113 files changed, 3799 insertions, 2062 deletions

diff --git a/drivers/usb/Makefile b/drivers/usb/Makefile
index 9b7d9769fdcc..c7123bf71c58 100644
--- a/drivers/usb/Makefile
+++ b/drivers/usb/Makefile
@@ -48,6 +48,7 @@ obj-$(CONFIG_USB_MICROTEK)	+= image/
 obj-$(CONFIG_USB_SERIAL)        += serial/
 
 obj-$(CONFIG_USB_AUERSWALD)     += misc/
+obj-$(CONFIG_USB_CY7C63)        += misc/
 obj-$(CONFIG_USB_CYTHERM)       += misc/
 obj-$(CONFIG_USB_EMI26)         += misc/
 obj-$(CONFIG_USB_EMI62)         += misc/
@@ -61,6 +62,7 @@ obj-$(CONFIG_USB_TEST)		+= misc/
 obj-$(CONFIG_USB_USS720)        += misc/
 obj-$(CONFIG_USB_PHIDGETSERVO)  += misc/
 obj-$(CONFIG_USB_SISUSBVGA)     += misc/
+obj-$(CONFIG_USB_APPLEDISPLAY)  += misc/
 
 obj-$(CONFIG_USB_ATM)           += atm/
 obj-$(CONFIG_USB_SPEEDTOUCH)    += atm/
diff --git a/drivers/usb/atm/usbatm.c b/drivers/usb/atm/usbatm.c
index 546249843b8e..a38701c742c3 100644
--- a/drivers/usb/atm/usbatm.c
+++ b/drivers/usb/atm/usbatm.c
@@ -1039,7 +1039,7 @@ static void usbatm_tasklet_schedule(unsigned long data)
         tasklet_schedule((struct tasklet_struct *) data);
 }
 
-static inline void usbatm_init_channel(struct usbatm_channel *channel)
+static void usbatm_init_channel(struct usbatm_channel *channel)
 {
         spin_lock_init(&channel->lock);
         INIT_LIST_HEAD(&channel->list);
diff --git a/drivers/usb/atm/xusbatm.c b/drivers/usb/atm/xusbatm.c
index 42d6823b82b3..70125c6d3be4 100644
--- a/drivers/usb/atm/xusbatm.c
+++ b/drivers/usb/atm/xusbatm.c
@@ -20,7 +20,6 @@
  ******************************************************************************/
 
 #include <linux/module.h>
-#include <linux/netdevice.h>            /* FIXME: required by linux/etherdevice.h */
 #include <linux/etherdevice.h>          /* for random_ether_addr() */
 
 #include "usbatm.h"
diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index 6dd339f4c0fc..d41dc67ba4cc 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -63,7 +63,7 @@
 #include <linux/mutex.h>
 #include <asm/uaccess.h>
 #include <linux/usb.h>
-#include <linux/usb_cdc.h>
+#include <linux/usb/cdc.h>
 #include <asm/byteorder.h>
 #include <asm/unaligned.h>
 #include <linux/list.h>
@@ -127,8 +127,8 @@ static int acm_wb_alloc(struct acm *acm)
                         wb->use = 1;
                         return wbn;
                 }
-                wbn = (wbn + 1) % ACM_NWB;
-                if (++i >= ACM_NWB)
+                wbn = (wbn + 1) % ACM_NW;
+                if (++i >= ACM_NW)
                         return -1;
         }
 }
@@ -142,10 +142,9 @@ static int acm_wb_is_avail(struct acm *acm)
 {
         int i, n;
 
-        n = 0;
-        for (i = 0; i < ACM_NWB; i++) {
-                if (!acm->wb[i].use)
-                        n++;
+        n = ACM_NW;
+        for (i = 0; i < ACM_NW; i++) {
+                n -= acm->wb[i].use;
         }
         return n;
 }
@@ -167,7 +166,7 @@ static void acm_write_done(struct acm *acm)
         acm->write_ready = 1;
         wbn = acm->write_current;
         acm_wb_free(acm, wbn);
-        acm->write_current = (wbn + 1) % ACM_NWB;
+        acm->write_current = (wbn + 1) % ACM_NW;
         spin_unlock_irqrestore(&acm->write_lock, flags);
 }
 
@@ -291,22 +290,32 @@ static void acm_read_bulk(struct urb *urb, struct pt_regs *regs)
         struct acm_rb *buf;
         struct acm_ru *rcv = urb->context;
         struct acm *acm = rcv->instance;
+        int status = urb->status;
         dbg("Entering acm_read_bulk with status %d\n", urb->status);
 
         if (!ACM_READY(acm))
                 return;
 
-        if (urb->status)
-                dev_dbg(&acm->data->dev, "bulk rx status %d\n", urb->status);
+        if (status)
+                dev_dbg(&acm->data->dev, "bulk rx status %d\n", status);
 
         buf = rcv->buffer;
         buf->size = urb->actual_length;
 
-        spin_lock(&acm->read_lock);
-        list_add_tail(&rcv->list, &acm->spare_read_urbs);
-        list_add_tail(&buf->list, &acm->filled_read_bufs);
-        spin_unlock(&acm->read_lock);
-
+        if (likely(status == 0)) {
+                spin_lock(&acm->read_lock);
+                list_add_tail(&rcv->list, &acm->spare_read_urbs);
+                list_add_tail(&buf->list, &acm->filled_read_bufs);
+                spin_unlock(&acm->read_lock);
+        } else {
+                /* we drop the buffer due to an error */
+                spin_lock(&acm->read_lock);
+                list_add_tail(&rcv->list, &acm->spare_read_urbs);
+                list_add(&buf->list, &acm->spare_read_bufs);
+                spin_unlock(&acm->read_lock);
+                /* nevertheless the tasklet must be kicked unconditionally
+                so the queue cannot dry up */
+        }
         tasklet_schedule(&acm->urb_task);
 }
 
@@ -464,10 +473,10 @@ static int acm_tty_open(struct tty_struct *tty, struct file *filp)
         INIT_LIST_HEAD(&acm->spare_read_urbs);
         INIT_LIST_HEAD(&acm->spare_read_bufs);
         INIT_LIST_HEAD(&acm->filled_read_bufs);
-        for (i = 0; i < ACM_NRU; i++) {
+        for (i = 0; i < acm->rx_buflimit; i++) {
                 list_add(&(acm->ru[i].list), &acm->spare_read_urbs);
         }
-        for (i = 0; i < ACM_NRB; i++) {
+        for (i = 0; i < acm->rx_buflimit; i++) {
                 list_add(&(acm->rb[i].list), &acm->spare_read_bufs);
         }
 
@@ -488,14 +497,15 @@ bail_out:
 
 static void acm_tty_unregister(struct acm *acm)
 {
-        int i;
+        int i,nr;
 
+        nr = acm->rx_buflimit;
         tty_unregister_device(acm_tty_driver, acm->minor);
         usb_put_intf(acm->control);
         acm_table[acm->minor] = NULL;
         usb_free_urb(acm->ctrlurb);
         usb_free_urb(acm->writeurb);
-        for (i = 0; i < ACM_NRU; i++)
+        for (i = 0; i < nr; i++)
                 usb_free_urb(acm->ru[i].urb);
         kfree(acm);
 }
@@ -503,18 +513,19 @@ static void acm_tty_unregister(struct acm *acm)
 static void acm_tty_close(struct tty_struct *tty, struct file *filp)
 {
         struct acm *acm = tty->driver_data;
-        int i;
+        int i,nr;
 
         if (!acm || !acm->used)
                 return;
 
+        nr = acm->rx_buflimit;
         mutex_lock(&open_mutex);
         if (!--acm->used) {
                 if (acm->dev) {
                         acm_set_control(acm, acm->ctrlout = 0);
                         usb_kill_urb(acm->ctrlurb);
                         usb_kill_urb(acm->writeurb);
-                        for (i = 0; i < ACM_NRU; i++)
+                        for (i = 0; i < nr; i++)
                                 usb_kill_urb(acm->ru[i].urb);
                 } else
                         acm_tty_unregister(acm);
@@ -576,7 +587,7 @@ static int acm_tty_chars_in_buffer(struct tty_struct *tty)
         /*
          * This is inaccurate (overcounts), but it works.
          */
-        return (ACM_NWB - acm_wb_is_avail(acm)) * acm->writesize;
+        return (ACM_NW - acm_wb_is_avail(acm)) * acm->writesize;
 }
 
 static void acm_tty_throttle(struct tty_struct *tty)
@@ -712,7 +723,7 @@ static void acm_write_buffers_free(struct acm *acm)
         int i;
         struct acm_wb *wb;
 
