIG_SOC_AU1200
+
 #define USBH_ENABLE_BE (1<<0)
 #define USBH_ENABLE_C  (1<<1)
 #define USBH_ENABLE_E  (1<<2)
@@ -37,21 +39,68 @@
 #error not byte order defined
 #endif
 
+#else   /* Au1200 */
+
+#define USB_HOST_CONFIG    (USB_MSR_BASE + USB_MSR_MCFG)
+#define USB_MCFG_PFEN     (1<<31)
+#define USB_MCFG_RDCOMB   (1<<30)
+#define USB_MCFG_SSDEN    (1<<23)
+#define USB_MCFG_OHCCLKEN (1<<16)
+#define USB_MCFG_UCAM     (1<<7)
+#define USB_MCFG_OBMEN    (1<<1)
+#define USB_MCFG_OMEMEN   (1<<0)
+
+#define USBH_ENABLE_CE    USB_MCFG_OHCCLKEN
+#ifdef CONFIG_DMA_COHERENT
+#define USBH_ENABLE_INIT  (USB_MCFG_OHCCLKEN \
+                         | USB_MCFG_PFEN | USB_MCFG_RDCOMB \
+                         | USB_MCFG_SSDEN | USB_MCFG_UCAM \
+                         | USB_MCFG_OBMEN | USB_MCFG_OMEMEN)
+#else
+#define USBH_ENABLE_INIT  (USB_MCFG_OHCCLKEN \
+                         | USB_MCFG_PFEN | USB_MCFG_RDCOMB \
+                         | USB_MCFG_SSDEN \
+                         | USB_MCFG_OBMEN | USB_MCFG_OMEMEN)
+#endif
+#define USBH_DISABLE      (USB_MCFG_OBMEN | USB_MCFG_OMEMEN)
+
+#endif  /* Au1200 */
+
 extern int usb_disabled(void);
 
 /*-------------------------------------------------------------------------*/
 
-static void au1xxx_start_hc(struct platform_device *dev)
+static void au1xxx_start_ohc(struct platform_device *dev)
 {
         printk(KERN_DEBUG __FILE__
                 ": starting Au1xxx OHCI USB Controller\n");
 
         /* enable host controller */
+
+#ifndef CONFIG_SOC_AU1200
+
         au_writel(USBH_ENABLE_CE, USB_HOST_CONFIG);
         udelay(1000);
         au_writel(USBH_ENABLE_INIT, USB_HOST_CONFIG);
         udelay(1000);
 
+#else   /* Au1200 */
+
+        /* write HW defaults again in case Yamon cleared them */
+        if (au_readl(USB_HOST_CONFIG) == 0) {
+                au_writel(0x00d02000, USB_HOST_CONFIG);
+                au_readl(USB_HOST_CONFIG);
+                udelay(1000);
+        }
+        au_writel(USBH_ENABLE_CE | au_readl(USB_HOST_CONFIG), USB_HOST_CONFIG);
+        au_readl(USB_HOST_CONFIG);
+        udelay(1000);
+        au_writel(USBH_ENABLE_INIT | au_readl(USB_HOST_CONFIG), USB_HOST_CONFIG);
+        au_readl(USB_HOST_CONFIG);
+        udelay(1000);
+
+#endif  /* Au1200 */
+
         /* wait for reset complete (read register twice; see au1500 errata) */
         while (au_readl(USB_HOST_CONFIG),
                 !(au_readl(USB_HOST_CONFIG) & USBH_ENABLE_RD))
@@ -61,13 +110,25 @@ static void au1xxx_start_hc(struct platform_device *dev)
         ": Clock to USB host has been enabled \n");
 }
 
-static void au1xxx_stop_hc(struct platform_device *dev)
+static void au1xxx_stop_ohc(struct platform_device *dev)
 {
         printk(KERN_DEBUG __FILE__
                ": stopping Au1xxx OHCI USB Controller\n");
 
+#ifndef CONFIG_SOC_AU1200
+
         /* Disable clock */
         au_writel(au_readl(USB_HOST_CONFIG) & ~USBH_ENABLE_CE, USB_HOST_CONFIG);
+
+#else   /* Au1200 */
+
+        /* Disable mem */
+        au_writel(~USBH_DISABLE & au_readl(USB_HOST_CONFIG), USB_HOST_CONFIG);
+        udelay(1000);
+        /* Disable clock */
+        au_writel(~USBH_ENABLE_CE & au_readl(USB_HOST_CONFIG), USB_HOST_CONFIG);
+        au_readl(USB_HOST_CONFIG);
+#endif  /* Au1200 */
 }
 
 
@@ -78,7 +139,7 @@ static void au1xxx_stop_hc(struct platform_device *dev)
 
 
 /**
- * usb_hcd_au1xxx_probe - initialize Au1xxx-based HCDs
+ * usb_ohci_au1xxx_probe - initialize Au1xxx-based HCDs
  * Context: !in_interrupt()
  *
  * Allocates basic resources for this USB host controller, and
@@ -86,14 +147,25 @@ static void au1xxx_stop_hc(struct platform_device *dev)
  * through the hotplug entry's driver_data.
  *
  */
-int usb_hcd_au1xxx_probe (const struct hc_driver *driver,
+static int usb_ohci_au1xxx_probe(const struct hc_driver *driver,
                           struct platform_device *dev)
 {
         int retval;
         struct usb_hcd *hcd;
 
-        if(dev->resource[1].flags != IORESOURCE_IRQ) {
-                pr_debug ("resource[1] is not IORESOURCE_IRQ");
+#if defined(CONFIG_SOC_AU1200) && defined(CONFIG_DMA_COHERENT)
+        /* Au1200 AB USB does not support coherent memory */
+        if (!(read_c0_prid() & 0xff)) {
+                pr_info("%s: this is chip revision AB !!\n",
+                        dev->dev.name);
+                pr_info("%s: update your board or re-configure the kernel\n",
+                        dev->dev.name);
+                return -ENODEV;
+        }
+#endif
+
+        if (dev->resource[1].flags != IORESOURCE_IRQ) {
+                pr_debug("resource[1] is not IORESOURCE_IRQ\n");
                 return -ENOMEM;
         }
 
@@ -104,26 +176,26 @@ int usb_hcd_au1xxx_probe (const struct hc_driver *driver,
         hcd->rsrc_len = dev->resource[0].end - dev->resource[0].start + 1;
 
         if (!request_mem_region(hcd->rsrc_start, hcd->rsrc_len, hcd_name)) {
-                pr_debug("request_mem_region failed");
+                pr_debug("request_mem_region failed\n");
                 retval = -EBUSY;
                 goto err1;
         }
 
         hcd->regs = ioremap(hcd->rsrc_start, hcd->rsrc_len);
         if (!hcd->regs) {
-                pr_debug("ioremap failed");
+                pr_debug("ioremap failed\n");
                 retval = -ENOMEM;
                 goto err2;
         }
 
-        au1xxx_start_hc(dev);
+        au1xxx_start_ohc(dev);
         ohci_hcd_init(hcd_to_ohci(hcd));
 
-        retval = usb_add_hcd(hcd, dev->resource[1].start, SA_INTERRUPT);
+        retval = usb_add_hcd(hcd, dev->resource[1].start, SA_INTERRUPT | SA_SHIRQ);
         if (retval == 0)
                 return retval;
 
-        au1xxx_stop_hc(dev);
+        au1xxx_stop_ohc(dev);
         iounmap(hcd->regs);
  err2:
         release_mem_region(hcd->rsrc_start, hcd->rsrc_len);
@@ -146,10 +218,10 @@ int usb_hcd_au1xxx_probe (const struct hc_driver *driver,
  * context, normally "rmmod", "apmd", or something similar.
  *
  */
-void usb_hcd_au1xxx_remove (struct usb_hcd *hcd, struct platform_device *dev)
+static void usb_ohci_au1xxx_remove(struct usb_hcd *hcd, struct platform_device *dev)
 {
         usb_remove_hcd(hcd);
-        au1xxx_stop_hc(dev);
+        au1xxx_stop_ohc(dev);
         iounmap(hcd->regs);
         release_mem_region(hcd->rsrc_start, hcd->rsrc_len);
         usb_put_hcd(hcd);
@@ -235,7 +307,7 @@ static int ohci_hcd_au1xxx_drv_probe(struct platform_device *pdev)
         if (usb_disabled())
                 return -ENODEV;
 
-        ret = usb_hcd_au1xxx_probe(&ohci_au1xxx_hc_driver, pdev);
+        ret = usb_ohci_au1xxx_probe(&ohci_au1xxx_hc_driver, pdev);
         return ret;
 }
 
@@ -243,7 +315,7 @@ static int ohci_hcd_au1xxx_drv_remove(struct platform_device *pdev)
 {
         struct usb_hcd *hcd = platform_get_drvdata(pdev);
 
-        usb_hcd_au1xxx_remove(hcd, pdev);
+        usb_ohci_au1xxx_remove(hcd, pdev);
         return 0;
 }
         /*TBD*/
diff --git a/drivers/usb/host/ohci-hcd.c b/drivers/usb/host/ohci-hcd.c
index a4b12404ae08..544f7589912f 100644
--- a/drivers/usb/host/ohci-hcd.c
+++ b/drivers/usb/host/ohci-hcd.c
@@ -443,11 +443,16 @@ ohci_reboot (struct notifier_block *block, unsigned long code, void *null)
 static int ohci_init (struct ohci_hcd *ohci)
 {
         int ret;
+        struct usb_hcd *hcd = ohci_to_hcd(ohci);
 
         disable (ohci);
-        ohci->regs = ohci_to_hcd(ohci)->regs;
+        ohci->regs = hcd->regs;
         ohci->next_statechange = jiffies;
 
+        /* REVISIT this BIOS handshake is now moved into PCI "quirks", and
+         * was never needed for most non-PCI systems ... remove the code?
+         */
+
 #ifndef IR_DISABLE
         /* SMM owns the HC?  not for long! */
         if (!no_handshake && ohci_readl (ohci,
@@ -478,8 +483,10 @@ static int ohci_init (struct ohci_hcd *ohci)
 
         /* Disable HC interrupts */
         ohci_writel (ohci, OHCI_INTR_MIE, &ohci->regs->intrdisable);
-        // flush the writes
-        (void) ohci_readl (ohci, &ohci->regs->control);
+
+        /* flush the writes, and save key bits like RWC */
+        if (ohci_readl (ohci, &ohci->regs->control) & OHCI_CTRL_RWC)
+                ohci->hc_control |= OHCI_CTRL_RWC;
 
         /* Read the number of ports unless overridden */
         if (ohci->num_ports == 0)
@@ -488,16 +495,19 @@ static int ohci_init (struct ohci_hcd *ohci)
         if (ohci->hcca)
                 return 0;
 
-        ohci->hcca = dma_alloc_coherent (ohci_to_hcd(ohci)->self.controller,
+        ohci->hcca = dma_alloc_coherent (hcd->self.controller,
                         sizeof *ohci->hcca, &ohci->hcca_dma, 0);
         if (!ohci->hcca)
                 return -ENOMEM;
 
         if ((ret = ohci_mem_init (ohci)) < 0)
-                ohci_stop (ohci_to_hcd(ohci));
+                ohci_stop (hcd);
+        else {
+                register_reboot_notifier (&ohci->reboot_notifier);
+                create_debug_files (ohci);
+        }
 
         return ret;
-
 }
 
 /*-------------------------------------------------------------------------*/
@@ -510,6 +520,7 @@ static int ohci_run (struct ohci_hcd *ohci)
 {
         u32                     mask, temp;
         int                     first = ohci->fminterval == 0;
+        struct usb_hcd          *hcd = ohci_to_hcd(ohci);
 
         disable (ohci);
 
@@ -525,18 +536,17 @@ static int ohci_run (struct ohci_hcd *ohci)
                 /* also: power/overcurrent flags in roothub.a */
         }
 
-        /* Reset USB nearly "by the book".  RemoteWakeupConnected
-         * saved if boot firmware (BIOS/SMM/...) told us it's connected
-         * (for OHCI integrated on mainboard, it normally is)
+        /* Reset USB nearly "by the book".  RemoteWakeupConnected was
+         * saved if boot firmware (BIOS/SMM/...) told us it's connected,
+         * or if bus glue did the same (e.g. for PCI add-in cards with
+         * PCI PM support).
          */
-        ohci->hc_control = ohci_readl (ohci, &ohci->regs->control);
         ohci_dbg (ohci, "resetting from state '%s', control = 0x%x\n",
                         hcfs2string (ohci->hc_control & OHCI_CTRL_HCFS),
-                        ohci->hc_control);
-
-        if (ohci->hc_control & OHCI_CTRL_RWC
-                        && !(ohci->flags & OHCI_QUIRK_AMD756))
-                ohci_to_hcd(ohci)->can_wakeup = 1;
+                        ohci_readl (ohci, &ohci->regs->control));
+        if ((ohci->hc_control & OHCI_CTRL_RWC) != 0
+                        && !device_may_wakeup(hcd->self.controller))
+                device_init_wakeup(hcd->self.controller, 1);
 
         switch (ohci->hc_control & OHCI_CTRL_HCFS) {
         case OHCI_USB_OPER:
@@ -632,7 +642,7 @@ retry:
         ohci->hc_control &= OHCI_CTRL_RWC;
         ohci->hc_control |= OHCI_CONTROL_INIT | OHCI_USB_OPER;
         ohci_writel (ohci, ohci->hc_control, &ohci->regs->control);
-        ohci_to_hcd(ohci)->state = HC_STATE_RUNNING;
+        hcd->state = HC_STATE_RUNNING;
 
         /* wake on ConnectStatusChange, matching external hubs */
         ohci_writel (ohci, RH_HS_DRWE, &ohci->regs->roothub.status);
@@ -667,15 +677,10 @@ retry:
 
         // POTPGT delay is bits 24-31, in 2 ms units.
         mdelay ((temp >> 23) & 0x1fe);
-        ohci_to_hcd(ohci)->state = HC_STATE_RUNNING;
+        hcd->state = HC_STATE_RUNNING;
 
         ohci_dump (ohci, 1);
 
-        if (ohci_to_hcd(ohci)->self.root_hub == NULL) {
-                register_reboot_notifier (&ohci->reboot_notifier);
-                create_debug_files (ohci);
-        }
-
         return 0;
 }
 
@@ -905,6 +910,10 @@ MODULE_LICENSE ("GPL");
 #include "ohci-ppc-soc.c"
 #endif
 
+#ifdef CONFIG_ARCH_AT91RM9200
+#include "ohci-at91.c"
+#endif
+
 #if !(defined(CONFIG_PCI) \
       || defined(CONFIG_SA1111) \
       || defined(CONFIG_ARCH_S3C2410) \
@@ -913,6 +922,7 @@ MODULE_LICENSE ("GPL");
       || defined (CONFIG_PXA27x) \
       || defined (CONFIG_SOC_AU1X00) \
       || defined (CONFIG_USB_OHCI_HCD_PPC_SOC) \
+      || defined (CONFIG_ARCH_AT91RM9200) \
         )
 #error "missing bus glue for ohci-hcd"
 #endif
diff --git a/drivers/usb/host/ohci-hub.c b/drivers/usb/host/ohci-hub.c
index 4b2226d77b34..0bb972b58336 100644
--- a/drivers/usb/host/ohci-hub.c
+++ b/drivers/usb/host/ohci-hub.c
@@ -107,7 +107,7 @@ static int ohci_bus_suspend (struct usb_hcd *hcd)
                         &ohci->regs->intrstatus);
 
         /* maybe resume can wake root hub */
-        if (hcd->remote_wakeup)
+        if (device_may_wakeup(&ohci_to_hcd(ohci)->self.root_hub->dev))
                 ohci->hc_control |= OHCI_CTRL_RWE;
         else
                 ohci->hc_control &= ~OHCI_CTRL_RWE;
@@ -246,9 +246,9 @@ static int ohci_bus_resume (struct usb_hcd *hcd)
         (void) ohci_readl (ohci, &ohci->regs->control);
         msleep (3);
 
-        temp = OHCI_CONTROL_INIT | OHCI_USB_OPER;
-        if (hcd->can_wakeup)
-                temp |= OHCI_CTRL_RWC;
+        temp = ohci->hc_control;
+        temp &= OHCI_CTRL_RWC;
+        temp |= OHCI_CONTROL_INIT | OHCI_USB_OPER;
         ohci->hc_control = temp;
         ohci_writel (ohci, temp, &ohci->regs->control);
         (void) ohci_readl (ohci, &ohci->regs->control);
@@ -302,7 +302,7 @@ ohci_hub_status_data (struct usb_hcd *hcd, char *buf)
 {
         struct ohci_hcd *ohci = hcd_to_ohci (hcd);
         int             i, changed = 0, length = 1;
-        int             can_suspend = hcd->can_wakeup;
+        int             can_suspend = device_may_wakeup(&hcd->self.root_hub->dev);
         unsigned long   flags;
 
         spin_lock_irqsave (&ohci->lock, flags);
@@ -354,7 +354,7 @@ ohci_hub_status_data (struct usb_hcd *hcd, char *buf)
                  */
                 if (!(status & RH_PS_CCS))
                         continue;
-                if ((status & RH_PS_PSS) && hcd->remote_wakeup)
+                if ((status & RH_PS_PSS) && can_suspend)
                         continue;
                 can_suspend = 0;
         }
diff --git a/drivers/usb/host/ohci-pci.c b/drivers/usb/host/ohci-pci.c
index 1b09dde068e1..1bfe96f4d045 100644
--- a/drivers/usb/host/ohci-pci.c
+++ b/drivers/usb/host/ohci-pci.c
@@ -35,7 +35,10 @@ ohci_pci_start (struct usb_hcd *hcd)
         struct ohci_hcd *ohci = hcd_to_ohci (hcd);
         int             ret;
 