-        for (wb = &acm->wb[0], i = 0; i < ACM_NWB; i++, wb++) {
+        for (wb = &acm->wb[0], i = 0; i < ACM_NW; i++, wb++) {
                 usb_buffer_free(acm->dev, acm->writesize, wb->buf, wb->dmah);
         }
 }
@@ -723,7 +734,7 @@ static int acm_write_buffers_alloc(struct acm *acm)
         int i;
         struct acm_wb *wb;
 
-        for (wb = &acm->wb[0], i = 0; i < ACM_NWB; i++, wb++) {
+        for (wb = &acm->wb[0], i = 0; i < ACM_NW; i++, wb++) {
                 wb->buf = usb_buffer_alloc(acm->dev, acm->writesize, GFP_KERNEL,
                     &wb->dmah);
                 if (!wb->buf) {
@@ -760,10 +771,14 @@ static int acm_probe (struct usb_interface *intf,
         int call_interface_num = -1;
         int data_interface_num;
         unsigned long quirks;
+        int num_rx_buf;
         int i;
 
-        /* handle quirks deadly to normal probing*/
+        /* normal quirks */
         quirks = (unsigned long)id->driver_info;
+        num_rx_buf = (quirks == SINGLE_RX_URB) ? 1 : ACM_NR;
+
+        /* handle quirks deadly to normal probing*/
         if (quirks == NO_UNION_NORMAL) {
                 data_interface = usb_ifnum_to_if(usb_dev, 1);
                 control_interface = usb_ifnum_to_if(usb_dev, 0);
@@ -900,7 +915,7 @@ skip_normal_probe:
         }
 
         ctrlsize = le16_to_cpu(epctrl->wMaxPacketSize);
-        readsize = le16_to_cpu(epread->wMaxPacketSize)*2;
+        readsize = le16_to_cpu(epread->wMaxPacketSize)* ( quirks == SINGLE_RX_URB ? 1 : 2);
         acm->writesize = le16_to_cpu(epwrite->wMaxPacketSize);
         acm->control = control_interface;
         acm->data = data_interface;
@@ -909,6 +924,7 @@ skip_normal_probe:
         acm->ctrl_caps = ac_management_function;
         acm->ctrlsize = ctrlsize;
         acm->readsize = readsize;
+        acm->rx_buflimit = num_rx_buf;
         acm->urb_task.func = acm_rx_tasklet;
         acm->urb_task.data = (unsigned long) acm;
         INIT_WORK(&acm->work, acm_softint, acm);
@@ -935,7 +951,7 @@ skip_normal_probe:
                 dev_dbg(&intf->dev, "out of memory (ctrlurb kmalloc)\n");
                 goto alloc_fail5;
         }
-        for (i = 0; i < ACM_NRU; i++) {
+        for (i = 0; i < num_rx_buf; i++) {
                 struct acm_ru *rcv = &(acm->ru[i]);
 
                 if (!(rcv->urb = usb_alloc_urb(0, GFP_KERNEL))) {
@@ -946,10 +962,9 @@ skip_normal_probe:
                 rcv->urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
                 rcv->instance = acm;
         }
-        for (i = 0; i < ACM_NRB; i++) {
+        for (i = 0; i < num_rx_buf; i++) {
                 struct acm_rb *buf = &(acm->rb[i]);
 
-                // Using usb_buffer_alloc instead of kmalloc as Oliver suggested
                 if (!(buf->base = usb_buffer_alloc(acm->dev, readsize, GFP_KERNEL, &buf->dma))) {
                         dev_dbg(&intf->dev, "out of memory (read bufs usb_buffer_alloc)\n");
                         goto alloc_fail7;
@@ -988,9 +1003,9 @@ skip_normal_probe:
         return 0;
 
 alloc_fail7:
-        for (i = 0; i < ACM_NRB; i++)
+        for (i = 0; i < num_rx_buf; i++)
                 usb_buffer_free(usb_dev, acm->readsize, acm->rb[i].base, acm->rb[i].dma);
-        for (i = 0; i < ACM_NRU; i++)
+        for (i = 0; i < num_rx_buf; i++)
                 usb_free_urb(acm->ru[i].urb);
         usb_free_urb(acm->ctrlurb);
 alloc_fail5:
@@ -1027,7 +1042,7 @@ static void acm_disconnect(struct usb_interface *intf)
 
         usb_kill_urb(acm->ctrlurb);
         usb_kill_urb(acm->writeurb);
-        for (i = 0; i < ACM_NRU; i++)
+        for (i = 0; i < acm->rx_buflimit; i++)
                 usb_kill_urb(acm->ru[i].urb);
 
         INIT_LIST_HEAD(&acm->filled_read_bufs);
@@ -1039,7 +1054,7 @@ static void acm_disconnect(struct usb_interface *intf)
 
         acm_write_buffers_free(acm);
         usb_buffer_free(usb_dev, acm->ctrlsize, acm->ctrl_buffer, acm->ctrl_dma);
-        for (i = 0; i < ACM_NRB; i++)
+        for (i = 0; i < acm->rx_buflimit; i++)
                 usb_buffer_free(usb_dev, acm->readsize, acm->rb[i].base, acm->rb[i].dma);
 
         usb_driver_release_interface(&acm_driver, intf == acm->control ? acm->data : intf);
@@ -1068,6 +1083,9 @@ static struct usb_device_id acm_ids[] = {
         { USB_DEVICE(0x0482, 0x0203), /* KYOCERA AH-K3001V */
         .driver_info = NO_UNION_NORMAL, /* has no union descriptor */
         },
+        { USB_DEVICE(0x0ace, 0x1608), /* ZyDAS 56K USB MODEM */
+        .driver_info = SINGLE_RX_URB, /* firmware bug */
+        },
         /* control interfaces with various AT-command sets */
         { USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_ACM,
                 USB_CDC_ACM_PROTO_AT_V25TER) },
diff --git a/drivers/usb/class/cdc-acm.h b/drivers/usb/class/cdc-acm.h
index fd2aaccdcbac..1bcaea32cfc1 100644
--- a/drivers/usb/class/cdc-acm.h
+++ b/drivers/usb/class/cdc-acm.h
@@ -56,11 +56,11 @@
  * in line disciplines. They ask for empty space amount, receive our URB size,
  * and proceed to issue several 1-character writes, assuming they will fit.
  * The very first write takes a complete URB. Fortunately, this only happens
- * when processing onlcr, so we only need 2 buffers.
+ * when processing onlcr, so we only need 2 buffers. These values must be
+ * powers of 2.
  */
-#define ACM_NWB  2
-#define ACM_NRU  16
-#define ACM_NRB  16
+#define ACM_NW  2
+#define ACM_NR  16
 
 struct acm_wb {
         unsigned char *buf;
@@ -91,9 +91,10 @@ struct acm {
         struct urb *ctrlurb, *writeurb;                 /* urbs */
         u8 *ctrl_buffer;                                /* buffers of urbs */
         dma_addr_t ctrl_dma;                            /* dma handles of buffers */
-        struct acm_wb wb[ACM_NWB];
-        struct acm_ru ru[ACM_NRU];
-        struct acm_rb rb[ACM_NRB];
+        struct acm_wb wb[ACM_NW];
+        struct acm_ru ru[ACM_NR];
+        struct acm_rb rb[ACM_NR];
+        int rx_buflimit;
         int rx_endpoint;
         spinlock_t read_lock;
         struct list_head spare_read_urbs;
@@ -122,3 +123,4 @@ struct acm {
 