-        if(hcd->self.controller && hcd->self.controller->bus == &pci_bus_type) {
+        /* REVISIT this whole block should move to reset(), which handles
+         * all the other one-time init.
+         */
+        if (hcd->self.controller) {
                 struct pci_dev *pdev = to_pci_dev(hcd->self.controller);
 
                 /* AMD 756, for most chips (early revs), corrupts register
@@ -45,7 +48,8 @@ ohci_pci_start (struct usb_hcd *hcd)
                                 && pdev->device == 0x740c) {
                         ohci->flags = OHCI_QUIRK_AMD756;
                         ohci_dbg (ohci, "AMD756 erratum 4 workaround\n");
-                        // also somewhat erratum 10 (suspend/resume issues)
+                        /* also erratum 10 (suspend/resume issues) */
+                        device_init_wakeup(&hcd->self.root_hub->dev, 0);
                 }
 
                 /* FIXME for some of the early AMD 760 southbridges, OHCI
@@ -88,6 +92,13 @@ ohci_pci_start (struct usb_hcd *hcd)
                         ohci_dbg (ohci,
                                 "enabled Compaq ZFMicro chipset quirk\n");
                 }
+
+                /* RWC may not be set for add-in PCI cards, since boot
+                 * firmware probably ignored them.  This transfers PCI
+                 * PM wakeup capabilities (once the PCI layer is fixed).
+                 */
+                if (device_may_wakeup(&pdev->dev))
+                        ohci->hc_control |= OHCI_CTRL_RWC;
         }
 
         /* NOTE: there may have already been a first reset, to
diff --git a/drivers/usb/host/sl811-hcd.c b/drivers/usb/host/sl811-hcd.c
index 517360b77d8e..a92343052751 100644
--- a/drivers/usb/host/sl811-hcd.c
+++ b/drivers/usb/host/sl811-hcd.c
@@ -853,7 +853,7 @@ static int sl811h_urb_enqueue(
 
         } else {
                 INIT_LIST_HEAD(&ep->schedule);
-                ep->udev = usb_get_dev(udev);
+                ep->udev = udev;
                 ep->epnum = epnum;
                 ep->maxpacket = usb_maxpacket(udev, urb->pipe, is_out);
                 ep->defctrl = SL11H_HCTLMASK_ARM | SL11H_HCTLMASK_ENABLE;
@@ -1052,7 +1052,6 @@ sl811h_endpoint_disable(struct usb_hcd *hcd, struct usb_host_endpoint *hep)
         if (!list_empty(&hep->urb_list))
                 WARN("ep %p not empty?\n", ep);
 
-        usb_put_dev(ep->udev);
         kfree(ep);
         hep->hcpriv = NULL;
 }
diff --git a/drivers/usb/host/uhci-debug.c b/drivers/usb/host/uhci-debug.c
index 5832953086f8..e1239319655c 100644
--- a/drivers/usb/host/uhci-debug.c
+++ b/drivers/usb/host/uhci-debug.c
@@ -17,10 +17,13 @@
 
 #include "uhci-hcd.h"
 
-static struct dentry *uhci_debugfs_root = NULL;
+#define uhci_debug_operations (* (struct file_operations *) NULL)
+static struct dentry *uhci_debugfs_root;
+
+#ifdef DEBUG
 
 /* Handle REALLY large printks so we don't overflow buffers */
-static inline void lprintk(char *buf)
+static void lprintk(char *buf)
 {
         char *p;
 
@@ -90,13 +93,59 @@ static int uhci_show_td(struct uhci_td *td, char *buf, int len, int space)
         return out - buf;
 }
 
-static int uhci_show_qh(struct uhci_qh *qh, char *buf, int len, int space)
+static int uhci_show_urbp(struct urb_priv *urbp, char *buf, int len, int space)
 {
         char *out = buf;
-        struct urb_priv *urbp;
-        struct list_head *head, *tmp;
         struct uhci_td *td;
-        int i = 0, checked = 0, prevactive = 0;
+        int i, nactive, ninactive;
+
+        if (len < 200)
+                return 0;
+
+        out += sprintf(out, "urb_priv [%p] ", urbp);
+        out += sprintf(out, "urb [%p] ", urbp->urb);
+        out += sprintf(out, "qh [%p] ", urbp->qh);
+        out += sprintf(out, "Dev=%d ", usb_pipedevice(urbp->urb->pipe));
+        out += sprintf(out, "EP=%x(%s) ", usb_pipeendpoint(urbp->urb->pipe),
+                        (usb_pipein(urbp->urb->pipe) ? "IN" : "OUT"));
+
+        switch (usb_pipetype(urbp->urb->pipe)) {
+        case PIPE_ISOCHRONOUS: out += sprintf(out, "ISO"); break;
+        case PIPE_INTERRUPT: out += sprintf(out, "INT"); break;
+        case PIPE_BULK: out += sprintf(out, "BLK"); break;
+        case PIPE_CONTROL: out += sprintf(out, "CTL"); break;
+        }
+
+        out += sprintf(out, "%s", (urbp->fsbr ? " FSBR" : ""));
+
+        if (urbp->urb->status != -EINPROGRESS)
+                out += sprintf(out, " Status=%d", urbp->urb->status);
+        out += sprintf(out, "\n");
+
+        i = nactive = ninactive = 0;
+        list_for_each_entry(td, &urbp->td_list, list) {
+                if (++i <= 10 || debug > 2) {
+                        out += sprintf(out, "%*s%d: ", space + 2, "", i);
+                        out += uhci_show_td(td, out, len - (out - buf), 0);
+                } else {
+                        if (td_status(td) & TD_CTRL_ACTIVE)
+                                ++nactive;
+                        else
+                                ++ninactive;
+                }
+        }
+        if (nactive + ninactive > 0)
+                out += sprintf(out, "%*s[skipped %d inactive and %d active "
+                                "TDs]\n",
+                                space, "", ninactive, nactive);
+
+        return out - buf;
+}
+
+static int uhci_show_qh(struct uhci_qh *qh, char *buf, int len, int space)
+{
+        char *out = buf;
+        int i, nurbs;
         __le32 element = qh_element(qh);
 
         /* Try to make sure there's enough memory */
@@ -118,86 +167,40 @@ static int uhci_show_qh(struct uhci_qh *qh, char *buf, int len, int space)
         if (!(element & ~(UHCI_PTR_QH | UHCI_PTR_DEPTH)))
                 out += sprintf(out, "%*s  Element is NULL (bug?)\n", space, "");
 
-        if (!qh->urbp) {
-                out += sprintf(out, "%*s  urbp == NULL\n", space, "");
-                goto out;
-        }
-
-        urbp = qh->urbp;
-
-        head = &urbp->td_list;
-        tmp = head->next;
-
-        td = list_entry(tmp, struct uhci_td, list);
-
-        if (cpu_to_le32(td->dma_handle) != (element & ~UHCI_PTR_BITS))
-                out += sprintf(out, "%*s Element != First TD\n", space, "");
-
-        while (tmp != head) {
-                struct uhci_td *td = list_entry(tmp, struct uhci_td, list);
-
-                tmp = tmp->next;
-
-                out += sprintf(out, "%*s%d: ", space + 2, "", i++);
-                out += uhci_show_td(td, out, len - (out - buf), 0);
-
-                if (i > 10 && !checked && prevactive && tmp != head &&
-                    debug <= 2) {
-                        struct list_head *ntmp = tmp;
-                        struct uhci_td *ntd = td;
-                        int active = 1, ni = i;
-
-                        checked = 1;
-
-                        while (ntmp != head && ntmp->next != head && active) {
-                                ntd = list_entry(ntmp, struct uhci_td, list);
-
-                                ntmp = ntmp->next;
-
-                                active = td_status(ntd) & TD_CTRL_ACTIVE;
-
-                                ni++;
-                        }
-
-                        if (active && ni > i) {
-                                out += sprintf(out, "%*s[skipped %d active TDs]\n", space, "", ni - i);
-                                tmp = ntmp;
-                                td = ntd;
-                                i = ni;
-                        }
+        if (list_empty(&qh->queue)) {
+                out += sprintf(out, "%*s  queue is empty\n", space, "");
+        } else {
+                struct urb_priv *urbp = list_entry(qh->queue.next,
+                                struct urb_priv, node);
+                struct uhci_td *td = list_entry(urbp->td_list.next,
+                                struct uhci_td, list);
+
+                if (cpu_to_le32(td->dma_handle) != (element & ~UHCI_PTR_BITS))
+                        out += sprintf(out, "%*s Element != First TD\n",
+                                        space, "");
+                i = nurbs = 0;
+                list_for_each_entry(urbp, &qh->queue, node) {
+                        if (++i <= 10)
+                                out += uhci_show_urbp(urbp, out,
+                                                len - (out - buf), space + 2);
+                        else
+                                ++nurbs;
                 }
-
-                prevactive = td_status(td) & TD_CTRL_ACTIVE;
+                if (nurbs > 0)
+                        out += sprintf(out, "%*s Skipped %d URBs\n",
+                                        space, "", nurbs);
         }
 
-        if (list_empty(&urbp->queue_list) || urbp->queued)
-                goto out;
-
-        out += sprintf(out, "%*sQueued QHs:\n", -space, "--");
-
-        head = &urbp->queue_list;
-        tmp = head->next;
-
-        while (tmp != head) {
-                struct urb_priv *nurbp = list_entry(tmp, struct urb_priv,
-                                                queue_list);
-                tmp = tmp->next;
-
-                out += uhci_show_qh(nurbp->qh, out, len - (out - buf), space);
+        if (qh->udev) {
+                out += sprintf(out, "%*s  Dummy TD\n", space, "");
+                out += uhci_show_td(qh->dummy_td, out, len - (out - buf), 0);
         }
 
-out:
         return out - buf;
 }
 
-#define show_frame_num()        \
-        if (!shown) {           \
-          shown = 1;            \
-          out += sprintf(out, "- Frame %d\n", i); \
-        }
-
-#ifdef CONFIG_PROC_FS
 static const char * const qh_names[] = {
+  "skel_unlink_qh", "skel_iso_qh",
   "skel_int128_qh", "skel_int64_qh",
   "skel_int32_qh", "skel_int16_qh",
   "skel_int8_qh", "skel_int4_qh",
@@ -206,12 +209,6 @@ static const char * const qh_names[] = {
   "skel_bulk_qh", "skel_term_qh"
 };
 
-#define show_qh_name()          \
-        if (!shown) {           \
-          shown = 1;            \
-          out += sprintf(out, "- %s\n", qh_names[i]); \
-        }
-
 static int uhci_show_sc(int port, unsigned short status, char *buf, int len)
 {
         char *out = buf;
@@ -321,139 +318,29 @@ static int uhci_show_status(struct uhci_hcd *uhci, char *buf, int len)
         return out - buf;
 }
 
-static int uhci_show_urbp(struct uhci_hcd *uhci, struct urb_priv *urbp, char *buf, int len)
-{
-        struct list_head *tmp;
-        char *out = buf;
-        int count = 0;
-
-        if (len < 200)
-                return 0;
-
-        out += sprintf(out, "urb_priv [%p] ", urbp);
-        out += sprintf(out, "urb [%p] ", urbp->urb);
-        out += sprintf(out, "qh [%p] ", urbp->qh);
-        out += sprintf(out, "Dev=%d ", usb_pipedevice(urbp->urb->pipe));
-        out += sprintf(out, "EP=%x(%s) ", usb_pipeendpoint(urbp->urb->pipe), (usb_pipein(urbp->urb->pipe) ? "IN" : "OUT"));
-
-        switch (usb_pipetype(urbp->urb->pipe)) {
-        case PIPE_ISOCHRONOUS: out += sprintf(out, "ISO "); break;
-        case PIPE_INTERRUPT: out += sprintf(out, "INT "); break;
-        case PIPE_BULK: out += sprintf(out, "BLK "); break;
-        case PIPE_CONTROL: out += sprintf(out, "CTL "); break;
-        }
-
-        out += sprintf(out, "%s", (urbp->fsbr ? "FSBR " : ""));
-        out += sprintf(out, "%s", (urbp->fsbr_timeout ? "FSBR_TO " : ""));
-
-        if (urbp->urb->status != -EINPROGRESS)
-                out += sprintf(out, "Status=%d ", urbp->urb->status);
-        //out += sprintf(out, "FSBRtime=%lx ",urbp->fsbrtime);
-
-        count = 0;
-        list_for_each(tmp, &urbp->td_list)
-                count++;
-        out += sprintf(out, "TDs=%d ",count);
-
-        if (urbp->queued)
-                out += sprintf(out, "queued\n");
-        else {
-                count = 0;
-                list_for_each(tmp, &urbp->queue_list)
-                        count++;
-                out += sprintf(out, "queued URBs=%d\n", count);
-        }
-
-        return out - buf;
-}
-
-static int uhci_show_lists(struct uhci_hcd *uhci, char *buf, int len)
-{
-        char *out = buf;
-        struct list_head *head, *tmp;
-        int count;
-
-        out += sprintf(out, "Main list URBs:");
-        if (list_empty(&uhci->urb_list))
-                out += sprintf(out, " Empty\n");
-        else {
-                out += sprintf(out, "\n");
-                count = 0;
-                head = &uhci->urb_list;
-                tmp = head->next;
-                while (tmp != head) {
-                        struct urb_priv *urbp = list_entry(tmp, struct urb_priv, urb_list);
-
-                        out += sprintf(out, "  %d: ", ++count);
-                        out += uhci_show_urbp(uhci, urbp, out, len - (out - buf));
-                        tmp = tmp->next;
-                }
-        }
-
-        out += sprintf(out, "Remove list URBs:");
-        if (list_empty(&uhci->urb_remove_list))
-                out += sprintf(out, " Empty\n");
-        else {
-                out += sprintf(out, "\n");
-                count = 0;
-                head = &uhci->urb_remove_list;
-                tmp = head->next;
-                while (tmp != head) {
-                        struct urb_priv *urbp = list_entry(tmp, struct urb_priv, urb_list);
-
-                        out += sprintf(out, "  %d: ", ++count);
-                        out += uhci_show_urbp(uhci, urbp, out, len - (out - buf));
-                        tmp = tmp->next;
-                }
-        }
-
-        out += sprintf(out, "Complete list URBs:");
-        if (list_empty(&uhci->complete_list))
-                out += sprintf(out, " Empty\n");
-        else {
-                out += sprintf(out, "\n");
-                count = 0;
-                head = &uhci->complete_list;
-                tmp = head->next;
-                while (tmp != head) {
-                        struct urb_priv *urbp = list_entry(tmp, struct urb_priv, urb_list);
-
-                        out += sprintf(out, "  %d: ", ++count);
-                        out += uhci_show_urbp(uhci, urbp, out, len - (out - buf));
-                        tmp = tmp->next;
-                }
-        }
-
-        return out - buf;
-}
-
 static int uhci_sprint_schedule(struct uhci_hcd *uhci, char *buf, int len)
 {
-        unsigned long flags;
         char *out = buf;
         int i, j;
         struct uhci_qh *qh;
         struct uhci_td *td;
         struct list_head *tmp, *head;
 
-        spin_lock_irqsave(&uhci->lock, flags);
-
         out += uhci_show_root_hub_state(uhci, out, len - (out - buf));
         out += sprintf(out, "HC status\n");
         out += uhci_show_status(uhci, out, len - (out - buf));
+        if (debug <= 1)
+                return out - buf;
 
         out += sprintf(out, "Frame List\n");
         for (i = 0; i < UHCI_NUMFRAMES; ++i) {
-                int shown = 0;
                 td = uhci->frame_cpu[i];
                 if (!td)
                         continue;
 
-                if (td->dma_handle != (dma_addr_t)uhci->frame[i]) {
-                        show_frame_num();
+                out += sprintf(out, "- Frame %d\n", i); \
+                if (td->dma_handle != (dma_addr_t)uhci->frame[i])
                         out += sprintf(out, "    frame list does not match td->dma_handle!\n");
-                }
-                show_frame_num();
 
                 head = &td->fl_list;
                 tmp = head;
@@ -467,14 +354,11 @@ static int uhci_sprint_schedule(struct uhci_hcd *uhci, char *buf, int len)
         out += sprintf(out, "Skeleton QHs\n");
 
         for (i = 0; i < UHCI_NUM_SKELQH; ++i) {
-                int shown = 0;
+                int cnt = 0;
 
                 qh = uhci->skelqh[i];
-
-                if (debug > 1) {
-                        show_qh_name();
-                        out += uhci_show_qh(qh, out, len - (out - buf), 4);
-                }
+                out += sprintf(out, "- %s\n", qh_names[i]); \
+                out += uhci_show_qh(qh, out, len - (out - buf), 4);
 
                 /* Last QH is the Terminating QH, it's different */
                 if (i == UHCI_NUM_SKELQH - 1) {
@@ -487,53 +371,37 @@ static int uhci_sprint_schedule(struct uhci_hcd *uhci, char *buf, int len)
                         continue;
                 }
 
-                j = (i < 7) ? 7 : i+1;          /* Next skeleton */
-                if (list_empty(&qh->list)) {
-                        if (i < UHCI_NUM_SKELQH - 1) {
-                                if (qh->link !=
-                                    (cpu_to_le32(uhci->skelqh[j]->dma_handle) | UHCI_PTR_QH)) {
-                                        show_qh_name();
-                                        out += sprintf(out, "    skeleton QH not linked to next skeleton QH!\n");
-                                }
-                        }
-
-                        continue;
-                }
-
-                show_qh_name();
-
-                head = &qh->list;
+                j = (i < 9) ? 9 : i+1;          /* Next skeleton */
+                head = &qh->node;
                 tmp = head->next;
 
                 while (tmp != head) {
-                        qh = list_entry(tmp, struct uhci_qh, list);
-
+                        qh = list_entry(tmp, struct uhci_qh, node);
                         tmp = tmp->next;
-
-                        out += uhci_show_qh(qh, out, len - (out - buf), 4);
+                        if (++cnt <= 10)
+                                out += uhci_show_qh(qh, out,
+                                                len - (out - buf), 4);
                 }
+                if ((cnt -= 10) > 0)
+                        out += sprintf(out, "    Skipped %d QHs\n", cnt);
 