 /* constants describing various quirks and errors */
 #define NO_UNION_NORMAL                 1
+#define SINGLE_RX_URB                   2
diff --git a/drivers/usb/core/Makefile b/drivers/usb/core/Makefile
index 28329ddf187c..ec510922af63 100644
--- a/drivers/usb/core/Makefile
+++ b/drivers/usb/core/Makefile
@@ -3,7 +3,8 @@
 #
 
 usbcore-objs    := usb.o hub.o hcd.o urb.o message.o driver.o \
-                        config.o file.o buffer.o sysfs.o devio.o notify.o
+                        config.o file.o buffer.o sysfs.o endpoint.o \
+                        devio.o notify.o
 
 ifeq ($(CONFIG_PCI),y)
         usbcore-objs    += hcd-pci.o
diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
index 545da37afca7..3f8e06279c92 100644
--- a/drivers/usb/core/devio.c
+++ b/drivers/usb/core/devio.c
@@ -515,19 +515,19 @@ static int check_ctrlrecip(struct dev_state *ps, unsigned int requesttype, unsig
 
 static struct usb_device *usbdev_lookup_minor(int minor)
 {
-        struct class_device *class_dev;
-        struct usb_device *dev = NULL;
+        struct device *device;
+        struct usb_device *udev = NULL;
 
         down(&usb_device_class->sem);
-        list_for_each_entry(class_dev, &usb_device_class->children, node) {
-                if (class_dev->devt == MKDEV(USB_DEVICE_MAJOR, minor)) {
-                        dev = class_dev->class_data;
+        list_for_each_entry(device, &usb_device_class->devices, node) {
+                if (device->devt == MKDEV(USB_DEVICE_MAJOR, minor)) {
+                        udev = device->platform_data;
                         break;
                 }
         }
         up(&usb_device_class->sem);
 
-        return dev;
+        return udev;
 };
 
 /*
@@ -823,8 +823,7 @@ static int proc_connectinfo(struct dev_state *ps, void __user *arg)
 
 static int proc_resetdevice(struct dev_state *ps)
 {
-        return usb_reset_device(ps->dev);
-
+        return usb_reset_composite_device(ps->dev, NULL);
 }
 
 static int proc_setintf(struct dev_state *ps, void __user *arg)
@@ -923,8 +922,8 @@ static int proc_do_submiturb(struct dev_state *ps, struct usbdevfs_urb *uurb,
                 if ((ep->desc.bmAttributes & USB_ENDPOINT_XFERTYPE_MASK)
                                 != USB_ENDPOINT_XFER_CONTROL)
                         return -EINVAL;
-                /* min 8 byte setup packet, max arbitrary */
-                if (uurb->buffer_length < 8 || uurb->buffer_length > PAGE_SIZE)
+                /* min 8 byte setup packet, max 8 byte setup plus an arbitrary data stage */
+                if (uurb->buffer_length < 8 || uurb->buffer_length > (8 + MAX_USBFS_BUFFER_SIZE))
                         return -EINVAL;
                 if (!(dr = kmalloc(sizeof(struct usb_ctrlrequest), GFP_KERNEL)))
                         return -ENOMEM;
@@ -982,7 +981,8 @@ static int proc_do_submiturb(struct dev_state *ps, struct usbdevfs_urb *uurb,
                         return -EFAULT;
                 }
                 for (totlen = u = 0; u < uurb->number_of_packets; u++) {
-                        if (isopkt[u].length > 1023) {
+                        /* arbitrary limit, sufficient for USB 2.0 high-bandwidth iso */
+                        if (isopkt[u].length > 8192) {
                                 kfree(isopkt);
                                 return -EINVAL;
                         }
@@ -1078,7 +1078,9 @@ static int proc_submiturb(struct dev_state *ps, void __user *arg)
         if (copy_from_user(&uurb, arg, sizeof(uurb)))
                 return -EFAULT;
 
-        return proc_do_submiturb(ps, &uurb, (((struct usbdevfs_urb __user *)arg)->iso_frame_desc), arg);
+        return proc_do_submiturb(ps, &uurb,
+                (struct usbdevfs_iso_packet_desc __user *)uurb.iso_frame_desc,
+                arg);
 }
 
 static int proc_unlinkurb(struct dev_state *ps, void __user *arg)
@@ -1203,7 +1205,9 @@ static int proc_submiturb_compat(struct dev_state *ps, void __user *arg)
         if (get_urb32(&uurb,(struct usbdevfs_urb32 *)arg))
                 return -EFAULT;
 
-        return proc_do_submiturb(ps, &uurb, ((struct usbdevfs_urb32 __user *)arg)->iso_frame_desc, arg);
+        return proc_do_submiturb(ps, &uurb,
+                (struct usbdevfs_iso_packet_desc __user *)uurb.iso_frame_desc,
+                arg);
 }
 
 static int processcompl_compat(struct async *as, void __user * __user *arg)
@@ -1576,16 +1580,16 @@ static void usbdev_add(struct usb_device *dev)
 {
         int minor = ((dev->bus->busnum-1) * 128) + (dev->devnum-1);
 
-        dev->class_dev = class_device_create(usb_device_class, NULL,
-                                MKDEV(USB_DEVICE_MAJOR, minor), &dev->dev,
+        dev->usbfs_dev = device_create(usb_device_class, &dev->dev,
+                                MKDEV(USB_DEVICE_MAJOR, minor),
                                 "usbdev%d.%d", dev->bus->busnum, dev->devnum);
 
-        dev->class_dev->class_data = dev;
+        dev->usbfs_dev->platform_data = dev;
 }
 
 static void usbdev_remove(struct usb_device *dev)
 {
-        class_device_unregister(dev->class_dev);
+        device_unregister(dev->usbfs_dev);
 }
 
 static int usbdev_notify(struct notifier_block *self, unsigned long action,
diff --git a/drivers/usb/core/endpoint.c b/drivers/usb/core/endpoint.c
new file mode 100644
index 000000000000..247b5a4913a8
--- /dev/null
+++ b/drivers/usb/core/endpoint.c
@@ -0,0 +1,275 @@
+/*
+ * drivers/usb/core/endpoint.c
+ *
+ * (C) Copyright 2002,2004,2006 Greg Kroah-Hartman
+ * (C) Copyright 2002,2004 IBM Corp.
+ * (C) Copyright 2006 Novell Inc.
+ *
+ * Endpoint sysfs stuff
+ *
+ */
+
+#include <linux/kernel.h>
+#include <linux/usb.h>
+#include "usb.h"
+
+/* endpoint stuff */
+
+struct ep_device {
+        struct usb_endpoint_descriptor *desc;
+        struct usb_device *udev;
+        struct device dev;
+};
+#define to_ep_device(_dev) \
+        container_of(_dev, struct ep_device, dev)
+
+struct ep_attribute {
+        struct attribute attr;
+        ssize_t (*show)(struct usb_device *,
+                        struct usb_endpoint_descriptor *, char *);
+};
+#define to_ep_attribute(_attr) \
+        container_of(_attr, struct ep_attribute, attr)
+
+#define usb_ep_attr(field, format_string)                       \
+static ssize_t show_ep_##field(struct device *dev,              \
+                               struct device_attribute *attr,   \
+                               char *buf)                       \
+{                                                               \
+        struct ep_device *ep = to_ep_device(dev);               \
+        return sprintf(buf, format_string, ep->desc->field);    \
+}                                                               \
+static DEVICE_ATTR(field, S_IRUGO, show_ep_##field, NULL);
+
+usb_ep_attr(bLength, "%02x\n")
+usb_ep_attr(bEndpointAddress, "%02x\n")
+usb_ep_attr(bmAttributes, "%02x\n")
+usb_ep_attr(bInterval, "%02x\n")
+
+static ssize_t show_ep_wMaxPacketSize(struct device *dev,
+                                      struct device_attribute *attr, char *buf)
+{
+        struct ep_device *ep = to_ep_device(dev);
+        return sprintf(buf, "%04x\n",
+                        le16_to_cpu(ep->desc->wMaxPacketSize) & 0x07ff);
+}
+static DEVICE_ATTR(wMaxPacketSize, S_IRUGO, show_ep_wMaxPacketSize, NULL);
+
+static ssize_t show_ep_type(struct device *dev, struct device_attribute *attr,
+                            char *buf)
+{
+        struct ep_device *ep = to_ep_device(dev);
+        char *type = "unknown";
+
+        switch (ep->desc->bmAttributes & USB_ENDPOINT_XFERTYPE_MASK) {
+        case USB_ENDPOINT_XFER_CONTROL:
+                type = "Control";
+                break;
+        case USB_ENDPOINT_XFER_ISOC:
+                type = "Isoc";
+                break;
+        case USB_ENDPOINT_XFER_BULK:
+                type = "Bulk";
+                break;
+        case USB_ENDPOINT_XFER_INT:
+                type = "Interrupt";
+                break;
+        }
+        return sprintf(buf, "%s\n", type);
+}
+static DEVICE_ATTR(type, S_IRUGO, show_ep_type, NULL);
+
+static ssize_t show_ep_interval(struct device *dev,
+                                struct device_attribute *attr, char *buf)
+{
+        struct ep_device *ep = to_ep_device(dev);
+        char unit;
+        unsigned interval = 0;
+        unsigned in;
+
+        in = (ep->desc->bEndpointAddress & USB_DIR_IN);
+
+        switch (ep->desc->bmAttributes & USB_ENDPOINT_XFERTYPE_MASK) {
+        case USB_ENDPOINT_XFER_CONTROL:
+                if (ep->udev->speed == USB_SPEED_HIGH)  /* uframes per NAK */
+                        interval = ep->desc->bInterval;
+                break;
+        case USB_ENDPOINT_XFER_ISOC:
+                interval = 1 << (ep->desc->bInterval - 1);
+                break;
+        case USB_ENDPOINT_XFER_BULK:
+                if (ep->udev->speed == USB_SPEED_HIGH && !in) /* uframes per NAK */
+                        interval = ep->desc->bInterval;
+                break;
+        case USB_ENDPOINT_XFER_INT:
+                if (ep->udev->speed == USB_SPEED_HIGH)
+                        interval = 1 << (ep->desc->bInterval - 1);
+                else
+                        interval = ep->desc->bInterval;
+                break;
+        }
+        interval *= (ep->udev->speed == USB_SPEED_HIGH) ? 125 : 1000;
+        if (interval % 1000)
+                unit = 'u';
+        else {
+                unit = 'm';
+                interval /= 1000;
+        }
+
+        return sprintf(buf, "%d%cs\n", interval, unit);
+}
+static DEVICE_ATTR(interval, S_IRUGO, show_ep_interval, NULL);
+
+static ssize_t show_ep_direction(struct device *dev,
+                                 struct device_attribute *attr, char *buf)
+{
+        struct ep_device *ep = to_ep_device(dev);
+        char *direction;
+
+        if ((ep->desc->bmAttributes & USB_ENDPOINT_XFERTYPE_MASK) ==
+                        USB_ENDPOINT_XFER_CONTROL)
+                direction = "both";
+        else if (ep->desc->bEndpointAddress & USB_DIR_IN)
+                direction = "in";
+        else
+                direction = "out";
+        return sprintf(buf, "%s\n", direction);
+}
+static DEVICE_ATTR(direction, S_IRUGO, show_ep_direction, NULL);
+
+static struct attribute *ep_dev_attrs[] = {
+        &dev_attr_bLength.attr,
+        &dev_attr_bEndpointAddress.attr,
+        &dev_attr_bmAttributes.attr,
+        &dev_attr_bInterval.attr,
+        &dev_attr_wMaxPacketSize.attr,
+        &dev_attr_interval.attr,
+        &dev_attr_type.attr,
+        &dev_attr_direction.attr,
+        NULL,
+};
+static struct attribute_group ep_dev_attr_grp = {
+        .attrs = ep_dev_attrs,
+};
+
+static struct endpoint_class {
+        struct kref kref;
+        struct class *class;
+} *ep_class;
+
+static int init_endpoint_class(void)
+{
+        int result = 0;
+
+        if (ep_class != NULL) {
+                kref_get(&ep_class->kref);
+                goto exit;
+        }
+
+        ep_class = kmalloc(sizeof(*ep_class), GFP_KERNEL);
+        if (!ep_class) {
+                result = -ENOMEM;
+                goto exit;
+        }
+
+        kref_init(&ep_class->kref);
+        ep_class->class = class_create(THIS_MODULE, "usb_endpoint");
+        if (IS_ERR(ep_class->class)) {
+                result = IS_ERR(ep_class->class);
+                kfree(ep_class);
+                ep_class = NULL;
+                goto exit;
+        }
+
+exit:
+        return result;
+}
+
+static void release_endpoint_class(struct kref *kref)
+{
+        /* Ok, we cheat as we know we only have one ep_class */
+        class_destroy(ep_class->class);
+        kfree(ep_class);
+        ep_class = NULL;
+}
+
+static void destroy_endpoint_class(void)
+{
+        if (ep_class)
+                kref_put(&ep_class->kref, release_endpoint_class);
+}
+
+static void ep_device_release(struct device *dev)
+{
+        struct ep_device *ep_dev = to_ep_device(dev);
+
+        dev_dbg(dev, "%s called for %s\n", __FUNCTION__, dev->bus_id);
+        kfree(ep_dev);
+}
+
+void usb_create_ep_files(struct device *parent,
+                         struct usb_host_endpoint *endpoint,
+                         struct usb_device *udev)
+{
+        char name[8];
+        struct ep_device *ep_dev;
+        int minor;
+        int retval;
+
+        retval = init_endpoint_class();
+        if (retval)
+                goto exit;
+
+        ep_dev = kzalloc(sizeof(*ep_dev), GFP_KERNEL);
+        if (!ep_dev) {
+                retval = -ENOMEM;
+                goto exit;
+        }
+
+        /* fun calculation to determine the minor of this endpoint */
+        minor = (((udev->bus->busnum - 1) * 128) * 16) + (udev->devnum - 1);
+
+        ep_dev->desc = &endpoint->desc;
+        ep_dev->udev = udev;
+        ep_dev->dev.devt = MKDEV(442, minor);   // FIXME fake number...
+        ep_dev->dev.class = ep_class->class;
+        ep_dev->dev.parent = parent;
+        ep_dev->dev.release = ep_device_release;
+        snprintf(ep_dev->dev.bus_id, BUS_ID_SIZE, "usbdev%d.%d_ep%02x",
+                 udev->bus->busnum, udev->devnum,
+                 endpoint->desc.bEndpointAddress);
+
+        retval = device_register(&ep_dev->dev);
+        if (retval)
+                goto error;
+        sysfs_create_group(&ep_dev->dev.kobj, &ep_dev_attr_grp);
+
+        endpoint->ep_dev = ep_dev;
+
+        /* create the symlink to the old-style "ep_XX" directory */
+        sprintf(name, "ep_%02x", endpoint->desc.bEndpointAddress);
+        sysfs_create_link(&parent->kobj, &endpoint->ep_dev->dev.kobj, name);
+
+exit:
+        return;
+error:
+        kfree(ep_dev);
+        return;
+}
+
+void usb_remove_ep_files(struct usb_host_endpoint *endpoint)
+{
+
+        if (endpoint->ep_dev) {
+                char name[8];
+
+                sprintf(name, "ep_%02x", endpoint->desc.bEndpointAddress);
+                sysfs_remove_link(&endpoint->ep_dev->dev.parent->kobj, name);
+                sysfs_remove_group(&endpoint->ep_dev->dev.kobj, &ep_dev_attr_grp);
+                device_unregister(&endpoint->ep_dev->dev);
+                endpoint->ep_dev = NULL;
+        }
+        destroy_endpoint_class();
+}
+
+
diff --git a/drivers/usb/core/file.c b/drivers/usb/core/file.c
index b263a54a13c0..f65b193cde3d 100644
--- a/drivers/usb/core/file.c
+++ b/drivers/usb/core/file.c
@@ -61,33 +61,66 @@ static struct file_operations usb_fops = {
         .open =         usb_open,
 };
 
-static struct class *usb_class;
+static struct usb_class {
+        struct kref kref;
+        struct class *class;
+} *usb_class;
 
-int usb_major_init(void)
+static int init_usb_class(void)
 {
-        int error;
+        int result = 0;
 
-        error = register_chrdev(USB_MAJOR, "usb", &usb_fops);
-        if (error) {
-                err("unable to get major %d for usb devices", USB_MAJOR);
-                goto out;
+        if (usb_class != NULL) {
+                kref_get(&usb_class->kref);
+                goto exit;
+        }
+
+        usb_class = kmalloc(sizeof(*usb_class), GFP_KERNEL);
+        if (!usb_class) {
+                result = -ENOMEM;
+                goto exit;
         }
 