-                if (i < UHCI_NUM_SKELQH - 1) {
+                if (i > 1 && i < UHCI_NUM_SKELQH - 1) {
                         if (qh->link !=
                             (cpu_to_le32(uhci->skelqh[j]->dma_handle) | UHCI_PTR_QH))
                                 out += sprintf(out, "    last QH not linked to next skeleton!\n");
                 }
         }
 
-        if (debug > 2)
-                out += uhci_show_lists(uhci, out, len - (out - buf));
-
-        spin_unlock_irqrestore(&uhci->lock, flags);
-
         return out - buf;
 }
 
+#ifdef CONFIG_DEBUG_FS
+
 #define MAX_OUTPUT      (64 * 1024)
 
 struct uhci_debug {
         int size;
         char *data;
-        struct uhci_hcd *uhci;
 };
 
 static int uhci_debug_open(struct inode *inode, struct file *file)
@@ -541,6 +409,7 @@ static int uhci_debug_open(struct inode *inode, struct file *file)
         struct uhci_hcd *uhci = inode->u.generic_ip;
         struct uhci_debug *up;
         int ret = -ENOMEM;
+        unsigned long flags;
 
         lock_kernel();
         up = kmalloc(sizeof(*up), GFP_KERNEL);
@@ -553,7 +422,11 @@ static int uhci_debug_open(struct inode *inode, struct file *file)
                 goto out;
         }
 
-        up->size = uhci_sprint_schedule(uhci, up->data, MAX_OUTPUT);
+        up->size = 0;
+        spin_lock_irqsave(&uhci->lock, flags);
+        if (uhci->is_initialized)
+                up->size = uhci_sprint_schedule(uhci, up->data, MAX_OUTPUT);
+        spin_unlock_irqrestore(&uhci->lock, flags);
 
         file->private_data = up;
 
@@ -604,15 +477,32 @@ static int uhci_debug_release(struct inode *inode, struct file *file)
         return 0;
 }
 
+#undef uhci_debug_operations
 static struct file_operations uhci_debug_operations = {
+        .owner =        THIS_MODULE,
         .open =         uhci_debug_open,
         .llseek =       uhci_debug_lseek,
         .read =         uhci_debug_read,
         .release =      uhci_debug_release,
 };
 
-#else   /* CONFIG_DEBUG_FS */
+#endif  /* CONFIG_DEBUG_FS */
 
-#define uhci_debug_operations (* (struct file_operations *) NULL)
+#else   /* DEBUG */
+
+static inline void lprintk(char *buf)
+{}
+
+static inline int uhci_show_qh(struct uhci_qh *qh, char *buf,
+                int len, int space)
+{
+        return 0;
+}
+
+static inline int uhci_sprint_schedule(struct uhci_hcd *uhci,
+                char *buf, int len)
+{
+        return 0;
+}
 
 #endif
diff --git a/drivers/usb/host/uhci-hcd.c b/drivers/usb/host/uhci-hcd.c
index dfe121d35887..4edb8330c440 100644
--- a/drivers/usb/host/uhci-hcd.c
+++ b/drivers/usb/host/uhci-hcd.c
@@ -54,7 +54,7 @@
 /*
  * Version Information
  */
-#define DRIVER_VERSION "v2.3"
+#define DRIVER_VERSION "v3.0"
 #define DRIVER_AUTHOR "Linus 'Frodo Rabbit' Torvalds, Johannes Erdfelt, \
 Randy Dunlap, Georg Acher, Deti Fliegl, Thomas Sailer, Roman Weissgaerber, \
 Alan Stern"
@@ -68,12 +68,16 @@ Alan Stern"
  * debug = 3, show all TDs in URBs when dumping
  */
 #ifdef DEBUG
+#define DEBUG_CONFIGURED        1
 static int debug = 1;
-#else
-static int debug = 0;
-#endif
 module_param(debug, int, S_IRUGO | S_IWUSR);
 MODULE_PARM_DESC(debug, "Debug level");
+
+#else
+#define DEBUG_CONFIGURED        0
+#define debug                   0
+#endif
+
 static char *errbuf;
 #define ERRBUF_LEN    (32 * 1024)
 
@@ -338,6 +342,12 @@ static irqreturn_t uhci_irq(struct usb_hcd *hcd, struct pt_regs *regs)
                                 dev_err(uhci_dev(uhci),
                                         "host controller halted, "
                                         "very bad!\n");
+                                if (debug > 1 && errbuf) {
+                                        /* Print the schedule for debugging */
+                                        uhci_sprint_schedule(uhci,
+                                                        errbuf, ERRBUF_LEN);
+                                        lprintk(errbuf);
+                                }
                                 hc_died(uhci);
 
                                 /* Force a callback in case there are
@@ -376,6 +386,14 @@ static void release_uhci(struct uhci_hcd *uhci)
 {
         int i;
 
+        if (DEBUG_CONFIGURED) {
+                spin_lock_irq(&uhci->lock);
+                uhci->is_initialized = 0;
+                spin_unlock_irq(&uhci->lock);
+
+                debugfs_remove(uhci->dentry);
+        }
+
         for (i = 0; i < UHCI_NUM_SKELQH; i++)
                 uhci_free_qh(uhci, uhci->skelqh[i]);
 
@@ -390,8 +408,6 @@ static void release_uhci(struct uhci_hcd *uhci)
         dma_free_coherent(uhci_dev(uhci),
                         UHCI_NUMFRAMES * sizeof(*uhci->frame),
                         uhci->frame, uhci->frame_dma_handle);
-
-        debugfs_remove(uhci->dentry);
 }
 
 static int uhci_reset(struct usb_hcd *hcd)
@@ -474,33 +490,29 @@ static int uhci_start(struct usb_hcd *hcd)
 
         hcd->uses_new_polling = 1;
 
-        dentry = debugfs_create_file(hcd->self.bus_name,
-                        S_IFREG|S_IRUGO|S_IWUSR, uhci_debugfs_root, uhci,
-                        &uhci_debug_operations);
-        if (!dentry) {
-                dev_err(uhci_dev(uhci),
-                                "couldn't create uhci debugfs entry\n");
-                retval = -ENOMEM;
-                goto err_create_debug_entry;
-        }
-        uhci->dentry = dentry;
-
         uhci->fsbr = 0;
         uhci->fsbrtimeout = 0;
 
         spin_lock_init(&uhci->lock);
-        INIT_LIST_HEAD(&uhci->qh_remove_list);
 
         INIT_LIST_HEAD(&uhci->td_remove_list);
-
-        INIT_LIST_HEAD(&uhci->urb_remove_list);
-
-        INIT_LIST_HEAD(&uhci->urb_list);
-
-        INIT_LIST_HEAD(&uhci->complete_list);
+        INIT_LIST_HEAD(&uhci->idle_qh_list);
 
         init_waitqueue_head(&uhci->waitqh);
 
+        if (DEBUG_CONFIGURED) {
+                dentry = debugfs_create_file(hcd->self.bus_name,
+                                S_IFREG|S_IRUGO|S_IWUSR, uhci_debugfs_root,
+                                uhci, &uhci_debug_operations);
+                if (!dentry) {
+                        dev_err(uhci_dev(uhci), "couldn't create uhci "
+                                        "debugfs entry\n");
+                        retval = -ENOMEM;
+                        goto err_create_debug_entry;
+                }
+                uhci->dentry = dentry;
+        }
+
         uhci->frame = dma_alloc_coherent(uhci_dev(uhci),
                         UHCI_NUMFRAMES * sizeof(*uhci->frame),
                         &uhci->frame_dma_handle, 0);
@@ -540,7 +552,7 @@ static int uhci_start(struct usb_hcd *hcd)
         }
 
         for (i = 0; i < UHCI_NUM_SKELQH; i++) {
-                uhci->skelqh[i] = uhci_alloc_qh(uhci);
+                uhci->skelqh[i] = uhci_alloc_qh(uhci, NULL, NULL);
                 if (!uhci->skelqh[i]) {
                         dev_err(uhci_dev(uhci), "unable to allocate QH\n");
                         goto err_alloc_skelqh;
@@ -557,13 +569,17 @@ static int uhci_start(struct usb_hcd *hcd)
                         uhci->skel_int16_qh->link =
                         uhci->skel_int8_qh->link =
                         uhci->skel_int4_qh->link =
-                        uhci->skel_int2_qh->link =
-                        cpu_to_le32(uhci->skel_int1_qh->dma_handle) | UHCI_PTR_QH;
-        uhci->skel_int1_qh->link = cpu_to_le32(uhci->skel_ls_control_qh->dma_handle) | UHCI_PTR_QH;
-
-        uhci->skel_ls_control_qh->link = cpu_to_le32(uhci->skel_fs_control_qh->dma_handle) | UHCI_PTR_QH;
-        uhci->skel_fs_control_qh->link = cpu_to_le32(uhci->skel_bulk_qh->dma_handle) | UHCI_PTR_QH;
-        uhci->skel_bulk_qh->link = cpu_to_le32(uhci->skel_term_qh->dma_handle) | UHCI_PTR_QH;
+                        uhci->skel_int2_qh->link = UHCI_PTR_QH |
+                        cpu_to_le32(uhci->skel_int1_qh->dma_handle);
+
+        uhci->skel_int1_qh->link = UHCI_PTR_QH |
+                        cpu_to_le32(uhci->skel_ls_control_qh->dma_handle);
+        uhci->skel_ls_control_qh->link = UHCI_PTR_QH |
+                        cpu_to_le32(uhci->skel_fs_control_qh->dma_handle);
+        uhci->skel_fs_control_qh->link = UHCI_PTR_QH |
+                        cpu_to_le32(uhci->skel_bulk_qh->dma_handle);
+        uhci->skel_bulk_qh->link = UHCI_PTR_QH |
+                        cpu_to_le32(uhci->skel_term_qh->dma_handle);
 
         /* This dummy TD is to work around a bug in Intel PIIX controllers */
         uhci_fill_td(uhci->term_td, 0, uhci_explen(0) |
@@ -589,15 +605,15 @@ static int uhci_start(struct usb_hcd *hcd)
 
                 /*
                  * ffs (Find First bit Set) does exactly what we need:
-                 * 1,3,5,...  => ffs = 0 => use skel_int2_qh = skelqh[6],
-                 * 2,6,10,... => ffs = 1 => use skel_int4_qh = skelqh[5], etc.
-                 * ffs > 6 => not on any high-period queue, so use
-                 *      skel_int1_qh = skelqh[7].
+                 * 1,3,5,...  => ffs = 0 => use skel_int2_qh = skelqh[8],
+                 * 2,6,10,... => ffs = 1 => use skel_int4_qh = skelqh[7], etc.
+                 * ffs >= 7 => not on any high-period queue, so use
+                 *      skel_int1_qh = skelqh[9].
                  * Add UHCI_NUMFRAMES to insure at least one bit is set.
                  */
-                irq = 6 - (int) __ffs(i + UHCI_NUMFRAMES);
-                if (irq < 0)
-                        irq = 7;
+                irq = 8 - (int) __ffs(i + UHCI_NUMFRAMES);
+                if (irq <= 1)
+                        irq = 9;
 
                 /* Only place we don't use the frame list routines */
                 uhci->frame[i] = UHCI_PTR_QH |
@@ -611,6 +627,7 @@ static int uhci_start(struct usb_hcd *hcd)
         mb();
 
         configure_hc(uhci);
+        uhci->is_initialized = 1;
         start_rh(uhci);
         return 0;
 
@@ -767,13 +784,30 @@ static int uhci_resume(struct usb_hcd *hcd)
 }
 #endif
 
-/* Wait until all the URBs for a particular device/endpoint are gone */
+/* Wait until a particular device/endpoint's QH is idle, and free it */
 static void uhci_hcd_endpoint_disable(struct usb_hcd *hcd,
-                struct usb_host_endpoint *ep)
+                struct usb_host_endpoint *hep)
 {
         struct uhci_hcd *uhci = hcd_to_uhci(hcd);
+        struct uhci_qh *qh;
+
+        spin_lock_irq(&uhci->lock);
+        qh = (struct uhci_qh *) hep->hcpriv;
+        if (qh == NULL)
+                goto done;
+
+        while (qh->state != QH_STATE_IDLE) {
+                ++uhci->num_waiting;
+                spin_unlock_irq(&uhci->lock);
+                wait_event_interruptible(uhci->waitqh,
+                                qh->state == QH_STATE_IDLE);
+                spin_lock_irq(&uhci->lock);
+                --uhci->num_waiting;
+        }
 
-        wait_event_interruptible(uhci->waitqh, list_empty(&ep->urb_list));
+        uhci_free_qh(uhci, qh);
+done:
+        spin_unlock_irq(&uhci->lock);
 }
 
 static int uhci_hcd_get_frame_number(struct usb_hcd *hcd)
@@ -857,16 +891,15 @@ static int __init uhci_hcd_init(void)
         if (usb_disabled())
                 return -ENODEV;
 
-        if (debug) {
+        if (DEBUG_CONFIGURED) {
                 errbuf = kmalloc(ERRBUF_LEN, GFP_KERNEL);
                 if (!errbuf)
                         goto errbuf_failed;
+                uhci_debugfs_root = debugfs_create_dir("uhci", NULL);
+                if (!uhci_debugfs_root)
+                        goto debug_failed;
         }
 
-        uhci_debugfs_root = debugfs_create_dir("uhci", NULL);
-        if (!uhci_debugfs_root)
-                goto debug_failed;
-
         uhci_up_cachep = kmem_cache_create("uhci_urb_priv",
                 sizeof(struct urb_priv), 0, 0, NULL, NULL);
         if (!uhci_up_cachep)
diff --git a/drivers/usb/host/uhci-hcd.h b/drivers/usb/host/uhci-hcd.h
index 8b4b887a7d41..4a69c7eb09bd 100644
--- a/drivers/usb/host/uhci-hcd.h
+++ b/drivers/usb/host/uhci-hcd.h
@@ -28,8 +28,9 @@
 #define   USBSTS_USBINT         0x0001  /* Interrupt due to IOC */
 #define   USBSTS_ERROR          0x0002  /* Interrupt due to error */
 #define   USBSTS_RD             0x0004  /* Resume Detect */
-#define   USBSTS_HSE            0x0008  /* Host System Error - basically PCI problems */
-#define   USBSTS_HCPE           0x0010  /* Host Controller Process Error - the scripts were buggy */
+#define   USBSTS_HSE            0x0008  /* Host System Error: PCI problems */
+#define   USBSTS_HCPE           0x0010  /* Host Controller Process Error:
+                                         * the schedule is buggy */
 #define   USBSTS_HCH            0x0020  /* HC Halted */
 
 /* Interrupt enable register */
@@ -47,7 +48,8 @@
 /* USB port status and control registers */
 #define USBPORTSC1      16
 #define USBPORTSC2      18
-#define   USBPORTSC_CCS         0x0001  /* Current Connect Status ("device present") */
+#define   USBPORTSC_CCS         0x0001  /* Current Connect Status
+                                         * ("device present") */
 #define   USBPORTSC_CSC         0x0002  /* Connect Status Change */
 #define   USBPORTSC_PE          0x0004  /* Port Enable */
 #define   USBPORTSC_PEC         0x0008  /* Port Enable Change */
@@ -71,15 +73,16 @@
 #define   USBLEGSUP_RWC         0x8f00  /* the R/WC bits */
 #define   USBLEGSUP_RO          0x5040  /* R/O and reserved bits */
 
-#define UHCI_PTR_BITS           cpu_to_le32(0x000F)
-#define UHCI_PTR_TERM           cpu_to_le32(0x0001)
-#define UHCI_PTR_QH             cpu_to_le32(0x0002)
-#define UHCI_PTR_DEPTH          cpu_to_le32(0x0004)
-#define UHCI_PTR_BREADTH        cpu_to_le32(0x0000)
+#define UHCI_PTR_BITS           __constant_cpu_to_le32(0x000F)
+#define UHCI_PTR_TERM           __constant_cpu_to_le32(0x0001)
+#define UHCI_PTR_QH             __constant_cpu_to_le32(0x0002)
+#define UHCI_PTR_DEPTH          __constant_cpu_to_le32(0x0004)
+#define UHCI_PTR_BREADTH        __constant_cpu_to_le32(0x0000)
 
 #define UHCI_NUMFRAMES          1024    /* in the frame list [array] */
 #define UHCI_MAX_SOF_NUMBER     2047    /* in an SOF packet */
-#define CAN_SCHEDULE_FRAMES     1000    /* how far future frames can be scheduled */
+#define CAN_SCHEDULE_FRAMES     1000    /* how far in the future frames
+                                         * can be scheduled */
 