-        usb_class = class_create(THIS_MODULE, "usb");
-        if (IS_ERR(usb_class)) {
-                error = PTR_ERR(usb_class);
+        kref_init(&usb_class->kref);
+        usb_class->class = class_create(THIS_MODULE, "usb");
+        if (IS_ERR(usb_class->class)) {
+                result = IS_ERR(usb_class->class);
                 err("class_create failed for usb devices");
-                unregister_chrdev(USB_MAJOR, "usb");
-                goto out;
+                kfree(usb_class);
+                usb_class = NULL;
         }
 
-out:
+exit:
+        return result;
+}
+
+static void release_usb_class(struct kref *kref)
+{
+        /* Ok, we cheat as we know we only have one usb_class */
+        class_destroy(usb_class->class);
+        kfree(usb_class);
+        usb_class = NULL;
+}
+
+static void destroy_usb_class(void)
+{
+        if (usb_class)
+                kref_put(&usb_class->kref, release_usb_class);
+}
+
+int usb_major_init(void)
+{
+        int error;
+
+        error = register_chrdev(USB_MAJOR, "usb", &usb_fops);
+        if (error)
+                err("unable to get major %d for usb devices", USB_MAJOR);
+
         return error;
 }
 
 void usb_major_cleanup(void)
 {
-        class_destroy(usb_class);
         unregister_chrdev(USB_MAJOR, "usb");
 }
 
@@ -149,6 +182,10 @@ int usb_register_dev(struct usb_interface *intf,
         if (retval)
                 goto exit;
 
+        retval = init_usb_class();
+        if (retval)
+                goto exit;
+
         intf->minor = minor;
 
         /* create a usb class device for this usb interface */
@@ -158,14 +195,13 @@ int usb_register_dev(struct usb_interface *intf,
                 ++temp;
         else
                 temp = name;
-        intf->class_dev = class_device_create(usb_class, NULL,
-                                              MKDEV(USB_MAJOR, minor),
-                                              &intf->dev, "%s", temp);
-        if (IS_ERR(intf->class_dev)) {
+        intf->usb_dev = device_create(usb_class->class, &intf->dev,
+                                      MKDEV(USB_MAJOR, minor), "%s", temp);
+        if (IS_ERR(intf->usb_dev)) {
                 spin_lock (&minor_lock);
                 usb_minors[intf->minor] = NULL;
                 spin_unlock (&minor_lock);
-                retval = PTR_ERR(intf->class_dev);
+                retval = PTR_ERR(intf->usb_dev);
         }
 exit:
         return retval;
@@ -206,9 +242,10 @@ void usb_deregister_dev(struct usb_interface *intf,
         spin_unlock (&minor_lock);
 
         snprintf(name, BUS_ID_SIZE, class_driver->name, intf->minor - minor_base);
-        class_device_destroy(usb_class, MKDEV(USB_MAJOR, intf->minor));
-        intf->class_dev = NULL;
+        device_destroy(usb_class->class, MKDEV(USB_MAJOR, intf->minor));
+        intf->usb_dev = NULL;
         intf->minor = -1;
+        destroy_usb_class();
 }
 EXPORT_SYMBOL(usb_deregister_dev);
 
diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c
index e2e00ba4e1e6..4bf914d00a14 100644
--- a/drivers/usb/core/hcd.c
+++ b/drivers/usb/core/hcd.c
@@ -1826,24 +1826,16 @@ int usb_add_hcd(struct usb_hcd *hcd,
 
         /* enable irqs just before we start the controller */
         if (hcd->driver->irq) {
-                char    buf[8], *bufp = buf;
-
-#ifdef __sparc__
-                bufp = __irq_itoa(irqnum);
-#else
-                sprintf(buf, "%d", irqnum);
-#endif
-
                 snprintf(hcd->irq_descr, sizeof(hcd->irq_descr), "%s:usb%d",
                                 hcd->driver->description, hcd->self.busnum);
                 if ((retval = request_irq(irqnum, &usb_hcd_irq, irqflags,
                                 hcd->irq_descr, hcd)) != 0) {
                         dev_err(hcd->self.controller,
-                                        "request interrupt %s failed\n", bufp);
+                                        "request interrupt %d failed\n", irqnum);
                         goto err_request_irq;
                 }
                 hcd->irq = irqnum;
-                dev_info(hcd->self.controller, "irq %s, %s 0x%08llx\n", bufp,
+                dev_info(hcd->self.controller, "irq %d, %s 0x%08llx\n", irqnum,
                                 (hcd->driver->flags & HCD_MEMORY) ?
                                         "io mem" : "io base",
                                         (unsigned long long)hcd->rsrc_start);
diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index 90b8d43c6b33..e1731ff8af4d 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -432,15 +432,22 @@ static void hub_power_on(struct usb_hub *hub)
 {
         int port1;
         unsigned pgood_delay = hub->descriptor->bPwrOn2PwrGood * 2;
-        u16 wHubCharacteristics = le16_to_cpu(hub->descriptor->wHubCharacteristics);
-
-        /* if hub supports power switching, enable power on each port */
-        if ((wHubCharacteristics & HUB_CHAR_LPSM) < 2) {
+        u16 wHubCharacteristics =
+                        le16_to_cpu(hub->descriptor->wHubCharacteristics);
+
+        /* Enable power on each port.  Some hubs have reserved values
+         * of LPSM (> 2) in their descriptors, even though they are
+         * USB 2.0 hubs.  Some hubs do not implement port-power switching
+         * but only emulate it.  In all cases, the ports won't work
+         * unless we send these messages to the hub.
+         */
+        if ((wHubCharacteristics & HUB_CHAR_LPSM) < 2)
                 dev_dbg(hub->intfdev, "enabling power on all ports\n");
-                for (port1 = 1; port1 <= hub->descriptor->bNbrPorts; port1++)
-                        set_port_feature(hub->hdev, port1,
-                                        USB_PORT_FEAT_POWER);
-        }
+        else
+                dev_dbg(hub->intfdev, "trying to enable port power on "
+                                "non-switchable hub\n");
+        for (port1 = 1; port1 <= hub->descriptor->bNbrPorts; port1++)
+                set_port_feature(hub->hdev, port1, USB_PORT_FEAT_POWER);
 
         /* Wait at least 100 msec for power to become stable */
         msleep(max(pgood_delay, (unsigned) 100));
@@ -518,15 +525,16 @@ static int hub_port_disable(struct usb_hub *hub, int port1, int set_state)
 
 
 /* caller has locked the hub device */
-static void hub_pre_reset(struct usb_hub *hub, int disable_ports)
+static void hub_pre_reset(struct usb_interface *intf)
 {
+        struct usb_hub *hub = usb_get_intfdata(intf);
         struct usb_device *hdev = hub->hdev;
         int port1;
 
         for (port1 = 1; port1 <= hdev->maxchild; ++port1) {
                 if (hdev->children[port1 - 1]) {
                         usb_disconnect(&hdev->children[port1 - 1]);
-                        if (disable_ports)
+                        if (hub->error == 0)
                                 hub_port_disable(hub, port1, 0);
                 }
         }
@@ -534,8 +542,10 @@ static void hub_pre_reset(struct usb_hub *hub, int disable_ports)
 }
 
 /* caller has locked the hub device */
-static void hub_post_reset(struct usb_hub *hub)
+static void hub_post_reset(struct usb_interface *intf)
 {
+        struct usb_hub *hub = usb_get_intfdata(intf);
+
         hub_activate(hub);
         hub_power_on(hub);
 }
@@ -795,15 +805,16 @@ static void hub_disconnect(struct usb_interface *intf)
         struct usb_hub *hub = usb_get_intfdata (intf);
         struct usb_device *hdev;
 
+        /* Disconnect all children and quiesce the hub */
+        hub->error = 0;
+        hub_pre_reset(intf);
+
         usb_set_intfdata (intf, NULL);
         hdev = hub->hdev;
 
         if (hdev->speed == USB_SPEED_HIGH)
                 highspeed_hubs--;
 
-        /* Disconnect all children and quiesce the hub */
-        hub_pre_reset(hub, 1);
-
         usb_free_urb(hub->urb);
         hub->urb = NULL;
 
@@ -1169,6 +1180,7 @@ static int choose_configuration(struct usb_device *udev)
 {
         int i;
         int num_configs;
+        int insufficient_power = 0;
         struct usb_host_config *c, *best;
 
         best = NULL;
@@ -1221,8 +1233,10 @@ static int choose_configuration(struct usb_device *udev)
                  */
 