 
 /*
@@ -87,38 +90,59 @@
  */
 
 /*
- * One role of a QH is to hold a queue of TDs for some endpoint.  Each QH is
- * used with one URB, and qh->element (updated by the HC) is either:
- *   - the next unprocessed TD for the URB, or
- *   - UHCI_PTR_TERM (when there's no more traffic for this endpoint), or
- *   - the QH for the next URB queued to the same endpoint.
+ * One role of a QH is to hold a queue of TDs for some endpoint.  One QH goes
+ * with each endpoint, and qh->element (updated by the HC) is either:
+ *   - the next unprocessed TD in the endpoint's queue, or
+ *   - UHCI_PTR_TERM (when there's no more traffic for this endpoint).
  *
  * The other role of a QH is to serve as a "skeleton" framelist entry, so we
  * can easily splice a QH for some endpoint into the schedule at the right
  * place.  Then qh->element is UHCI_PTR_TERM.
  *
- * In the frame list, qh->link maintains a list of QHs seen by the HC:
+ * In the schedule, qh->link maintains a list of QHs seen by the HC:
  *     skel1 --> ep1-qh --> ep2-qh --> ... --> skel2 --> ...
+ *
+ * qh->node is the software equivalent of qh->link.  The differences
+ * are that the software list is doubly-linked and QHs in the UNLINKING
+ * state are on the software list but not the hardware schedule.
+ *
+ * For bookkeeping purposes we maintain QHs even for Isochronous endpoints,
+ * but they never get added to the hardware schedule.
  */
+#define QH_STATE_IDLE           1       /* QH is not being used */
+#define QH_STATE_UNLINKING      2       /* QH has been removed from the
+                                         * schedule but the hardware may
+                                         * still be using it */
+#define QH_STATE_ACTIVE         3       /* QH is on the schedule */
+
 struct uhci_qh {
         /* Hardware fields */
-        __le32 link;                    /* Next queue */
-        __le32 element;                 /* Queue element pointer */
+        __le32 link;                    /* Next QH in the schedule */
+        __le32 element;                 /* Queue element (TD) pointer */
 
         /* Software fields */
         dma_addr_t dma_handle;
 
-        struct urb_priv *urbp;
+        struct list_head node;          /* Node in the list of QHs */
+        struct usb_host_endpoint *hep;  /* Endpoint information */
+        struct usb_device *udev;
+        struct list_head queue;         /* Queue of urbps for this QH */
+        struct uhci_qh *skel;           /* Skeleton for this QH */
+        struct uhci_td *dummy_td;       /* Dummy TD to end the queue */
 
-        struct list_head list;
-        struct list_head remove_list;
+        unsigned int unlink_frame;      /* When the QH was unlinked */
+        int state;                      /* QH_STATE_xxx; see above */
+
+        unsigned int initial_toggle:1;  /* Endpoint's current toggle value */
+        unsigned int needs_fixup:1;     /* Must fix the TD toggle values */
+        unsigned int is_stopped:1;      /* Queue was stopped by an error */
 } __attribute__((aligned(16)));
 
 /*
  * We need a special accessor for the element pointer because it is
  * subject to asynchronous updates by the controller.
  */
-static __le32 inline qh_element(struct uhci_qh *qh) {
+static inline __le32 qh_element(struct uhci_qh *qh) {
         __le32 element = qh->element;
 
         barrier();
@@ -149,11 +173,13 @@ static __le32 inline qh_element(struct uhci_qh *qh) {
 #define TD_CTRL_ACTLEN_MASK     0x7FF   /* actual length, encoded as n - 1 */
 
 #define TD_CTRL_ANY_ERROR       (TD_CTRL_STALLED | TD_CTRL_DBUFERR | \
-                                 TD_CTRL_BABBLE | TD_CTRL_CRCTIME | TD_CTRL_BITSTUFF)
+                                 TD_CTRL_BABBLE | TD_CTRL_CRCTIME | \
+                                 TD_CTRL_BITSTUFF)
 
 #define uhci_maxerr(err)                ((err) << TD_CTRL_C_ERR_SHIFT)
 #define uhci_status_bits(ctrl_sts)      ((ctrl_sts) & 0xF60000)
-#define uhci_actual_length(ctrl_sts)    (((ctrl_sts) + 1) & TD_CTRL_ACTLEN_MASK) /* 1-based */
+#define uhci_actual_length(ctrl_sts)    (((ctrl_sts) + 1) & \
+                        TD_CTRL_ACTLEN_MASK)    /* 1-based */
 
 /*
  * for TD <info>: (a.k.a. Token)
@@ -163,7 +189,7 @@ static __le32 inline qh_element(struct uhci_qh *qh) {
 #define TD_TOKEN_TOGGLE_SHIFT   19
 #define TD_TOKEN_TOGGLE         (1 << 19)
 #define TD_TOKEN_EXPLEN_SHIFT   21
-#define TD_TOKEN_EXPLEN_MASK    0x7FF           /* expected length, encoded as n - 1 */
+#define TD_TOKEN_EXPLEN_MASK    0x7FF   /* expected length, encoded as n-1 */
 #define TD_TOKEN_PID_MASK       0xFF
 
 #define uhci_explen(len)        ((((len) - 1) & TD_TOKEN_EXPLEN_MASK) << \
@@ -187,7 +213,7 @@ static __le32 inline qh_element(struct uhci_qh *qh) {
  * sw space after the TD entry.
  *
  * td->link points to either another TD (not necessarily for the same urb or
- * even the same endpoint), or nothing (PTR_TERM), or a QH (for queued urbs).
+ * even the same endpoint), or nothing (PTR_TERM), or a QH.
  */
 struct uhci_td {
         /* Hardware fields */
@@ -210,7 +236,7 @@ struct uhci_td {
  * We need a special accessor for the control/status word because it is
  * subject to asynchronous updates by the controller.
  */
-static u32 inline td_status(struct uhci_td *td) {
+static inline u32 td_status(struct uhci_td *td) {
         __le32 status = td->status;
 
         barrier();
@@ -223,17 +249,14 @@ static u32 inline td_status(struct uhci_td *td) {
  */
 
 /*
- * The UHCI driver places Interrupt, Control and Bulk into QHs both
- * to group together TDs for one transfer, and also to facilitate queuing
- * of URBs. To make it easy to insert entries into the schedule, we have
- * a skeleton of QHs for each predefined Interrupt latency, low-speed
- * control, full-speed control and terminating QH (see explanation for
- * the terminating QH below).
+ * The UHCI driver uses QHs with Interrupt, Control and Bulk URBs for
+ * automatic queuing. To make it easy to insert entries into the schedule,
+ * we have a skeleton of QHs for each predefined Interrupt latency,
+ * low-speed control, full-speed control, bulk, and terminating QH
+ * (see explanation for the terminating QH below).
  *
  * When we want to add a new QH, we add it to the end of the list for the
- * skeleton QH.
- *
- * For instance, the queue can look like this:
+ * skeleton QH.  For instance, the schedule list can look like this:
  *
  * skel int128 QH
  * dev 1 interrupt QH
@@ -256,26 +279,31 @@ static u32 inline td_status(struct uhci_td *td) {
  * - To loop back to the full-speed control queue for full-speed bandwidth
  *   reclamation.
  *
- * Isochronous transfers are stored before the start of the skeleton
- * schedule and don't use QHs. While the UHCI spec doesn't forbid the
- * use of QHs for Isochronous, it doesn't use them either. And the spec
- * says that queues never advance on an error completion status, which
- * makes them totally unsuitable for Isochronous transfers.
+ * There's a special skeleton QH for Isochronous QHs.  It never appears
+ * on the schedule, and Isochronous TDs go on the schedule before the
+ * the skeleton QHs.  The hardware accesses them directly rather than
+ * through their QH, which is used only for bookkeeping purposes.
+ * While the UHCI spec doesn't forbid the use of QHs for Isochronous,
+ * it doesn't use them either.  And the spec says that queues never
+ * advance on an error completion status, which makes them totally
+ * unsuitable for Isochronous transfers.
  */
 
-#define UHCI_NUM_SKELQH         12
-#define skel_int128_qh          skelqh[0]
-#define skel_int64_qh           skelqh[1]
-#define skel_int32_qh           skelqh[2]
-#define skel_int16_qh           skelqh[3]
-#define skel_int8_qh            skelqh[4]
-#define skel_int4_qh            skelqh[5]
-#define skel_int2_qh            skelqh[6]
-#define skel_int1_qh            skelqh[7]
-#define skel_ls_control_qh      skelqh[8]
-#define skel_fs_control_qh      skelqh[9]
-#define skel_bulk_qh            skelqh[10]
-#define skel_term_qh            skelqh[11]
+#define UHCI_NUM_SKELQH         14
+#define skel_unlink_qh          skelqh[0]
+#define skel_iso_qh             skelqh[1]
+#define skel_int128_qh          skelqh[2]
+#define skel_int64_qh           skelqh[3]
+#define skel_int32_qh           skelqh[4]
+#define skel_int16_qh           skelqh[5]
+#define skel_int8_qh            skelqh[6]
+#define skel_int4_qh            skelqh[7]
+#define skel_int2_qh            skelqh[8]
+#define skel_int1_qh            skelqh[9]
+#define skel_ls_control_qh      skelqh[10]
+#define skel_fs_control_qh      skelqh[11]
+#define skel_bulk_qh            skelqh[12]
+#define skel_term_qh            skelqh[13]
 
 /*
  * Search tree for determining where <interval> fits in the skelqh[]
@@ -293,21 +321,21 @@ static inline int __interval_to_skel(int interval)
         if (interval < 16) {
                 if (interval < 4) {
                         if (interval < 2)
-                                return 7;       /* int1 for 0-1 ms */
-                        return 6;               /* int2 for 2-3 ms */
+                                return 9;       /* int1 for 0-1 ms */
+                        return 8;               /* int2 for 2-3 ms */
                 }
                 if (interval < 8)
-                        return 5;               /* int4 for 4-7 ms */
-                return 4;                       /* int8 for 8-15 ms */
+                        return 7;               /* int4 for 4-7 ms */
+                return 6;                       /* int8 for 8-15 ms */
         }
         if (interval < 64) {
                 if (interval < 32)
-                        return 3;               /* int16 for 16-31 ms */
-                return 2;                       /* int32 for 32-63 ms */
+                        return 5;               /* int16 for 16-31 ms */
+                return 4;                       /* int32 for 32-63 ms */
         }
         if (interval < 128)
-                return 1;                       /* int64 for 64-127 ms */
-        return 0;                               /* int128 for 128-255 ms (Max.) */
+                return 3;                       /* int64 for 64-127 ms */
+        return 2;                               /* int128 for 128-255 ms (Max.) */
 }
 
 
@@ -360,15 +388,16 @@ struct uhci_hcd {
 
         struct uhci_td *term_td;        /* Terminating TD, see UHCI bug */
         struct uhci_qh *skelqh[UHCI_NUM_SKELQH];        /* Skeleton QHs */
+        struct uhci_qh *next_qh;        /* Next QH to scan */
 
         spinlock_t lock;
 
-        dma_addr_t frame_dma_handle;            /* Hardware frame list */
+        dma_addr_t frame_dma_handle;    /* Hardware frame list */
         __le32 *frame;
-        void **frame_cpu;                       /* CPU's frame list */
+        void **frame_cpu;               /* CPU's frame list */
 
-        int fsbr;                               /* Full-speed bandwidth reclamation */
-        unsigned long fsbrtimeout;              /* FSBR delay */
+        int fsbr;                       /* Full-speed bandwidth reclamation */
+        unsigned long fsbrtimeout;      /* FSBR delay */
 
         enum uhci_rh_state rh_state;
         unsigned long auto_stop_time;           /* When to AUTO_STOP */
@@ -382,6 +411,7 @@ struct uhci_hcd {
         unsigned int hc_inaccessible:1;         /* HC is suspended or dead */
         unsigned int working_RD:1;              /* Suspended root hub doesn't
                                                    need to be polled */
+        unsigned int is_initialized:1;          /* Data structure is usable */
 
         /* Support for port suspend/resume/reset */
         unsigned long port_c_suspend;           /* Bit-arrays of ports */
@@ -389,27 +419,16 @@ struct uhci_hcd {
         unsigned long resuming_ports;
         unsigned long ports_timeout;            /* Time to stop signalling */
 
-        /* Main list of URBs currently controlled by this HC */
-        struct list_head urb_list;
-
-        /* List of QHs that are done, but waiting to be unlinked (race) */
-        struct list_head qh_remove_list;
-        unsigned int qh_remove_age;             /* Age in frames */
-
         /* List of TDs that are done, but waiting to be freed (race) */
         struct list_head td_remove_list;
         unsigned int td_remove_age;             /* Age in frames */
 
-        /* List of asynchronously unlinked URBs */
-        struct list_head urb_remove_list;
-        unsigned int urb_remove_age;            /* Age in frames */
-
-        /* List of URBs awaiting completion callback */
-        struct list_head complete_list;
+        struct list_head idle_qh_list;          /* Where the idle QHs live */
 
         int rh_numports;                        /* Number of root-hub ports */
 
         wait_queue_head_t waitqh;               /* endpoint_disable waiters */
+        int num_waiting;                        /* Number of waiters */
 };
 
 /* Convert between a usb_hcd pointer and the corresponding uhci_hcd */
@@ -429,7 +448,7 @@ static inline struct usb_hcd *uhci_to_hcd(struct uhci_hcd *uhci)
  *      Private per-URB data
  */
 struct urb_priv {
-        struct list_head urb_list;
+        struct list_head node;          /* Node in the QH's urbp list */
 
         struct urb *urb;
 
@@ -437,15 +456,8 @@ struct urb_priv {
         struct list_head td_list;
 
         unsigned fsbr : 1;              /* URB turned on FSBR */
-        unsigned fsbr_timeout : 1;      /* URB timed out on FSBR */
-        unsigned queued : 1;            /* QH was queued (not linked in) */
-        unsigned short_control_packet : 1;      /* If we get a short packet during */
-                                                /*  a control transfer, retrigger */
-                                                /*  the status phase */
-
-        unsigned long fsbrtime;         /* In jiffies */
-
-        struct list_head queue_list;
+        unsigned short_transfer : 1;    /* URB got a short transfer, no
+                                         * need to rescan */
 };
 
 
diff --git a/drivers/usb/host/uhci-hub.c b/drivers/usb/host/uhci-hub.c
index a71e48a66805..152971d16769 100644
--- a/drivers/usb/host/uhci-hub.c
+++ b/drivers/usb/host/uhci-hub.c
@@ -99,6 +99,21 @@ static void uhci_finish_suspend(struct uhci_hcd *uhci, int port,
         }
 }
 
+/* Wait for the UHCI controller in HP's iLO2 server management chip.
+ * It can take up to 250 us to finish a reset and set the CSC bit.
+ */
+static void wait_for_HP(unsigned long port_addr)
+{
+        int i;
+
+        for (i = 10; i < 250; i += 10) {
+                if (inw(port_addr) & USBPORTSC_CSC)
+                        return;
+                udelay(10);
+        }
+        /* Log a warning? */
+}
+
 static void uhci_check_ports(struct uhci_hcd *uhci)
 {
         unsigned int port;
@@ -113,6 +128,12 @@ static void uhci_check_ports(struct uhci_hcd *uhci)
                                 CLR_RH_PORTSTAT(USBPORTSC_PR);
                                 udelay(10);
 
+                                /* HP's server management chip requires
+                                 * a longer delay. */
+                                if (to_pci_dev(uhci_dev(uhci))->vendor ==
+                                                PCI_VENDOR_ID_HP)
+                                        wait_for_HP(port_addr);
+
                                 /* If the port was enabled before, turning
                                  * reset on caused a port enable change.
                                  * Turning reset off causes a port connect
diff --git a/drivers/usb/host/uhci-q.c b/drivers/usb/host/uhci-q.c
index 782398045f9f..a06d84c19e13 100644
--- a/drivers/usb/host/uhci-q.c
+++ b/drivers/usb/host/uhci-q.c
@@ -13,13 +13,9 @@
  * (C) Copyright 2000 Yggdrasil Computing, Inc. (port of new PCI interface
  *               support from usb-ohci.c by Adam Richter, adam@yggdrasil.com).
  * (C) Copyright 1999 Gregory P. Smith (from usb-ohci.c)
- * (C) Copyright 2004 Alan Stern, stern@rowland.harvard.edu
+ * (C) Copyright 2004-2005 Alan Stern, stern@rowland.harvard.edu
  */
 
-static int uhci_urb_dequeue(struct usb_hcd *hcd, struct urb *urb);
-static void uhci_unlink_generic(struct uhci_hcd *uhci, struct urb *urb);
-static void uhci_remove_pending_urbps(struct uhci_hcd *uhci);
-static void uhci_free_pending_qhs(struct uhci_hcd *uhci);
 static void uhci_free_pending_tds(struct uhci_hcd *uhci);
 
 /*
@@ -30,7 +26,7 @@ static void uhci_free_pending_tds(struct uhci_hcd *uhci);
  * games with the FSBR code to make sure we get the correct order in all
  * the cases. I don't think it's worth the effort
  */
-static inline void uhci_set_next_interrupt(struct uhci_hcd *uhci)
+static void uhci_set_next_interrupt(struct uhci_hcd *uhci)
 {
         if (uhci->is_stopped)
                 mod_timer(&uhci_to_hcd(uhci)->rh_timer, jiffies);
@@ -42,12 +38,6 @@ static inline void uhci_clear_next_interrupt(struct uhci_hcd *uhci)
         uhci->term_td->status &= ~cpu_to_le32(TD_CTRL_IOC);
 }
 
-static inline void uhci_moveto_complete(struct uhci_hcd *uhci, 
-                                        struct urb_priv *urbp)
-{
-        list_move_tail(&urbp->urb_list, &uhci->complete_list);
-}
-
 static struct uhci_td *uhci_alloc_td(struct uhci_hcd *uhci)
 {
         dma_addr_t dma_handle;
@@ -58,10 +48,6 @@ static struct uhci_td *uhci_alloc_td(struct uhci_hcd *uhci)
                 return NULL;
 
         td->dma_handle = dma_handle;
-
-        td->link = UHCI_PTR_TERM;
-        td->buffer = 0;
-
         td->frame = -1;
 
         INIT_LIST_HEAD(&td->list);
@@ -71,6 +57,18 @@ static struct uhci_td *uhci_alloc_td(struct uhci_hcd *uhci)
         return td;
 }
 
+static void uhci_free_td(struct uhci_hcd *uhci, struct uhci_td *td)
+{
+        if (!list_empty(&td->list))
+                dev_warn(uhci_dev(uhci), "td %p still in list!\n", td);
+        if (!list_empty(&td->remove_list))
+                dev_warn(uhci_dev(uhci), "td %p still in remove_list!\n", td);
+        if (!list_empty(&td->fl_list))
+                dev_warn(uhci_dev(uhci), "td %p still in fl_list!\n", td);
+
+        dma_pool_free(uhci->td_pool, td, td->dma_handle);
+}
+
 static inline void uhci_fill_td(struct uhci_td *td, u32 status,
                 u32 token, u32 buffer)
 {
@@ -82,7 +80,8 @@ static inline void uhci_fill_td(struct uhci_td *td, u32 status,
 /*
  * We insert Isochronous URBs directly into the frame list at the beginning
  */
-static void uhci_insert_td_frame_list(struct uhci_hcd *uhci, struct uhci_td *td, unsigned framenum)
+static inline void uhci_insert_td_in_frame_list(struct uhci_hcd *uhci,
+                struct uhci_td *td, unsigned framenum)
 {
         framenum &= (UHCI_NUMFRAMES - 1);
 
@@ -108,7 +107,7 @@ static void uhci_insert_td_frame_list(struct uhci_hcd *uhci, struct uhci_td *td,
         }
 }
 
-static inline void uhci_remove_td_frame_list(struct uhci_hcd *uhci,
+static inline void uhci_remove_td_from_frame_list(struct uhci_hcd *uhci,
                 struct uhci_td *td)
 {
         /* If it's not inserted, don't remove it */
@@ -139,48 +138,21 @@ static inline void uhci_remove_td_frame_list(struct uhci_hcd *uhci,
         td->frame = -1;
 }
 
-static void unlink_isochronous_tds(struct uhci_hcd *uhci, struct urb *urb)
+/*
+ * Remove all the TDs for an Isochronous URB from the frame list
+ */
+static void uhci_unlink_isochronous_tds(struct uhci_hcd *uhci, struct urb *urb)
 {
         struct urb_priv *urbp = (struct urb_priv *) urb->hcpriv;
         struct uhci_td *td;
 
         list_for_each_entry(td, &urbp->td_list, list)
-                uhci_remove_td_frame_list(uhci, td);
+                uhci_remove_td_from_frame_list(uhci, td);
         wmb();
 }
 
-/*
- * Inserts a td list into qh.
- */
-static void uhci_insert_tds_in_qh(struct uhci_qh *qh, struct urb *urb, __le32 breadth)
-{
-        struct urb_priv *urbp = (struct urb_priv *)urb->hcpriv;
-        struct uhci_td *td;
-        __le32 *plink;
-
-        /* Ordering isn't important here yet since the QH hasn't been */
-        /* inserted into the schedule yet */
-        plink = &qh->element;
-        list_for_each_entry(td, &urbp->td_list, list) {
-                *plink = cpu_to_le32(td->dma_handle) | breadth;
-                plink = &td->link;
-        }
-        *plink = UHCI_PTR_TERM;
-}
-
-static void uhci_free_td(struct uhci_hcd *uhci, struct uhci_td *td)
-{
-        if (!list_empty(&td->list))
-                dev_warn(uhci_dev(uhci), "td %p still in list!\n", td);
-        if (!list_empty(&td->remove_list))
-                dev_warn(uhci_dev(uhci), "td %p still in remove_list!\n", td);
-        if (!list_empty(&td->fl_list))
-                dev_warn(uhci_dev(uhci), "td %p still in fl_list!\n", td);
-
-        dma_pool_free(uhci->td_pool, td, td->dma_handle);
-}
-
-static struct uhci_qh *uhci_alloc_qh(struct uhci_hcd *uhci)
+static struct uhci_qh *uhci_alloc_qh(struct uhci_hcd *uhci,
+                struct usb_device *udev, struct usb_host_endpoint *hep)
 {
         dma_addr_t dma_handle;
         struct uhci_qh *qh;
@@ -194,256 +166,217 @@ static struct uhci_qh *uhci_alloc_qh(struct uhci_hcd *uhci)
         qh->element = UHCI_PTR_TERM;
         qh->link = UHCI_PTR_TERM;
 
-        qh->urbp = NULL;
-
-        INIT_LIST_HEAD(&qh->list);
-        INIT_LIST_HEAD(&qh->remove_list);
+        INIT_LIST_HEAD(&qh->queue);
+        INIT_LIST_HEAD(&qh->node);
 
+        if (udev) {             /* Normal QH */
+                qh->dummy_td = uhci_alloc_td(uhci);
+                if (!qh->dummy_td) {
+                        dma_pool_free(uhci->qh_pool, qh, dma_handle);
+                        return NULL;
+                }
+                qh->state = QH_STATE_IDLE;
+                qh->hep = hep;
+                qh->udev = udev;
+                hep->hcpriv = qh;
+
+        } else {                /* Skeleton QH */
+                qh->state = QH_STATE_ACTIVE;
+                qh->udev = NULL;
+        }
         return qh;
 }
 
 static void uhci_free_qh(struct uhci_hcd *uhci, struct uhci_qh *qh)
 {
-        if (!list_empty(&qh->list))
+        WARN_ON(qh->state != QH_STATE_IDLE && qh->udev);
+        if (!list_empty(&qh->queue))
                 dev_warn(uhci_dev(uhci), "qh %p list not empty!\n", qh);
-        if (!list_empty(&qh->remove_list))
-                dev_warn(uhci_dev(uhci), "qh %p still in remove_list!\n", qh);
 
+        list_del(&qh->node);
+        if (qh->udev) {
+                qh->hep->hcpriv = NULL;
+                uhci_free_td(uhci, qh->dummy_td);
+        }
         dma_pool_free(uhci->qh_pool, qh, qh->dma_handle);
 }
 
 /*
- * Append this urb's qh after the last qh in skelqh->list
- *
- * Note that urb_priv.queue_list doesn't have a separate queue head;
- * it's a ring with every element "live".
+ * When the currently executing URB is dequeued, save its current toggle value
  */
-static void uhci_insert_qh(struct uhci_hcd *uhci, struct uhci_qh *skelqh, struct urb *urb)
+static void uhci_save_toggle(struct uhci_qh *qh, struct urb *urb)
 {
-        struct urb_priv *urbp = (struct urb_priv *)urb->hcpriv;
-        struct urb_priv *turbp;
-        struct uhci_qh *lqh;
+        struct urb_priv *urbp = (struct urb_priv *) urb->hcpriv;
+        struct uhci_td *td;
 
-        /* Grab the last QH */
-        lqh = list_entry(skelqh->list.prev, struct uhci_qh, list);
+        /* If the QH element pointer is UHCI_PTR_TERM then then currently
+         * executing URB has already been unlinked, so this one isn't it. */
+        if (qh_element(qh) == UHCI_PTR_TERM ||
+                                qh->queue.next != &urbp->node)
+                return;
+        qh->element = UHCI_PTR_TERM;
 
-        /* Point to the next skelqh */
-        urbp->qh->link = lqh->link;
-        wmb();                          /* Ordering is important */
+        /* Only bulk and interrupt pipes have to worry about toggles */
+        if (!(usb_pipetype(urb->pipe) == PIPE_BULK ||
+                        usb_pipetype(urb->pipe) == PIPE_INTERRUPT))
+                return;
 
-        /*
-         * Patch QHs for previous endpoint's queued URBs?  HC goes
-         * here next, not to the next skelqh it now points to.
-         *
-         *    lqh --> td ... --> qh ... --> td --> qh ... --> td
-         *     |                 |                 |
-         *     v                 v                 v
-         *     +<----------------+-----------------+
-         *     v
-         *    newqh --> td ... --> td
-         *     |
-         *     v
-         *    ...
-         *
-         * The HC could see (and use!) any of these as we write them.
-         */
-        lqh->link = cpu_to_le32(urbp->qh->dma_handle) | UHCI_PTR_QH;
-        if (lqh->urbp) {
-                list_for_each_entry(turbp, &lqh->urbp->queue_list, queue_list)
-                        turbp->qh->link = lqh->link;
+        /* Find the first active TD; that's the device's toggle state */
+        list_for_each_entry(td, &urbp->td_list, list) {
+                if (td_status(td) & TD_CTRL_ACTIVE) {
+                        qh->needs_fixup = 1;
+                        qh->initial_toggle = uhci_toggle(td_token(td));
+                        return;
+                }
         }
 
-        list_add_tail(&urbp->qh->list, &skelqh->list);
+        WARN_ON(1);
 }
 
 /*
- * Start removal of QH from schedule; it finishes next frame.
- * TDs should be unlinked before this is called.
+ * Fix up the data toggles for URBs in a queue, when one of them
+ * terminates early (short transfer, error, or dequeued).
  */
-static void uhci_remove_qh(struct uhci_hcd *uhci, struct uhci_qh *qh)
+static void uhci_fixup_toggles(struct uhci_qh *qh, int skip_first)
 {
-        struct uhci_qh *pqh;
-        __le32 newlink;
-
-        if (!qh)
-                return;
-
-        /*
-         * Only go through the hoops if it's actually linked in
-         */
-        if (!list_empty(&qh->list)) {
-
-                /* If our queue is nonempty, make the next URB the head */
-                if (!list_empty(&qh->urbp->queue_list)) {
-                        struct urb_priv *nurbp;
-
-                        nurbp = list_entry(qh->urbp->queue_list.next,
-                                        struct urb_priv, queue_list);
-                        nurbp->queued = 0;
-                        list_add(&nurbp->qh->list, &qh->list);
-                        newlink = cpu_to_le32(nurbp->qh->dma_handle) | UHCI_PTR_QH;
-                } else
-                        newlink = qh->link;
-
-                /* Fix up the previous QH's queue to link to either
-                 * the new head of this queue or the start of the
-                 * next endpoint's queue. */
-                pqh = list_entry(qh->list.prev, struct uhci_qh, list);
-                pqh->link = newlink;
-                if (pqh->urbp) {
-                        struct urb_priv *turbp;
-
-                        list_for_each_entry(turbp, &pqh->urbp->queue_list,
-                                        queue_list)
-                                turbp->qh->link = newlink;
+        struct urb_priv *urbp = NULL;
+        struct uhci_td *td;
+        unsigned int toggle = qh->initial_toggle;
+        unsigned int pipe;
+
+        /* Fixups for a short transfer start with the second URB in the
+         * queue (the short URB is the first). */
+        if (skip_first)
+                urbp = list_entry(qh->queue.next, struct urb_priv, node);
+
+        /* When starting with the first URB, if the QH element pointer is
+         * still valid then we know the URB's toggles are okay. */
+        else if (qh_element(qh) != UHCI_PTR_TERM)
+                toggle = 2;
+
+        /* Fix up the toggle for the URBs in the queue.  Normally this
+         * loop won't run more than once: When an error or short transfer
+         * occurs, the queue usually gets emptied. */
+        urbp = list_prepare_entry(urbp, &qh->queue, node);
+        list_for_each_entry_continue(urbp, &qh->queue, node) {
+
+                /* If the first TD has the right toggle value, we don't
+                 * need to change any toggles in this URB */
+                td = list_entry(urbp->td_list.next, struct uhci_td, list);
+                if (toggle > 1 || uhci_toggle(td_token(td)) == toggle) {
+                        td = list_entry(urbp->td_list.next, struct uhci_td,
+                                        list);
+                        toggle = uhci_toggle(td_token(td)) ^ 1;
+
+                /* Otherwise all the toggles in the URB have to be switched */
+                } else {
+                        list_for_each_entry(td, &urbp->td_list, list) {
+                                td->token ^= __constant_cpu_to_le32(
+                                                        TD_TOKEN_TOGGLE);
+                                toggle ^= 1;
+                        }
                 }
-                wmb();
-
-                /* Leave qh->link in case the HC is on the QH now, it will */
-                /* continue the rest of the schedule */
-                qh->element = UHCI_PTR_TERM;
-
-                list_del_init(&qh->list);
-        }
-
-        list_del_init(&qh->urbp->queue_list);
-        qh->urbp = NULL;
-
-        uhci_get_current_frame_number(uhci);
-        if (uhci->frame_number + uhci->is_stopped != uhci->qh_remove_age) {
-                uhci_free_pending_qhs(uhci);
-                uhci->qh_remove_age = uhci->frame_number;
         }
 
-        /* Check to see if the remove list is empty. Set the IOC bit */
-        /* to force an interrupt so we can remove the QH */
-        if (list_empty(&uhci->qh_remove_list))
-                uhci_set_next_interrupt(uhci);
-
-        list_add(&qh->remove_list, &uhci->qh_remove_list);
+        wmb();
+        pipe = list_entry(qh->queue.next, struct urb_priv, node)->urb->pipe;
+        usb_settoggle(qh->udev, usb_pipeendpoint(pipe),
+                        usb_pipeout(pipe), toggle);
+        qh->needs_fixup = 0;
 }
 
-static int uhci_fixup_toggle(struct urb *urb, unsigned int toggle)
+/*
+ * Put a QH on the schedule in both hardware and software
+ */
+static void uhci_activate_qh(struct uhci_hcd *uhci, struct uhci_qh *qh)
 {
-        struct urb_priv *urbp = (struct urb_priv *)urb->hcpriv;
-        struct uhci_td *td;
-
-        list_for_each_entry(td, &urbp->td_list, list) {
-                if (toggle)
-                        td->token |= cpu_to_le32(TD_TOKEN_TOGGLE);
-                else
-                        td->token &= ~cpu_to_le32(TD_TOKEN_TOGGLE);
-
-                toggle ^= 1;
-        }
-
-        return toggle;
-}
+        struct uhci_qh *pqh;
 
-/* This function will append one URB's QH to another URB's QH. This is for */
-/* queuing interrupt, control or bulk transfers */
-static void uhci_append_queued_urb(struct uhci_hcd *uhci, struct urb *eurb, struct urb *urb)
-{
-        struct urb_priv *eurbp, *urbp, *furbp, *lurbp;
-        struct uhci_td *lltd;
+        WARN_ON(list_empty(&qh->queue));
 
-        eurbp = eurb->hcpriv;
-        urbp = urb->hcpriv;
+        /* Set the element pointer if it isn't set already.
+         * This isn't needed for Isochronous queues, but it doesn't hurt. */
+        if (qh_element(qh) == UHCI_PTR_TERM) {
+                struct urb_priv *urbp = list_entry(qh->queue.next,
+                                struct urb_priv, node);
+                struct uhci_td *td = list_entry(urbp->td_list.next,
+                                struct uhci_td, list);
 
-        /* Find the first URB in the queue */
-        furbp = eurbp;
-        if (eurbp->queued) {
-                list_for_each_entry(furbp, &eurbp->queue_list, queue_list)
-                        if (!furbp->queued)
-                                break;
+                qh->element = cpu_to_le32(td->dma_handle);
         }
 
-        lurbp = list_entry(furbp->queue_list.prev, struct urb_priv, queue_list);
-
-        lltd = list_entry(lurbp->td_list.prev, struct uhci_td, list);
-
-        /* Control transfers always start with toggle 0 */
-        if (!usb_pipecontrol(urb->pipe))
-                usb_settoggle(urb->dev, usb_pipeendpoint(urb->pipe),
-                                usb_pipeout(urb->pipe),
-                                uhci_fixup_toggle(urb,
-                                        uhci_toggle(td_token(lltd)) ^ 1));
-
-        /* All qhs in the queue need to link to the next queue */
-        urbp->qh->link = eurbp->qh->link;
-
-        wmb();                  /* Make sure we flush everything */
-
-        lltd->link = cpu_to_le32(urbp->qh->dma_handle) | UHCI_PTR_QH;
-
-        list_add_tail(&urbp->queue_list, &furbp->queue_list);
-
-        urbp->queued = 1;
+        if (qh->state == QH_STATE_ACTIVE)
+                return;
+        qh->state = QH_STATE_ACTIVE;
+
+        /* Move the QH from its old list to the end of the appropriate
+         * skeleton's list */
+        if (qh == uhci->next_qh)
+                uhci->next_qh = list_entry(qh->node.next, struct uhci_qh,
+                                node);
+        list_move_tail(&qh->node, &qh->skel->node);
+
+        /* Link it into the schedule */
+        pqh = list_entry(qh->node.prev, struct uhci_qh, node);
+        qh->link = pqh->link;
+        wmb();
+        pqh->link = UHCI_PTR_QH | cpu_to_le32(qh->dma_handle);
 }
 
-static void uhci_delete_queued_urb(struct uhci_hcd *uhci, struct urb *urb)
+/*
+ * Take a QH off the hardware schedule
+ */
+static void uhci_unlink_qh(struct uhci_hcd *uhci, struct uhci_qh *qh)
 {
-        struct urb_priv *urbp, *nurbp, *purbp, *turbp;
-        struct uhci_td *pltd;
-        unsigned int toggle;
-
-        urbp = urb->hcpriv;
+        struct uhci_qh *pqh;
 
-        if (list_empty(&urbp->queue_list))
+        if (qh->state == QH_STATE_UNLINKING)
                 return;
+        WARN_ON(qh->state != QH_STATE_ACTIVE || !qh->udev);
+        qh->state = QH_STATE_UNLINKING;
 
-        nurbp = list_entry(urbp->queue_list.next, struct urb_priv, queue_list);
+        /* Unlink the QH from the schedule and record when we did it */
+        pqh = list_entry(qh->node.prev, struct uhci_qh, node);
+        pqh->link = qh->link;
+        mb();
 