                 /* Rule out configs that draw too much bus current */
-                if (c->desc.bMaxPower * 2 > udev->bus_mA)
+                if (c->desc.bMaxPower * 2 > udev->bus_mA) {
+                        insufficient_power++;
                         continue;
+                }
 
                 /* If the first config's first interface is COMM/2/0xff
                  * (MSFT RNDIS), rule it out unless Linux has host-side
@@ -1231,7 +1245,7 @@ static int choose_configuration(struct usb_device *udev)
                                 && desc->bInterfaceClass == USB_CLASS_COMM
                                 && desc->bInterfaceSubClass == 2
                                 && desc->bInterfaceProtocol == 0xff) {
-#ifndef CONFIG_USB_NET_RNDIS
+#ifndef CONFIG_USB_NET_RNDIS_HOST
                         continue;
 #else
                         best = c;
@@ -1256,6 +1270,11 @@ static int choose_configuration(struct usb_device *udev)
                         best = c;
         }
 
+        if (insufficient_power > 0)
+                dev_info(&udev->dev, "rejected %d configuration%s "
+                        "due to insufficient available bus power\n",
+                        insufficient_power, plural(insufficient_power));
+
         if (best) {
                 i = best->desc.bConfigurationValue;
                 dev_info(&udev->dev,
@@ -2732,7 +2751,8 @@ static void hub_events(void)
 
                 /* If the hub has died, clean up after it */
                 if (hdev->state == USB_STATE_NOTATTACHED) {
-                        hub_pre_reset(hub, 0);
+                        hub->error = -ENODEV;
+                        hub_pre_reset(intf);
                         goto loop;
                 }
 
@@ -2744,7 +2764,7 @@ static void hub_events(void)
                         dev_dbg (hub_dev, "resetting for error %d\n",
                                 hub->error);
 
-                        ret = usb_reset_device(hdev);
+                        ret = usb_reset_composite_device(hdev, intf);
                         if (ret) {
                                 dev_dbg (hub_dev,
                                         "error resetting hub: %d\n", ret);
@@ -2913,6 +2933,8 @@ static struct usb_driver hub_driver = {
         .disconnect =   hub_disconnect,
         .suspend =      hub_suspend,
         .resume =       hub_resume,
+        .pre_reset =    hub_pre_reset,
+        .post_reset =   hub_post_reset,
         .ioctl =        hub_ioctl,
         .id_table =     hub_id_table,
 };
@@ -2992,9 +3014,9 @@ static int config_descriptors_changed(struct usb_device *udev)
  * usb_reset_device - perform a USB port reset to reinitialize a device
  * @udev: device to reset (not in SUSPENDED or NOTATTACHED state)
  *
- * WARNING - don't reset any device unless drivers for all of its
- * interfaces are expecting that reset!  Maybe some driver->reset()
- * method should eventually help ensure sufficient cooperation.
+ * WARNING - don't use this routine to reset a composite device
+ * (one with multiple interfaces owned by separate drivers)!
+ * Use usb_reset_composite_device() instead.
  *
  * Do a port reset, reassign the device's address, and establish its
  * former operating configuration.  If the reset fails, or the device's
@@ -3018,7 +3040,6 @@ int usb_reset_device(struct usb_device *udev)
         struct usb_device               *parent_hdev = udev->parent;
         struct usb_hub                  *parent_hub;
         struct usb_device_descriptor    descriptor = udev->descriptor;
-        struct usb_hub                  *hub = NULL;
         int                             i, ret = 0;
         int                             port1 = udev->portnum;
 
@@ -3036,14 +3057,6 @@ int usb_reset_device(struct usb_device *udev)
         }
         parent_hub = hdev_to_hub(parent_hdev);
 
-        /* If we're resetting an active hub, take some special actions */
-        if (udev->actconfig && udev->actconfig->desc.bNumInterfaces > 0 &&
-                        udev->actconfig->interface[0]->dev.driver ==
-                                &hub_driver.driver &&
-                        (hub = hdev_to_hub(udev)) != NULL) {
-                hub_pre_reset(hub, 0);
-        }
-
         set_bit(port1, parent_hub->busy_bits);
         for (i = 0; i < SET_CONFIG_TRIES; ++i) {
 
@@ -3102,11 +3115,87 @@ int usb_reset_device(struct usb_device *udev)
         }
 
 done:
-        if (hub)
-                hub_post_reset(hub);
         return 0;
  
 re_enumerate:
         hub_port_logical_disconnect(parent_hub, port1);
         return -ENODEV;
 }
+
+/**
+ * usb_reset_composite_device - warn interface drivers and perform a USB port reset
+ * @udev: device to reset (not in SUSPENDED or NOTATTACHED state)
+ * @iface: interface bound to the driver making the request (optional)
+ *
+ * Warns all drivers bound to registered interfaces (using their pre_reset
+ * method), performs the port reset, and then lets the drivers know that
+ * the reset is over (using their post_reset method).
+ *
+ * Return value is the same as for usb_reset_device().
+ *
+ * The caller must own the device lock.  For example, it's safe to use
+ * this from a driver probe() routine after downloading new firmware.
+ * For calls that might not occur during probe(), drivers should lock
+ * the device using usb_lock_device_for_reset().
+ *
+ * The interface locks are acquired during the pre_reset stage and released
+ * during the post_reset stage.  However if iface is not NULL and is
+ * currently being probed, we assume that the caller already owns its
+ * lock.
+ */
+int usb_reset_composite_device(struct usb_device *udev,
+                struct usb_interface *iface)
+{
+        int ret;
+        struct usb_host_config *config = udev->actconfig;
+
+        if (udev->state == USB_STATE_NOTATTACHED ||
+                        udev->state == USB_STATE_SUSPENDED) {
+                dev_dbg(&udev->dev, "device reset not allowed in state %d\n",
+                                udev->state);
+                return -EINVAL;
+        }
+
+        if (iface && iface->condition != USB_INTERFACE_BINDING)
+                iface = NULL;
+
+        if (config) {
+                int i;
+                struct usb_interface *cintf;
+                struct usb_driver *drv;
+
+                for (i = 0; i < config->desc.bNumInterfaces; ++i) {
+                        cintf = config->interface[i];
+                        if (cintf != iface)
+                                down(&cintf->dev.sem);
+                        if (device_is_registered(&cintf->dev) &&
+                                        cintf->dev.driver) {
+                                drv = to_usb_driver(cintf->dev.driver);
+                                if (drv->pre_reset)
+                                        (drv->pre_reset)(cintf);
+                        }
+                }
+        }
+
+        ret = usb_reset_device(udev);
+
+        if (config) {
+                int i;
+                struct usb_interface *cintf;
+                struct usb_driver *drv;
+
+                for (i = config->desc.bNumInterfaces - 1; i >= 0; --i) {
+                        cintf = config->interface[i];
+                        if (device_is_registered(&cintf->dev) &&
+                                        cintf->dev.driver) {
+                                drv = to_usb_driver(cintf->dev.driver);
+                                if (drv->post_reset)
+                                        (drv->post_reset)(cintf);
+                        }
+                        if (cintf != iface)
+                                up(&cintf->dev.sem);
+                }
+        }
+
+        return ret;
+}
diff --git a/drivers/usb/core/inode.c b/drivers/usb/core/inode.c
index 695b90a17a68..bfc9b28a7242 100644
--- a/drivers/usb/core/inode.c
+++ b/drivers/usb/core/inode.c
@@ -543,10 +543,10 @@ static void fs_remove_file (struct dentry *dentry)
 
 /* --------------------------------------------------------------------- */
 
-static struct super_block *usb_get_sb(struct file_system_type *fs_type,
-        int flags, const char *dev_name, void *data)
+static int usb_get_sb(struct file_system_type *fs_type,
+        int flags, const char *dev_name, void *data, struct vfsmount *mnt)
 {
-        return get_sb_single(fs_type, flags, data, usbfs_fill_super);
+        return get_sb_single(fs_type, flags, data, usbfs_fill_super, mnt);
 }
 
 static struct file_system_type usb_fs_type = {
diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c
index 08fb20f06f3e..8569600f3130 100644
--- a/drivers/usb/core/message.c
+++ b/drivers/usb/core/message.c
@@ -158,6 +158,37 @@ int usb_control_msg(struct usb_device *dev, unsigned int pipe, __u8 request, __u
 