-        /*
-         * Fix up the toggle for the following URBs in the queue.
-         * Only needed for bulk and interrupt: control and isochronous
-         * endpoints don't propagate toggles between messages.
-         */
-        if (usb_pipebulk(urb->pipe) || usb_pipeint(urb->pipe)) {
-                if (!urbp->queued)
-                        /* We just set the toggle in uhci_unlink_generic */
-                        toggle = usb_gettoggle(urb->dev,
-                                        usb_pipeendpoint(urb->pipe),
-                                        usb_pipeout(urb->pipe));
-                else {
-                        /* If we're in the middle of the queue, grab the */
-                        /* toggle from the TD previous to us */
-                        purbp = list_entry(urbp->queue_list.prev,
-                                        struct urb_priv, queue_list);
-                        pltd = list_entry(purbp->td_list.prev,
-                                        struct uhci_td, list);
-                        toggle = uhci_toggle(td_token(pltd)) ^ 1;
-                }
+        uhci_get_current_frame_number(uhci);
+        qh->unlink_frame = uhci->frame_number;
 
-                list_for_each_entry(turbp, &urbp->queue_list, queue_list) {
-                        if (!turbp->queued)
-                                break;
-                        toggle = uhci_fixup_toggle(turbp->urb, toggle);
-                }
+        /* Force an interrupt so we know when the QH is fully unlinked */
+        if (list_empty(&uhci->skel_unlink_qh->node))
+                uhci_set_next_interrupt(uhci);
 
-                usb_settoggle(urb->dev, usb_pipeendpoint(urb->pipe),
-                                usb_pipeout(urb->pipe), toggle);
-        }
+        /* Move the QH from its old list to the end of the unlinking list */
+        if (qh == uhci->next_qh)
+                uhci->next_qh = list_entry(qh->node.next, struct uhci_qh,
+                                node);
+        list_move_tail(&qh->node, &uhci->skel_unlink_qh->node);
+}
 
-        if (urbp->queued) {
-                /* We're somewhere in the middle (or end).  The case where
-                 * we're at the head is handled in uhci_remove_qh(). */
-                purbp = list_entry(urbp->queue_list.prev, struct urb_priv,
-                                queue_list);
+/*
+ * When we and the controller are through with a QH, it becomes IDLE.
+ * This happens when a QH has been off the schedule (on the unlinking
+ * list) for more than one frame, or when an error occurs while adding
+ * the first URB onto a new QH.
+ */
+static void uhci_make_qh_idle(struct uhci_hcd *uhci, struct uhci_qh *qh)
+{
+        WARN_ON(qh->state == QH_STATE_ACTIVE);
 
-                pltd = list_entry(purbp->td_list.prev, struct uhci_td, list);
-                if (nurbp->queued)
-                        pltd->link = cpu_to_le32(nurbp->qh->dma_handle) | UHCI_PTR_QH;
-                else
-                        /* The next URB happens to be the beginning, so */
-                        /*  we're the last, end the chain */
-                        pltd->link = UHCI_PTR_TERM;
-        }
+        if (qh == uhci->next_qh)
+                uhci->next_qh = list_entry(qh->node.next, struct uhci_qh,
+                                node);
+        list_move(&qh->node, &uhci->idle_qh_list);
+        qh->state = QH_STATE_IDLE;
 
-        /* urbp->queue_list is handled in uhci_remove_qh() */
+        /* If anyone is waiting for a QH to become idle, wake them up */
+        if (uhci->num_waiting)
+                wake_up_all(&uhci->waitqh);
 }
 
-static struct urb_priv *uhci_alloc_urb_priv(struct uhci_hcd *uhci, struct urb *urb)
+static inline struct urb_priv *uhci_alloc_urb_priv(struct uhci_hcd *uhci,
+                struct urb *urb)
 {
         struct urb_priv *urbp;
 
@@ -453,16 +386,11 @@ static struct urb_priv *uhci_alloc_urb_priv(struct uhci_hcd *uhci, struct urb *u
 
         memset((void *)urbp, 0, sizeof(*urbp));
 
-        urbp->fsbrtime = jiffies;
         urbp->urb = urb;
+        urb->hcpriv = urbp;
         
+        INIT_LIST_HEAD(&urbp->node);
         INIT_LIST_HEAD(&urbp->td_list);
-        INIT_LIST_HEAD(&urbp->queue_list);
-        INIT_LIST_HEAD(&urbp->urb_list);
-
-        list_add_tail(&urbp->urb_list, &uhci->urb_list);
-
-        urb->hcpriv = urbp;
 
         return urbp;
 }
@@ -482,18 +410,14 @@ static void uhci_remove_td_from_urb(struct uhci_td *td)
         list_del_init(&td->list);
 }
 
-static void uhci_destroy_urb_priv(struct uhci_hcd *uhci, struct urb *urb)
+static void uhci_free_urb_priv(struct uhci_hcd *uhci,
+                struct urb_priv *urbp)
 {
         struct uhci_td *td, *tmp;
-        struct urb_priv *urbp;
-
-        urbp = (struct urb_priv *)urb->hcpriv;
-        if (!urbp)
-                return;
 
-        if (!list_empty(&urbp->urb_list))
-                dev_warn(uhci_dev(uhci), "urb %p still on uhci->urb_list "
-                                "or uhci->remove_list!\n", urb);
+        if (!list_empty(&urbp->node))
+                dev_warn(uhci_dev(uhci), "urb %p still on QH's list!\n",
+                                urbp->urb);
 
         uhci_get_current_frame_number(uhci);
         if (uhci->frame_number + uhci->is_stopped != uhci->td_remove_age) {
@@ -502,7 +426,7 @@ static void uhci_destroy_urb_priv(struct uhci_hcd *uhci, struct urb *urb)
         }
 
         /* Check to see if the remove list is empty. Set the IOC bit */
-        /* to force an interrupt so we can remove the TDs*/
+        /* to force an interrupt so we can remove the TDs. */
         if (list_empty(&uhci->td_remove_list))
                 uhci_set_next_interrupt(uhci);
 
@@ -511,7 +435,7 @@ static void uhci_destroy_urb_priv(struct uhci_hcd *uhci, struct urb *urb)
                 list_add(&td->remove_list, &uhci->td_remove_list);
         }
 
-        urb->hcpriv = NULL;
+        urbp->urb->hcpriv = NULL;
         kmem_cache_free(uhci_up_cachep, urbp);
 }
 
@@ -570,34 +494,33 @@ static int uhci_map_status(int status, int dir_out)
 /*
  * Control transfers
  */
-static int uhci_submit_control(struct uhci_hcd *uhci, struct urb *urb, struct urb *eurb)
+static int uhci_submit_control(struct uhci_hcd *uhci, struct urb *urb,
+                struct uhci_qh *qh)
 {
-        struct urb_priv *urbp = (struct urb_priv *)urb->hcpriv;
         struct uhci_td *td;
-        struct uhci_qh *qh, *skelqh;
         unsigned long destination, status;
-        int maxsze = usb_maxpacket(urb->dev, urb->pipe, usb_pipeout(urb->pipe));
+        int maxsze = le16_to_cpu(qh->hep->desc.wMaxPacketSize);
         int len = urb->transfer_buffer_length;
         dma_addr_t data = urb->transfer_dma;
+        __le32 *plink;
 
         /* The "pipe" thing contains the destination in bits 8--18 */
         destination = (urb->pipe & PIPE_DEVEP_MASK) | USB_PID_SETUP;
 
-        /* 3 errors */
-        status = TD_CTRL_ACTIVE | uhci_maxerr(3);
+        /* 3 errors, dummy TD remains inactive */
+        status = uhci_maxerr(3);
         if (urb->dev->speed == USB_SPEED_LOW)
                 status |= TD_CTRL_LS;
 
         /*
          * Build the TD for the control request setup packet
          */
-        td = uhci_alloc_td(uhci);
-        if (!td)
-                return -ENOMEM;
-
+        td = qh->dummy_td;
         uhci_add_td_to_urb(urb, td);
         uhci_fill_td(td, status, destination | uhci_explen(8),
-                urb->setup_dma);
+                        urb->setup_dma);
+        plink = &td->link;
+        status |= TD_CTRL_ACTIVE;
 
         /*
          * If direction is "send", change the packet ID from SETUP (0x2D)
@@ -615,21 +538,20 @@ static int uhci_submit_control(struct uhci_hcd *uhci, struct urb *urb, struct ur
          * Build the DATA TDs
          */
         while (len > 0) {
-                int pktsze = len;
-
-                if (pktsze > maxsze)
-                        pktsze = maxsze;
+                int pktsze = min(len, maxsze);
 
                 td = uhci_alloc_td(uhci);
                 if (!td)
-                        return -ENOMEM;
+                        goto nomem;
+                *plink = cpu_to_le32(td->dma_handle);
 
                 /* Alternate Data0/1 (start with Data1) */
                 destination ^= TD_TOKEN_TOGGLE;
         
                 uhci_add_td_to_urb(urb, td);
                 uhci_fill_td(td, status, destination | uhci_explen(pktsze),
-                        data);
+                                data);
+                plink = &td->link;
 
                 data += pktsze;
                 len -= pktsze;
@@ -640,7 +562,8 @@ static int uhci_submit_control(struct uhci_hcd *uhci, struct urb *urb, struct ur
          */
         td = uhci_alloc_td(uhci);
         if (!td)
-                return -ENOMEM;
+                goto nomem;
+        *plink = cpu_to_le32(td->dma_handle);
 
         /*
          * It's IN if the pipe is an output pipe or we're not expecting
@@ -658,16 +581,21 @@ static int uhci_submit_control(struct uhci_hcd *uhci, struct urb *urb, struct ur
 
         uhci_add_td_to_urb(urb, td);
         uhci_fill_td(td, status | TD_CTRL_IOC,
-                destination | uhci_explen(0), 0);
-
-        qh = uhci_alloc_qh(uhci);
-        if (!qh)
-                return -ENOMEM;
+                        destination | uhci_explen(0), 0);
+        plink = &td->link;
 
-        urbp->qh = qh;
-        qh->urbp = urbp;
+        /*
+         * Build the new dummy TD and activate the old one
+         */
+        td = uhci_alloc_td(uhci);
+        if (!td)
+                goto nomem;
+        *plink = cpu_to_le32(td->dma_handle);
 
-        uhci_insert_tds_in_qh(qh, urb, UHCI_PTR_BREADTH);
+        uhci_fill_td(td, 0, USB_PID_OUT | uhci_explen(0), 0);
+        wmb();
+        qh->dummy_td->status |= __constant_cpu_to_le32(TD_CTRL_ACTIVE);
+        qh->dummy_td = td;
 
         /* Low-speed transfers get a different queue, and won't hog the bus.
          * Also, some devices enumerate better without FSBR; the easiest way
@@ -675,18 +603,17 @@ static int uhci_submit_control(struct uhci_hcd *uhci, struct urb *urb, struct ur
          * isn't in the CONFIGURED state. */
         if (urb->dev->speed == USB_SPEED_LOW ||
                         urb->dev->state != USB_STATE_CONFIGURED)
-                skelqh = uhci->skel_ls_control_qh;
+                qh->skel = uhci->skel_ls_control_qh;
         else {
-                skelqh = uhci->skel_fs_control_qh;
+                qh->skel = uhci->skel_fs_control_qh;
                 uhci_inc_fsbr(uhci, urb);
         }
+        return 0;
 
-        if (eurb)
-                uhci_append_queued_urb(uhci, eurb, urb);
-        else
-                uhci_insert_qh(uhci, skelqh, urb);
-
-        return -EINPROGRESS;
+nomem:
+        /* Remove the dummy TD from the td_list so it doesn't get freed */
+        uhci_remove_td_from_urb(qh->dummy_td);
+        return -ENOMEM;
 }
 
 /*
@@ -703,7 +630,7 @@ static int usb_control_retrigger_status(struct uhci_hcd *uhci, struct urb *urb)
         struct urb_priv *urbp = (struct urb_priv *)urb->hcpriv;
         struct uhci_td *td;
 
-        urbp->short_control_packet = 1;
+        urbp->short_transfer = 1;
 
         td = list_entry(urbp->td_list.prev, struct uhci_td, list);
         urbp->qh->element = cpu_to_le32(td->dma_handle);
@@ -720,16 +647,14 @@ static int uhci_result_control(struct uhci_hcd *uhci, struct urb *urb)
         unsigned int status;
         int ret = 0;
 
-        if (list_empty(&urbp->td_list))
-                return -EINVAL;
-
         head = &urbp->td_list;
-
-        if (urbp->short_control_packet) {
+        if (urbp->short_transfer) {
                 tmp = head->prev;
                 goto status_stage;
         }
 
+        urb->actual_length = 0;
+
         tmp = head->next;
         td = list_entry(tmp, struct uhci_td, list);
 
@@ -742,8 +667,6 @@ static int uhci_result_control(struct uhci_hcd *uhci, struct urb *urb)
         if (status)
                 goto td_error;
 
-        urb->actual_length = 0;
-
         /* The rest of the TDs (but the last) are data */
         tmp = tmp->next;
         while (tmp != head && tmp->next != head) {
@@ -770,10 +693,7 @@ static int uhci_result_control(struct uhci_hcd *uhci, struct urb *urb)
                                 goto err;
                         }
 
-                        if (uhci_packetid(td_token(td)) == USB_PID_IN)
-                                return usb_control_retrigger_status(uhci, urb);
-                        else
-                                return 0;
+                        return usb_control_retrigger_status(uhci, urb);
                 }
         }
 
@@ -814,34 +734,40 @@ err:
                 if (errbuf) {
                         /* Print the chain for debugging purposes */
                         uhci_show_qh(urbp->qh, errbuf, ERRBUF_LEN, 0);
-
                         lprintk(errbuf);
                 }
         }
 
+        /* Note that the queue has stopped */
+        urbp->qh->element = UHCI_PTR_TERM;
+        urbp->qh->is_stopped = 1;
         return ret;
 }
 
 /*
  * Common submit for bulk and interrupt
  */
-static int uhci_submit_common(struct uhci_hcd *uhci, struct urb *urb, struct urb *eurb, struct uhci_qh *skelqh)
+static int uhci_submit_common(struct uhci_hcd *uhci, struct urb *urb,
+                struct uhci_qh *qh)
 {
         struct uhci_td *td;
-        struct uhci_qh *qh;
         unsigned long destination, status;
-        int maxsze = usb_maxpacket(urb->dev, urb->pipe, usb_pipeout(urb->pipe));
+        int maxsze = le16_to_cpu(qh->hep->desc.wMaxPacketSize);
         int len = urb->transfer_buffer_length;
-        struct urb_priv *urbp = (struct urb_priv *)urb->hcpriv;
         dma_addr_t data = urb->transfer_dma;
+        __le32 *plink;
+        unsigned int toggle;
 
         if (len < 0)
                 return -EINVAL;
 
         /* The "pipe" thing contains the destination in bits 8--18 */
         destination = (urb->pipe & PIPE_DEVEP_MASK) | usb_packetid(urb->pipe);
+        toggle = usb_gettoggle(urb->dev, usb_pipeendpoint(urb->pipe),
+                         usb_pipeout(urb->pipe));
 
-        status = uhci_maxerr(3) | TD_CTRL_ACTIVE;
+        /* 3 errors, dummy TD remains inactive */
+        status = uhci_maxerr(3);
         if (urb->dev->speed == USB_SPEED_LOW)
                 status |= TD_CTRL_LS;
         if (usb_pipein(urb->pipe))
@@ -850,30 +776,34 @@ static int uhci_submit_common(struct uhci_hcd *uhci, struct urb *urb, struct urb
         /*
          * Build the DATA TDs
          */
+        plink = NULL;
+        td = qh->dummy_td;
         do {    /* Allow zero length packets */
                 int pktsze = maxsze;
 
-                if (pktsze >= len) {
+                if (len <= pktsze) {            /* The last packet */
                         pktsze = len;
                         if (!(urb->transfer_flags & URB_SHORT_NOT_OK))
                                 status &= ~TD_CTRL_SPD;
                 }
 
-                td = uhci_alloc_td(uhci);
-                if (!td)
-                        return -ENOMEM;
-
+                if (plink) {
+                        td = uhci_alloc_td(uhci);
+                        if (!td)
+                                goto nomem;
+                        *plink = cpu_to_le32(td->dma_handle);
+                }
                 uhci_add_td_to_urb(urb, td);
-                uhci_fill_td(td, status, destination | uhci_explen(pktsze) |
-                        (usb_gettoggle(urb->dev, usb_pipeendpoint(urb->pipe),
-                         usb_pipeout(urb->pipe)) << TD_TOKEN_TOGGLE_SHIFT),
-                        data);
+                uhci_fill_td(td, status,
+                                destination | uhci_explen(pktsze) |
+                                        (toggle << TD_TOKEN_TOGGLE_SHIFT),
+                                data);
+                plink = &td->link;
+                status |= TD_CTRL_ACTIVE;
 
                 data += pktsze;
                 len -= maxsze;
-
-                usb_dotoggle(urb->dev, usb_pipeendpoint(urb->pipe),
-                        usb_pipeout(urb->pipe));
+                toggle ^= 1;
         } while (len > 0);
 