 
 /**
+ * usb_interrupt_msg - Builds an interrupt urb, sends it off and waits for completion
+ * @usb_dev: pointer to the usb device to send the message to
+ * @pipe: endpoint "pipe" to send the message to
+ * @data: pointer to the data to send
+ * @len: length in bytes of the data to send
+ * @actual_length: pointer to a location to put the actual length transferred in bytes
+ * @timeout: time in msecs to wait for the message to complete before
+ *      timing out (if 0 the wait is forever)
+ * Context: !in_interrupt ()
+ *
+ * This function sends a simple interrupt message to a specified endpoint and
+ * waits for the message to complete, or timeout.
+ *
+ * If successful, it returns 0, otherwise a negative error number.  The number
+ * of actual bytes transferred will be stored in the actual_length paramater.
+ *
+ * Don't use this function from within an interrupt context, like a bottom half
+ * handler.  If you need an asynchronous message, or need to send a message
+ * from within interrupt context, use usb_submit_urb() If a thread in your
+ * driver uses this call, make sure your disconnect() method can wait for it to
+ * complete.  Since you don't have a handle on the URB used, you can't cancel
+ * the request.
+ */
+int usb_interrupt_msg(struct usb_device *usb_dev, unsigned int pipe,
+                      void *data, int len, int *actual_length, int timeout)
+{
+        return usb_bulk_msg(usb_dev, pipe, data, len, actual_length, timeout);
+}
+EXPORT_SYMBOL_GPL(usb_interrupt_msg);
+
+/**
  *      usb_bulk_msg - Builds a bulk urb, sends it off and waits for completion
  *      @usb_dev: pointer to the usb device to send the message to
  *      @pipe: endpoint "pipe" to send the message to
@@ -1380,15 +1411,7 @@ free_interfaces:
                                 return ret;
                         }
                 }
-        }
-
-        /* if it's already configured, clear out old state first.
-         * getting rid of old interfaces means unbinding their drivers.
-         */
-        if (dev->state != USB_STATE_ADDRESS)
-                usb_disable_device (dev, 1);    // Skip ep0
 
-        if (cp) {
                 i = dev->bus_mA - cp->desc.bMaxPower * 2;
                 if (i < 0)
                         dev_warn(&dev->dev, "new config #%d exceeds power "
@@ -1396,84 +1419,91 @@ free_interfaces:
                                         configuration, -i);
         }
 
+        /* if it's already configured, clear out old state first.
+         * getting rid of old interfaces means unbinding their drivers.
+         */
+        if (dev->state != USB_STATE_ADDRESS)
+                usb_disable_device (dev, 1);    // Skip ep0
+
         if ((ret = usb_control_msg(dev, usb_sndctrlpipe(dev, 0),
                         USB_REQ_SET_CONFIGURATION, 0, configuration, 0,
-                        NULL, 0, USB_CTRL_SET_TIMEOUT)) < 0)
-                goto free_interfaces;
+                        NULL, 0, USB_CTRL_SET_TIMEOUT)) < 0) {
+
+                /* All the old state is gone, so what else can we do?
+                 * The device is probably useless now anyway.
+                 */
+                cp = NULL;
+        }
 
         dev->actconfig = cp;
-        if (!cp)
+        if (!cp) {
                 usb_set_device_state(dev, USB_STATE_ADDRESS);
-        else {
-                usb_set_device_state(dev, USB_STATE_CONFIGURED);
+                goto free_interfaces;
+        }
+        usb_set_device_state(dev, USB_STATE_CONFIGURED);
 
-                /* Initialize the new interface structures and the
-                 * hc/hcd/usbcore interface/endpoint state.
-                 */
-                for (i = 0; i < nintf; ++i) {
-                        struct usb_interface_cache *intfc;
-                        struct usb_interface *intf;
-                        struct usb_host_interface *alt;
-
-                        cp->interface[i] = intf = new_interfaces[i];
-                        intfc = cp->intf_cache[i];
-                        intf->altsetting = intfc->altsetting;
-                        intf->num_altsetting = intfc->num_altsetting;
-                        kref_get(&intfc->ref);
-
-                        alt = usb_altnum_to_altsetting(intf, 0);
-
-                        /* No altsetting 0?  We'll assume the first altsetting.
-                         * We could use a GetInterface call, but if a device is
-                         * so non-compliant that it doesn't have altsetting 0
-                         * then I wouldn't trust its reply anyway.
-                         */
-                        if (!alt)
-                                alt = &intf->altsetting[0];
-
-                        intf->cur_altsetting = alt;
-                        usb_enable_interface(dev, intf);
-                        intf->dev.parent = &dev->dev;
-                        intf->dev.driver = NULL;
-                        intf->dev.bus = &usb_bus_type;
-                        intf->dev.dma_mask = dev->dev.dma_mask;
-                        intf->dev.release = release_interface;
-                        device_initialize (&intf->dev);
-                        mark_quiesced(intf);
-                        sprintf (&intf->dev.bus_id[0], "%d-%s:%d.%d",
-                                 dev->bus->busnum, dev->devpath,
-                                 configuration,
-                                 alt->desc.bInterfaceNumber);
-                }
-                kfree(new_interfaces);
+        /* Initialize the new interface structures and the
+         * hc/hcd/usbcore interface/endpoint state.
+         */
+        for (i = 0; i < nintf; ++i) {
+                struct usb_interface_cache *intfc;
+                struct usb_interface *intf;
+                struct usb_host_interface *alt;
+
+                cp->interface[i] = intf = new_interfaces[i];
+                intfc = cp->intf_cache[i];
+                intf->altsetting = intfc->altsetting;
+                intf->num_altsetting = intfc->num_altsetting;
+                kref_get(&intfc->ref);
 
-                if (cp->string == NULL)
-                        cp->string = usb_cache_string(dev,
-                                        cp->desc.iConfiguration);
+                alt = usb_altnum_to_altsetting(intf, 0);
 
-                /* Now that all the interfaces are set up, register them
-                 * to trigger binding of drivers to interfaces.  probe()
-                 * routines may install different altsettings and may
-                 * claim() any interfaces not yet bound.  Many class drivers
-                 * need that: CDC, audio, video, etc.
+                /* No altsetting 0?  We'll assume the first altsetting.
+                 * We could use a GetInterface call, but if a device is
+                 * so non-compliant that it doesn't have altsetting 0
+                 * then I wouldn't trust its reply anyway.
                  */
-                for (i = 0; i < nintf; ++i) {
-                        struct usb_interface *intf = cp->interface[i];
-
-                        dev_dbg (&dev->dev,
-                                "adding %s (config #%d, interface %d)\n",
-                                intf->dev.bus_id, configuration,
-                                intf->cur_altsetting->desc.bInterfaceNumber);
-                        ret = device_add (&intf->dev);
-                        if (ret != 0) {
-                                dev_err(&dev->dev,
-                                        "device_add(%s) --> %d\n",
-                                        intf->dev.bus_id,
-                                        ret);
-                                continue;
-                        }
-                        usb_create_sysfs_intf_files (intf);
+                if (!alt)
+                        alt = &intf->altsetting[0];
+
+                intf->cur_altsetting = alt;
+                usb_enable_interface(dev, intf);
+                intf->dev.parent = &dev->dev;
+                intf->dev.driver = NULL;
+                intf->dev.bus = &usb_bus_type;
+                intf->dev.dma_mask = dev->dev.dma_mask;
+                intf->dev.release = release_interface;
+                device_initialize (&intf->dev);
+                mark_quiesced(intf);
+                sprintf (&intf->dev.bus_id[0], "%d-%s:%d.%d",
+                         dev->bus->busnum, dev->devpath,
+                         configuration, alt->desc.bInterfaceNumber);
+        }
+        kfree(new_interfaces);
+
+        if (cp->string == NULL)
+                cp->string = usb_cache_string(dev, cp->desc.iConfiguration);
+
+        /* Now that all the interfaces are set up, register them
+         * to trigger binding of drivers to interfaces.  probe()
+         * routines may install different altsettings and may
+         * claim() any interfaces not yet bound.  Many class drivers
+         * need that: CDC, audio, video, etc.
+         */
+        for (i = 0; i < nintf; ++i) {
+                struct usb_interface *intf = cp->interface[i];
+
+                dev_dbg (&dev->dev,
+                        "adding %s (config #%d, interface %d)\n",
+                        intf->dev.bus_id, configuration,
+                        intf->cur_altsetting->desc.bInterfaceNumber);
+                ret = device_add (&intf->dev);
+                if (ret != 0) {
+                        dev_err(&dev->dev, "device_add(%s) --> %d\n",
+                                intf->dev.bus_id, ret);
+                        continue;
                 }
+                usb_create_sysfs_intf_files (intf);
         }
 
         return 0;
diff --git a/drivers/usb/core/sysfs.c b/drivers/usb/core/sysfs.c
index 71d881327e88..3f49bf51cff7 100644
--- a/drivers/usb/core/sysfs.c
+++ b/drivers/usb/core/sysfs.c
@@ -15,203 +15,6 @@
 #include <linux/usb.h>
 #include "usb.h"
 