         /*
@@ -883,20 +813,22 @@ static int uhci_submit_common(struct uhci_hcd *uhci, struct urb *urb, struct urb
          * however, if transfer_length == 0, the zero packet was already
          * prepared above.
          */
-        if (usb_pipeout(urb->pipe) && (urb->transfer_flags & URB_ZERO_PACKET) &&
-            !len && urb->transfer_buffer_length) {
+        if ((urb->transfer_flags & URB_ZERO_PACKET) &&
+                        usb_pipeout(urb->pipe) && len == 0 &&
+                        urb->transfer_buffer_length > 0) {
                 td = uhci_alloc_td(uhci);
                 if (!td)
-                        return -ENOMEM;
+                        goto nomem;
+                *plink = cpu_to_le32(td->dma_handle);
 
                 uhci_add_td_to_urb(urb, td);
-                uhci_fill_td(td, status, destination | uhci_explen(0) |
-                        (usb_gettoggle(urb->dev, usb_pipeendpoint(urb->pipe),
-                         usb_pipeout(urb->pipe)) << TD_TOKEN_TOGGLE_SHIFT),
-                        data);
+                uhci_fill_td(td, status,
+                                destination | uhci_explen(0) |
+                                        (toggle << TD_TOKEN_TOGGLE_SHIFT),
+                                data);
+                plink = &td->link;
 
-                usb_dotoggle(urb->dev, usb_pipeendpoint(urb->pipe),
-                        usb_pipeout(urb->pipe));
+                toggle ^= 1;
         }
 
         /* Set the interrupt-on-completion flag on the last packet.
@@ -905,24 +837,29 @@ static int uhci_submit_common(struct uhci_hcd *uhci, struct urb *urb, struct urb
          * fast side but not enough to justify delaying an interrupt
          * more than 2 or 3 URBs, so we will ignore the URB_NO_INTERRUPT
          * flag setting. */
-        td->status |= cpu_to_le32(TD_CTRL_IOC);
+        td->status |= __constant_cpu_to_le32(TD_CTRL_IOC);
 
-        qh = uhci_alloc_qh(uhci);
-        if (!qh)
-                return -ENOMEM;
-
-        urbp->qh = qh;
-        qh->urbp = urbp;
+        /*
+         * Build the new dummy TD and activate the old one
+         */
+        td = uhci_alloc_td(uhci);
+        if (!td)
+                goto nomem;
+        *plink = cpu_to_le32(td->dma_handle);
 
-        /* Always breadth first */
-        uhci_insert_tds_in_qh(qh, urb, UHCI_PTR_BREADTH);
+        uhci_fill_td(td, 0, USB_PID_OUT | uhci_explen(0), 0);
+        wmb();
+        qh->dummy_td->status |= __constant_cpu_to_le32(TD_CTRL_ACTIVE);
+        qh->dummy_td = td;
 
-        if (eurb)
-                uhci_append_queued_urb(uhci, eurb, urb);
-        else
-                uhci_insert_qh(uhci, skelqh, urb);
+        usb_settoggle(urb->dev, usb_pipeendpoint(urb->pipe),
+                        usb_pipeout(urb->pipe), toggle);
+        return 0;
 
-        return -EINPROGRESS;
+nomem:
+        /* Remove the dummy TD from the td_list so it doesn't get freed */
+        uhci_remove_td_from_urb(qh->dummy_td);
+        return -ENOMEM;
 }
 
 /*
@@ -954,8 +891,27 @@ static int uhci_result_common(struct uhci_hcd *uhci, struct urb *urb)
                         if (urb->transfer_flags & URB_SHORT_NOT_OK) {
                                 ret = -EREMOTEIO;
                                 goto err;
-                        } else
-                                return 0;
+                        }
+
+                        /*
+                         * This URB stopped short of its end.  We have to
+                         * fix up the toggles of the following URBs on the
+                         * queue and restart the queue.
+                         *
+                         * Do this only the first time we encounter the
+                         * short URB.
+                         */
+                        if (!urbp->short_transfer) {
+                                urbp->short_transfer = 1;
+                                urbp->qh->initial_toggle =
+                                                uhci_toggle(td_token(td)) ^ 1;
+                                uhci_fixup_toggles(urbp->qh, 1);
+
+                                td = list_entry(urbp->td_list.prev,
+                                                struct uhci_td, list);
+                                urbp->qh->element = td->link;
+                        }
+                        break;
                 }
         }
 
@@ -964,31 +920,30 @@ static int uhci_result_common(struct uhci_hcd *uhci, struct urb *urb)
 td_error:
         ret = uhci_map_status(status, uhci_packetout(td_token(td)));
 
-err:
-        /* 
-         * Enable this chunk of code if you want to see some more debugging.
-         * But be careful, it has the tendancy to starve out khubd and prevent
-         * disconnects from happening successfully if you have a slow debug
-         * log interface (like a serial console.
-         */
-#if 0
         if ((debug == 1 && ret != -EPIPE) || debug > 1) {
                 /* Some debugging code */
                 dev_dbg(uhci_dev(uhci), "%s: failed with status %x\n",
                                 __FUNCTION__, status);
 
-                if (errbuf) {
+                if (debug > 1 && errbuf) {
                         /* Print the chain for debugging purposes */
                         uhci_show_qh(urbp->qh, errbuf, ERRBUF_LEN, 0);
-
                         lprintk(errbuf);
                 }
         }
-#endif
+err:
+
+        /* Note that the queue has stopped and save the next toggle value */
+        urbp->qh->element = UHCI_PTR_TERM;
+        urbp->qh->is_stopped = 1;
+        urbp->qh->needs_fixup = 1;
+        urbp->qh->initial_toggle = uhci_toggle(td_token(td)) ^
+                        (ret == -EREMOTEIO);
         return ret;
 }
 
-static inline int uhci_submit_bulk(struct uhci_hcd *uhci, struct urb *urb, struct urb *eurb)
+static inline int uhci_submit_bulk(struct uhci_hcd *uhci, struct urb *urb,
+                struct uhci_qh *qh)
 {
         int ret;
 
@@ -996,95 +951,60 @@ static inline int uhci_submit_bulk(struct uhci_hcd *uhci, struct urb *urb, struc
         if (urb->dev->speed == USB_SPEED_LOW)
                 return -EINVAL;
 
-        ret = uhci_submit_common(uhci, urb, eurb, uhci->skel_bulk_qh);
-        if (ret == -EINPROGRESS)
+        qh->skel = uhci->skel_bulk_qh;
+        ret = uhci_submit_common(uhci, urb, qh);
+        if (ret == 0)
                 uhci_inc_fsbr(uhci, urb);
-
         return ret;
 }
 
-static inline int uhci_submit_interrupt(struct uhci_hcd *uhci, struct urb *urb, struct urb *eurb)
+static inline int uhci_submit_interrupt(struct uhci_hcd *uhci, struct urb *urb,
+                struct uhci_qh *qh)
 {
-        /* USB 1.1 interrupt transfers only involve one packet per interval;
-         * that's the uhci_submit_common() "breadth first" policy.  Drivers
-         * can submit urbs of any length, but longer ones might need many
-         * intervals to complete.
+        /* USB 1.1 interrupt transfers only involve one packet per interval.
+         * Drivers can submit URBs of any length, but longer ones will need
+         * multiple intervals to complete.
          */
-        return uhci_submit_common(uhci, urb, eurb, uhci->skelqh[__interval_to_skel(urb->interval)]);
+        qh->skel = uhci->skelqh[__interval_to_skel(urb->interval)];
+        return uhci_submit_common(uhci, urb, qh);
 }
 
 /*
  * Isochronous transfers
  */
-static int isochronous_find_limits(struct uhci_hcd *uhci, struct urb *urb, unsigned int *start, unsigned int *end)
-{
-        struct urb *last_urb = NULL;
-        struct urb_priv *up;
-        int ret = 0;
-
-        list_for_each_entry(up, &uhci->urb_list, urb_list) {
-                struct urb *u = up->urb;
-
-                /* look for pending URBs with identical pipe handle */
-                if ((urb->pipe == u->pipe) && (urb->dev == u->dev) &&
-                    (u->status == -EINPROGRESS) && (u != urb)) {
-                        if (!last_urb)
-                                *start = u->start_frame;
-                        last_urb = u;
-                }
-        }
-
-        if (last_urb) {
-                *end = (last_urb->start_frame + last_urb->number_of_packets *
-                                last_urb->interval) & (UHCI_NUMFRAMES-1);
-                ret = 0;
-        } else
-                ret = -1;       /* no previous urb found */
-
-        return ret;
-}
-
-static int isochronous_find_start(struct uhci_hcd *uhci, struct urb *urb)
+static int uhci_submit_isochronous(struct uhci_hcd *uhci, struct urb *urb,
+                struct uhci_qh *qh)
 {
-        int limits;
-        unsigned int start = 0, end = 0;
+        struct uhci_td *td = NULL;      /* Since urb->number_of_packets > 0 */
+        int i, frame;
+        unsigned long destination, status;
+        struct urb_priv *urbp = (struct urb_priv *) urb->hcpriv;
 
         if (urb->number_of_packets > 900)       /* 900? Why? */
                 return -EFBIG;
 
-        limits = isochronous_find_limits(uhci, urb, &start, &end);
+        status = TD_CTRL_ACTIVE | TD_CTRL_IOS;
+        destination = (urb->pipe & PIPE_DEVEP_MASK) | usb_packetid(urb->pipe);
 
+        /* Figure out the starting frame number */
         if (urb->transfer_flags & URB_ISO_ASAP) {
-                if (limits) {
+                if (list_empty(&qh->queue)) {
                         uhci_get_current_frame_number(uhci);
-                        urb->start_frame = (uhci->frame_number + 10)
-                                        & (UHCI_NUMFRAMES - 1);
-                } else
-                        urb->start_frame = end;
+                        urb->start_frame = (uhci->frame_number + 10);
+
+                } else {                /* Go right after the last one */
+                        struct urb *last_urb;
+
+                        last_urb = list_entry(qh->queue.prev,
+                                        struct urb_priv, node)->urb;
+                        urb->start_frame = (last_urb->start_frame +
+                                        last_urb->number_of_packets *
+                                        last_urb->interval);
+                }
         } else {
-                urb->start_frame &= (UHCI_NUMFRAMES - 1);
                 /* FIXME: Sanity check */
         }
-
-        return 0;
-}
-
-/*
- * Isochronous transfers
- */
-static int uhci_submit_isochronous(struct uhci_hcd *uhci, struct urb *urb)
-{
-        struct uhci_td *td;
-        int i, ret, frame;
-        int status, destination;
-        struct urb_priv *urbp = (struct urb_priv *) urb->hcpriv;
-
-        status = TD_CTRL_ACTIVE | TD_CTRL_IOS;
-        destination = (urb->pipe & PIPE_DEVEP_MASK) | usb_packetid(urb->pipe);
-
-        ret = isochronous_find_start(uhci, urb);
-        if (ret)
-                return ret;
+        urb->start_frame &= (UHCI_NUMFRAMES - 1);
 
         for (i = 0; i < urb->number_of_packets; i++) {
                 td = uhci_alloc_td(uhci);
@@ -1092,20 +1012,25 @@ static int uhci_submit_isochronous(struct uhci_hcd *uhci, struct urb *urb)
                         return -ENOMEM;
 
                 uhci_add_td_to_urb(urb, td);
-                uhci_fill_td(td, status, destination | uhci_explen(urb->iso_frame_desc[i].length),
-                        urb->transfer_dma + urb->iso_frame_desc[i].offset);
-
-                if (i + 1 >= urb->number_of_packets)
-                        td->status |= cpu_to_le32(TD_CTRL_IOC);
+                uhci_fill_td(td, status, destination |
+                                uhci_explen(urb->iso_frame_desc[i].length),
+                                urb->transfer_dma +
+                                        urb->iso_frame_desc[i].offset);
         }
 
+        /* Set the interrupt-on-completion flag on the last packet. */
+        td->status |= __constant_cpu_to_le32(TD_CTRL_IOC);
+
+        qh->skel = uhci->skel_iso_qh;
+
+        /* Add the TDs to the frame list */
         frame = urb->start_frame;
         list_for_each_entry(td, &urbp->td_list, list) {
-                uhci_insert_td_frame_list(uhci, td, frame);
+                uhci_insert_td_in_frame_list(uhci, td, frame);
                 frame += urb->interval;
         }
 
-        return -EINPROGRESS;
+        return 0;
 }
 
 static int uhci_result_isochronous(struct uhci_hcd *uhci, struct urb *urb)
@@ -1139,80 +1064,67 @@ static int uhci_result_isochronous(struct uhci_hcd *uhci, struct urb *urb)
 
                 i++;
         }
-        unlink_isochronous_tds(uhci, urb);
 
         return ret;
 }
 
-static struct urb *uhci_find_urb_ep(struct uhci_hcd *uhci, struct urb *urb)
-{
-        struct urb_priv *up;
-
-        /* We don't match Isoc transfers since they are special */
-        if (usb_pipeisoc(urb->pipe))
-                return NULL;
-
-        list_for_each_entry(up, &uhci->urb_list, urb_list) {
-                struct urb *u = up->urb;
-
-                if (u->dev == urb->dev && u->status == -EINPROGRESS) {
-                        /* For control, ignore the direction */
-                        if (usb_pipecontrol(urb->pipe) &&
-                            (u->pipe & ~USB_DIR_IN) == (urb->pipe & ~USB_DIR_IN))
-                                return u;
-                        else if (u->pipe == urb->pipe)
-                                return u;
-                }
-        }
-
-        return NULL;
-}
-
 static int uhci_urb_enqueue(struct usb_hcd *hcd,
-                struct usb_host_endpoint *ep,
+                struct usb_host_endpoint *hep,
                 struct urb *urb, gfp_t mem_flags)
 {
         int ret;
         struct uhci_hcd *uhci = hcd_to_uhci(hcd);
         unsigned long flags;
-        struct urb *eurb;
+        struct urb_priv *urbp;
+        struct uhci_qh *qh;
         int bustime;
 
         spin_lock_irqsave(&uhci->lock, flags);
 
         ret = urb->status;
         if (ret != -EINPROGRESS)                /* URB already unlinked! */
-                goto out;
+                goto done;
 
-        eurb = uhci_find_urb_ep(uhci, urb);
+        ret = -ENOMEM;
+        urbp = uhci_alloc_urb_priv(uhci, urb);
+        if (!urbp)
+                goto done;
 
-        if (!uhci_alloc_urb_priv(uhci, urb)) {
-                ret = -ENOMEM;
-                goto out;
+        if (hep->hcpriv)
+                qh = (struct uhci_qh *) hep->hcpriv;
+        else {
+                qh = uhci_alloc_qh(uhci, urb->dev, hep);
+                if (!qh)
+                        goto err_no_qh;
         }
+        urbp->qh = qh;
 
         switch (usb_pipetype(urb->pipe)) {
         case PIPE_CONTROL:
-                ret = uhci_submit_control(uhci, urb, eurb);
+                ret = uhci_submit_control(uhci, urb, qh);
+                break;
+        case PIPE_BULK:
+                ret = uhci_submit_bulk(uhci, urb, qh);
                 break;
         case PIPE_INTERRUPT:
-                if (!eurb) {
+                if (list_empty(&qh->queue)) {
                         bustime = usb_check_bandwidth(urb->dev, urb);
                         if (bustime < 0)
                                 ret = bustime;
                         else {
-                                ret = uhci_submit_interrupt(uhci, urb, eurb);
-                                if (ret == -EINPROGRESS)
+                                ret = uhci_submit_interrupt(uhci, urb, qh);
+                                if (ret == 0)
                                         usb_claim_bandwidth(urb->dev, urb, bustime, 0);
                         }
                 } else {        /* inherit from parent */
-                        urb->bandwidth = eurb->bandwidth;
-                        ret = uhci_submit_interrupt(uhci, urb, eurb);
+                        struct urb_priv *eurbp;
+
+                        eurbp = list_entry(qh->queue.prev, struct urb_priv,
+                                        node);
+                        urb->bandwidth = eurbp->urb->bandwidth;
+                        ret = uhci_submit_interrupt(uhci, urb, qh);
                 }
                 break;
-        case PIPE_BULK:
-                ret = uhci_submit_bulk(uhci, urb, eurb);
-                break;
         case PIPE_ISOCHRONOUS:
                 bustime = usb_check_bandwidth(urb->dev, urb);
                 if (bustime < 0) {
@@ -1220,221 +1132,208 @@ static int uhci_urb_enqueue(struct usb_hcd *hcd,
                         break;
                 }
 
-                ret = uhci_submit_isochronous(uhci, urb);
-                if (ret == -EINPROGRESS)
+                ret = uhci_submit_isochronous(uhci, urb, qh);
+                if (ret == 0)
                         usb_claim_bandwidth(urb->dev, urb, bustime, 1);
                 break;
         }
+        if (ret != 0)
+                goto err_submit_failed;
+
+        /* Add this URB to the QH */
+        urbp->qh = qh;
+        list_add_tail(&urbp->node, &qh->queue);
 
-        if (ret != -EINPROGRESS) {
-                /* Submit failed, so delete it from the urb_list */
-                struct urb_priv *urbp = urb->hcpriv;
+        /* If the new URB is the first and only one on this QH then either
+         * the QH is new and idle or else it's unlinked and waiting to
+         * become idle, so we can activate it right away. */
+        if (qh->queue.next == &urbp->node)
+                uhci_activate_qh(uhci, qh);
+        goto done;
 
-                list_del_init(&urbp->urb_list);
-                uhci_destroy_urb_priv(uhci, urb);
-        } else
-                ret = 0;
+err_submit_failed:
+        if (qh->state == QH_STATE_IDLE)
+                uhci_make_qh_idle(uhci, qh);    /* Reclaim unused QH */
 
-out:
+err_no_qh:
+        uhci_free_urb_priv(uhci, urbp);
+
+done:
         spin_unlock_irqrestore(&uhci->lock, flags);
         return ret;
 }
 
-/*
- * Return the result of a transfer
- */
-static void uhci_transfer_result(struct uhci_hcd *uhci, struct urb *urb)
+static int uhci_urb_dequeue(struct usb_hcd *hcd, struct urb *urb)
 {
-        int ret = -EINPROGRESS;
+        struct uhci_hcd *uhci = hcd_to_uhci(hcd);
+        unsigned long flags;
         struct urb_priv *urbp;
 
-        spin_lock(&urb->lock);
+        spin_lock_irqsave(&uhci->lock, flags);
+        urbp = urb->hcpriv;
+        if (!urbp)                      /* URB was never linked! */
+                goto done;
+
+        /* Remove Isochronous TDs from the frame list ASAP */
+        if (usb_pipetype(urb->pipe) == PIPE_ISOCHRONOUS)
+                uhci_unlink_isochronous_tds(uhci, urb);
+        uhci_unlink_qh(uhci, urbp->qh);
+
+done:
+        spin_unlock_irqrestore(&uhci->lock, flags);
+        return 0;
+}
 
-        urbp = (struct urb_priv *)urb->hcpriv;
+/*
+ * Finish unlinking an URB and give it back
+ */
+static void uhci_giveback_urb(struct uhci_hcd *uhci, struct uhci_qh *qh,
+                struct urb *urb, struct pt_regs *regs)
+__releases(uhci->lock)
+__acquires(uhci->lock)
+{
+        struct urb_priv *urbp = (struct urb_priv *) urb->hcpriv;
 
-        if (urb->status != -EINPROGRESS)        /* URB already dequeued */
-                goto out;
+        /* Isochronous TDs get unlinked directly from the frame list */
+        if (usb_pipetype(urb->pipe) == PIPE_ISOCHRONOUS)
+                uhci_unlink_isochronous_tds(uhci, urb);
+
+        /* If the URB isn't first on its queue, adjust the link pointer
+         * of the last TD in the previous URB. */
+        else if (qh->queue.next != &urbp->node) {
+                struct urb_priv *purbp;
+                struct uhci_td *ptd, *ltd;
+
+                purbp = list_entry(urbp->node.prev, struct urb_priv, node);
+                ptd = list_entry(purbp->td_list.prev, struct uhci_td,
+                                list);
+                ltd = list_entry(urbp->td_list.prev, struct uhci_td,
+                                list);
+                ptd->link = ltd->link;
+        }
 
-        switch (usb_pipetype(urb->pipe)) {
-        case PIPE_CONTROL:
-                ret = uhci_result_control(uhci, urb);
-                break;
-        case PIPE_BULK:
-        case PIPE_INTERRUPT:
-                ret = uhci_result_common(uhci, urb);
-                break;
-        case PIPE_ISOCHRONOUS:
-                ret = uhci_result_isochronous(uhci, urb);
-                break;
+        /* Take the URB off the QH's queue.  If the queue is now empty,
+         * this is a perfect time for a toggle fixup. */
+        list_del_init(&urbp->node);
+        if (list_empty(&qh->queue) && qh->needs_fixup) {
+                usb_settoggle(urb->dev, usb_pipeendpoint(urb->pipe),
+                                usb_pipeout(urb->pipe), qh->initial_toggle);
+                qh->needs_fixup = 0;
         }
 
-        if (ret == -EINPROGRESS)
-                goto out;
-        urb->status = ret;
+        uhci_dec_fsbr(uhci, urb);       /* Safe since it checks */
+        uhci_free_urb_priv(uhci, urbp);
 
         switch (usb_pipetype(urb->pipe)) {
-        case PIPE_CONTROL:
-        case PIPE_BULK:
         case PIPE_ISOCHRONOUS:
                 /* Release bandwidth for Interrupt or Isoc. transfers */
                 if (urb->bandwidth)
                         usb_release_bandwidth(urb->dev, urb, 1);
-                uhci_unlink_generic(uhci, urb);
                 break;
         case PIPE_INTERRUPT:
                 /* Release bandwidth for Interrupt or Isoc. transfers */
                 /* Make sure we don't release if we have a queued URB */
-                if (list_empty(&urbp->queue_list) && urb->bandwidth)
+                if (list_empty(&qh->queue) && urb->bandwidth)
                         usb_release_bandwidth(urb->dev, urb, 0);
                 else
                         /* bandwidth was passed on to queued URB, */
                         /* so don't let usb_unlink_urb() release it */
                         urb->bandwidth = 0;
-                uhci_unlink_generic(uhci, urb);
                 break;
-        default:
-                dev_info(uhci_dev(uhci), "%s: unknown pipe type %d "
-                                "for urb %p\n",
-                                __FUNCTION__, usb_pipetype(urb->pipe), urb);
         }
 
-        /* Move it from uhci->urb_list to uhci->complete_list */
-        uhci_moveto_complete(uhci, urbp);
-
-out:
-        spin_unlock(&urb->lock);
-}
-
-static void uhci_unlink_generic(struct uhci_hcd *uhci, struct urb *urb)
-{
-        struct list_head *head;
-        struct uhci_td *td;
-        struct urb_priv *urbp = (struct urb_priv *)urb->hcpriv;
-        int prevactive = 0;
-
-        uhci_dec_fsbr(uhci, urb);       /* Safe since it checks */
+        spin_unlock(&uhci->lock);
+        usb_hcd_giveback_urb(uhci_to_hcd(uhci), urb, regs);
+        spin_lock(&uhci->lock);
 
-        /*
-         * Now we need to find out what the last successful toggle was
-         * so we can update the local data toggle for the next transfer
-         *
-         * There are 2 ways the last successful completed TD is found:
-         *
-         * 1) The TD is NOT active and the actual length < expected length
-         * 2) The TD is NOT active and it's the last TD in the chain
-         *
-         * and a third way the first uncompleted TD is found:
-         *
-         * 3) The TD is active and the previous TD is NOT active
-         *
-         * Control and Isochronous ignore the toggle, so this is safe
-         * for all types
-         *
-         * FIXME: The toggle fixups won't be 100% reliable until we
-         * change over to using a single queue for each endpoint and
-         * stop the queue before unlinking.
-         */
-        head = &urbp->td_list;
-        list_for_each_entry(td, head, list) {
-                unsigned int ctrlstat = td_status(td);
+        /* If the queue is now empty, we can unlink the QH and give up its
+         * reserved bandwidth. */
+        if (list_empty(&qh->queue)) {
+                uhci_unlink_qh(uhci, qh);
 
-                if (!(ctrlstat & TD_CTRL_ACTIVE) &&
-                                (uhci_actual_length(ctrlstat) <
-                                 uhci_expected_length(td_token(td)) ||
-                                td->list.next == head))
-                        usb_settoggle(urb->dev, uhci_endpoint(td_token(td)),
-                                uhci_packetout(td_token(td)),
-                                uhci_toggle(td_token(td)) ^ 1);
-                else if ((ctrlstat & TD_CTRL_ACTIVE) && !prevactive)
-                        usb_settoggle(urb->dev, uhci_endpoint(td_token(td)),
-                                uhci_packetout(td_token(td)),
-                                uhci_toggle(td_token(td)));
-
-                prevactive = ctrlstat & TD_CTRL_ACTIVE;
+                /* Bandwidth stuff not yet implemented */
         }
-
-        uhci_delete_queued_urb(uhci, urb);
-
-        /* The interrupt loop will reclaim the QHs */
-        uhci_remove_qh(uhci, urbp->qh);
-        urbp->qh = NULL;
 }
 
-static int uhci_urb_dequeue(struct usb_hcd *hcd, struct urb *urb)
+/*
+ * Scan the URBs in a QH's queue
+ */
+#define QH_FINISHED_UNLINKING(qh)                       \
+                (qh->state == QH_STATE_UNLINKING &&     \
+                uhci->frame_number + uhci->is_stopped != qh->unlink_frame)
+
+static void uhci_scan_qh(struct uhci_hcd *uhci, struct uhci_qh *qh,
+                struct pt_regs *regs)
 {
-        struct uhci_hcd *uhci = hcd_to_uhci(hcd);
-        unsigned long flags;
         struct urb_priv *urbp;
+        struct urb *urb;
+        int status;
 
-        spin_lock_irqsave(&uhci->lock, flags);
-        urbp = urb->hcpriv;
-        if (!urbp)                      /* URB was never linked! */
-                goto done;
-        list_del_init(&urbp->urb_list);
-
-        if (usb_pipetype(urb->pipe) == PIPE_ISOCHRONOUS)
-                unlink_isochronous_tds(uhci, urb);
-        uhci_unlink_generic(uhci, urb);
-
-        uhci_get_current_frame_number(uhci);
-        if (uhci->frame_number + uhci->is_stopped != uhci->urb_remove_age) {
-                uhci_remove_pending_urbps(uhci);
-                uhci->urb_remove_age = uhci->frame_number;
-        }
-
-        /* If we're the first, set the next interrupt bit */
-        if (list_empty(&uhci->urb_remove_list))
-                uhci_set_next_interrupt(uhci);
-        list_add_tail(&urbp->urb_list, &uhci->urb_remove_list);
-
-done:
-        spin_unlock_irqrestore(&uhci->lock, flags);
-        return 0;
-}
+        while (!list_empty(&qh->queue)) {
+                urbp = list_entry(qh->queue.next, struct urb_priv, node);
+                urb = urbp->urb;
 
-static int uhci_fsbr_timeout(struct uhci_hcd *uhci, struct urb *urb)
-{
-        struct urb_priv *urbp = (struct urb_priv *)urb->hcpriv;
-        struct list_head *head;
-        struct uhci_td *td;
-        int count = 0;
-
-        uhci_dec_fsbr(uhci, urb);
+                switch (usb_pipetype(urb->pipe)) {
+                case PIPE_CONTROL:
+                        status = uhci_result_control(uhci, urb);
+                        break;
+                case PIPE_ISOCHRONOUS:
+                        status = uhci_result_isochronous(uhci, urb);
+                        break;
+                default:        /* PIPE_BULK or PIPE_INTERRUPT */
+                        status = uhci_result_common(uhci, urb);
+                        break;
+                }
+                if (status == -EINPROGRESS)
+                        break;
 
-        urbp->fsbr_timeout = 1;
+                spin_lock(&urb->lock);
+                if (urb->status == -EINPROGRESS)        /* Not dequeued */
+                        urb->status = status;
+                else
+                        status = -ECONNRESET;
+                spin_unlock(&urb->lock);
 
-        /*
-         * Ideally we would want to fix qh->element as well, but it's
-         * read/write by the HC, so that can introduce a race. It's not
-         * really worth the hassle
-         */
+                /* Dequeued but completed URBs can't be given back unless
+                 * the QH is stopped or has finished unlinking. */
+                if (status == -ECONNRESET &&
+                                !(qh->is_stopped || QH_FINISHED_UNLINKING(qh)))
+                        return;
 
-        head = &urbp->td_list;
-        list_for_each_entry(td, head, list) {
-                /*
-                 * Make sure we don't do the last one (since it'll have the
-                 * TERM bit set) as well as we skip every so many TDs to
-                 * make sure it doesn't hog the bandwidth
-                 */
-                if (td->list.next != head && (count % DEPTH_INTERVAL) ==
-                                (DEPTH_INTERVAL - 1))
-                        td->link |= UHCI_PTR_DEPTH;
-
-                count++;
+                uhci_giveback_urb(uhci, qh, urb, regs);
+                if (qh->is_stopped)
+                        break;
         }
 
-        return 0;
-}
-
-static void uhci_free_pending_qhs(struct uhci_hcd *uhci)
-{
-        struct uhci_qh *qh, *tmp;
-
-        list_for_each_entry_safe(qh, tmp, &uhci->qh_remove_list, remove_list) {
-                list_del_init(&qh->remove_list);
+        /* If the QH is neither stopped nor finished unlinking (normal case),
+         * our work here is done. */
+ restart:
+        if (!(qh->is_stopped || QH_FINISHED_UNLINKING(qh)))
+                return;
 
-                uhci_free_qh(uhci, qh);
+        /* Otherwise give back each of the dequeued URBs */
+        list_for_each_entry(urbp, &qh->queue, node) {
+                urb = urbp->urb;
+                if (urb->status != -EINPROGRESS) {
+                        uhci_save_toggle(qh, urb);
+                        uhci_giveback_urb(uhci, qh, urb, regs);
+                        goto restart;
+                }
+        }
+        qh->is_stopped = 0;
+
+        /* There are no more dequeued URBs.  If there are still URBs on the
+         * queue, the QH can now be re-activated. */
+        if (!list_empty(&qh->queue)) {
+                if (qh->needs_fixup)
+                        uhci_fixup_toggles(qh, 0);
+                uhci_activate_qh(uhci, qh);
         }
+
+        /* The queue is empty.  The QH can become idle if it is fully
+         * unlinked. */
+        else if (QH_FINISHED_UNLINKING(qh))
+                uhci_make_qh_idle(uhci, qh);
 }
 
 static void uhci_free_pending_tds(struct uhci_hcd *uhci)
@@ -1448,43 +1347,13 @@ static void uhci_free_pending_tds(struct uhci_hcd *uhci)
         }
 }
 
-static void
-uhci_finish_urb(struct usb_hcd *hcd, struct urb *urb, struct pt_regs *regs)
-__releases(uhci->lock)
-__acquires(uhci->lock)
-{
-        struct uhci_hcd *uhci = hcd_to_uhci(hcd);
-
-        uhci_destroy_urb_priv(uhci, urb);
-
-        spin_unlock(&uhci->lock);
-        usb_hcd_giveback_urb(hcd, urb, regs);
-        spin_lock(&uhci->lock);
-}
-
-static void uhci_finish_completion(struct uhci_hcd *uhci, struct pt_regs *regs)
-{
-        struct urb_priv *urbp, *tmp;
-
-        list_for_each_entry_safe(urbp, tmp, &uhci->complete_list, urb_list) {
-                struct urb *urb = urbp->urb;
-
-                list_del_init(&urbp->urb_list);
-                uhci_finish_urb(uhci_to_hcd(uhci), urb, regs);
-        }
-}
-
-static void uhci_remove_pending_urbps(struct uhci_hcd *uhci)
-{
-
-        /* Splice the urb_remove_list onto the end of the complete_list */
-        list_splice_init(&uhci->urb_remove_list, uhci->complete_list.prev);
-}
-
-/* Process events in the schedule, but only in one thread at a time */
+/*
+ * Process events in the schedule, but only in one thread at a time
+ */
 static void uhci_scan_schedule(struct uhci_hcd *uhci, struct pt_regs *regs)
 {
-        struct urb_priv *urbp, *tmp;
+        int i;
+        struct uhci_qh *qh;
 
         /* Don't allow re-entrant calls */
         if (uhci->scan_in_progress) {
@@ -1498,60 +1367,39 @@ static void uhci_scan_schedule(struct uhci_hcd *uhci, struct pt_regs *regs)
         uhci_clear_next_interrupt(uhci);
         uhci_get_current_frame_number(uhci);
 
-        if (uhci->frame_number + uhci->is_stopped != uhci->qh_remove_age)
-                uhci_free_pending_qhs(uhci);
         if (uhci->frame_number + uhci->is_stopped != uhci->td_remove_age)
                 uhci_free_pending_tds(uhci);
-        if (uhci->frame_number + uhci->is_stopped != uhci->urb_remove_age)
-                uhci_remove_pending_urbps(uhci);
-
-        /* Walk the list of pending URBs to see which ones completed
-         * (must be _safe because uhci_transfer_result() dequeues URBs) */
-        list_for_each_entry_safe(urbp, tmp, &uhci->urb_list, urb_list) {
-                struct urb *urb = urbp->urb;
 
-                /* Checks the status and does all of the magic necessary */
-                uhci_transfer_result(uhci, urb);
-        }
-        uhci_finish_completion(uhci, regs);
-
-        /* If the controller is stopped, we can finish these off right now */
-        if (uhci->is_stopped) {
-                uhci_free_pending_qhs(uhci);
-                uhci_free_pending_tds(uhci);
-                uhci_remove_pending_urbps(uhci);
+        /* Go through all the QH queues and process the URBs in each one */
+        for (i = 0; i < UHCI_NUM_SKELQH - 1; ++i) {
+                uhci->next_qh = list_entry(uhci->skelqh[i]->node.next,
+                                struct uhci_qh, node);
+                while ((qh = uhci->next_qh) != uhci->skelqh[i]) {
+                        uhci->next_qh = list_entry(qh->node.next,
+                                        struct uhci_qh, node);
+                        uhci_scan_qh(uhci, qh, regs);
+                }
         }
 
         if (uhci->need_rescan)
                 goto rescan;
         uhci->scan_in_progress = 0;
 
-        if (list_empty(&uhci->urb_remove_list) &&
-            list_empty(&uhci->td_remove_list) &&
-            list_empty(&uhci->qh_remove_list))
+        /* If the controller is stopped, we can finish these off right now */
+        if (uhci->is_stopped)
+                uhci_free_pending_tds(uhci);
+
+        if (list_empty(&uhci->td_remove_list) &&
+                        list_empty(&uhci->skel_unlink_qh->node))
                 uhci_clear_next_interrupt(uhci);
         else
                 uhci_set_next_interrupt(uhci);
-
-        /* Wake up anyone waiting for an URB to complete */
-        wake_up_all(&uhci->waitqh);
 }
 
 static void check_fsbr(struct uhci_hcd *uhci)
 {
-        struct urb_priv *up;
-
-        list_for_each_entry(up, &uhci->urb_list, urb_list) {
-                struct urb *u = up->urb;
-
-                spin_lock(&u->lock);
-
-                /* Check if the FSBR timed out */
-                if (up->fsbr && !up->fsbr_timeout && time_after_eq(jiffies, up->fsbrtime + IDLE_TIMEOUT))
-                        uhci_fsbr_timeout(uhci, u);
-
-                spin_unlock(&u->lock);
-        }
+        /* For now, don't scan URBs for FSBR timeouts.
+         * Add it back in later... */
 
         /* Really disable FSBR */
         if (!uhci->fsbr && uhci->fsbrtimeout && time_after_eq(jiffies, uhci->fsbrtimeout)) {