-/* endpoint stuff */
-struct ep_object {
-        struct usb_endpoint_descriptor *desc;
-        struct usb_device *udev;
-        struct kobject kobj;
-};
-#define to_ep_object(_kobj) \
-        container_of(_kobj, struct ep_object, kobj)
-
-struct ep_attribute {
-        struct attribute attr;
-        ssize_t (*show)(struct usb_device *,
-                        struct usb_endpoint_descriptor *, char *);
-};
-#define to_ep_attribute(_attr) \
-        container_of(_attr, struct ep_attribute, attr)
-
-#define EP_ATTR(_name)                                          \
-struct ep_attribute ep_##_name = {                              \
-        .attr = {.name = #_name, .owner = THIS_MODULE,          \
-                        .mode = S_IRUGO},                       \
-        .show = show_ep_##_name}
-
-#define usb_ep_attr(field, format_string)                       \
-static ssize_t show_ep_##field(struct usb_device *udev,         \
-                struct usb_endpoint_descriptor *desc,           \
-                char *buf)                                      \
-{                                                               \
-        return sprintf(buf, format_string, desc->field);        \
-}                                                               \
-static EP_ATTR(field);
-
-usb_ep_attr(bLength, "%02x\n")
-usb_ep_attr(bEndpointAddress, "%02x\n")
-usb_ep_attr(bmAttributes, "%02x\n")
-usb_ep_attr(bInterval, "%02x\n")
-
-static ssize_t show_ep_wMaxPacketSize(struct usb_device *udev,
-                struct usb_endpoint_descriptor *desc, char *buf)
-{
-        return sprintf(buf, "%04x\n",
-                        le16_to_cpu(desc->wMaxPacketSize) & 0x07ff);
-}
-static EP_ATTR(wMaxPacketSize);
-
-static ssize_t show_ep_type(struct usb_device *udev,
-                struct usb_endpoint_descriptor *desc, char *buf)
-{
-        char *type = "unknown";
-
-        switch (desc->bmAttributes & USB_ENDPOINT_XFERTYPE_MASK) {
-        case USB_ENDPOINT_XFER_CONTROL:
-                type = "Control";
-                break;
-        case USB_ENDPOINT_XFER_ISOC:
-                type = "Isoc";
-                break;
-        case USB_ENDPOINT_XFER_BULK:
-                type = "Bulk";
-                break;
-        case USB_ENDPOINT_XFER_INT:
-                type = "Interrupt";
-                break;
-        }
-        return sprintf(buf, "%s\n", type);
-}
-static EP_ATTR(type);
-
-static ssize_t show_ep_interval(struct usb_device *udev,
-                struct usb_endpoint_descriptor *desc, char *buf)
-{
-        char unit;
-        unsigned interval = 0;
-        unsigned in;
-
-        in = (desc->bEndpointAddress & USB_DIR_IN);
-
-        switch (desc->bmAttributes & USB_ENDPOINT_XFERTYPE_MASK) {
-        case USB_ENDPOINT_XFER_CONTROL:
-                if (udev->speed == USB_SPEED_HIGH)      /* uframes per NAK */
-                        interval = desc->bInterval;
-                break;
-        case USB_ENDPOINT_XFER_ISOC:
-                interval = 1 << (desc->bInterval - 1);
-                break;
-        case USB_ENDPOINT_XFER_BULK:
-                if (udev->speed == USB_SPEED_HIGH && !in) /* uframes per NAK */
-                        interval = desc->bInterval;
-                break;
-        case USB_ENDPOINT_XFER_INT:
-                if (udev->speed == USB_SPEED_HIGH)
-                        interval = 1 << (desc->bInterval - 1);
-                else
-                        interval = desc->bInterval;
-                break;
-        }
-        interval *= (udev->speed == USB_SPEED_HIGH) ? 125 : 1000;
-        if (interval % 1000)
-                unit = 'u';
-        else {
-                unit = 'm';
-                interval /= 1000;
-        }
-
-        return sprintf(buf, "%d%cs\n", interval, unit);
-}
-static EP_ATTR(interval);
-
-static ssize_t show_ep_direction(struct usb_device *udev,
-                struct usb_endpoint_descriptor *desc, char *buf)
-{
-        char *direction;
-
-        if ((desc->bmAttributes & USB_ENDPOINT_XFERTYPE_MASK) ==
-                        USB_ENDPOINT_XFER_CONTROL)
-                direction = "both";
-        else if (desc->bEndpointAddress & USB_DIR_IN)
-                direction = "in";
-        else
-                direction = "out";
-        return sprintf(buf, "%s\n", direction);
-}
-static EP_ATTR(direction);
-
-static struct attribute *ep_attrs[] = {
-        &ep_bLength.attr,
-        &ep_bEndpointAddress.attr,
-        &ep_bmAttributes.attr,
-        &ep_bInterval.attr,
-        &ep_wMaxPacketSize.attr,
-        &ep_type.attr,
-        &ep_interval.attr,
-        &ep_direction.attr,
-        NULL,
-};
-
-static void ep_object_release(struct kobject *kobj)
-{
-        kfree(to_ep_object(kobj));
-}
-
-static ssize_t ep_object_show(struct kobject *kobj, struct attribute *attr,
-                char *buf)
-{
-        struct ep_object *ep_obj = to_ep_object(kobj);
-        struct ep_attribute *ep_attr = to_ep_attribute(attr);
-
-        return (ep_attr->show)(ep_obj->udev, ep_obj->desc, buf);
-}
-
-static struct sysfs_ops ep_object_sysfs_ops = {
-        .show =                 ep_object_show,
-};
-
-static struct kobj_type ep_object_ktype = {
-        .release =              ep_object_release,
-        .sysfs_ops =            &ep_object_sysfs_ops,
-        .default_attrs =        ep_attrs,
-};
-
-static void usb_create_ep_files(struct kobject *parent,
-                struct usb_host_endpoint *endpoint,
-                struct usb_device *udev)
-{
-        struct ep_object *ep_obj;
-        struct kobject *kobj;
-
-        ep_obj = kzalloc(sizeof(struct ep_object), GFP_KERNEL);
-        if (!ep_obj)
-                return;
-
-        ep_obj->desc = &endpoint->desc;
-        ep_obj->udev = udev;
-
-        kobj = &ep_obj->kobj;
-        kobject_set_name(kobj, "ep_%02x", endpoint->desc.bEndpointAddress);
-        kobj->parent = parent;
-        kobj->ktype = &ep_object_ktype;
-
-        /* Don't use kobject_register, because it generates a hotplug event */
-        kobject_init(kobj);
-        if (kobject_add(kobj) == 0)
-                endpoint->kobj = kobj;
-        else
-                kobject_put(kobj);
-}
-
-static void usb_remove_ep_files(struct usb_host_endpoint *endpoint)
-{
-
-        if (endpoint->kobj) {
-                kobject_del(endpoint->kobj);
-                kobject_put(endpoint->kobj);
-                endpoint->kobj = NULL;
-        }
-}
-
 /* Active configuration fields */
 #define usb_actconfig_show(field, multiplier, format_string)            \
 static ssize_t  show_##field (struct device *dev,                       \
@@ -420,7 +223,7 @@ void usb_create_sysfs_dev_files (struct usb_device *udev)
         if (udev->serial)
                 device_create_file (dev, &dev_attr_serial);
         device_create_file (dev, &dev_attr_configuration);
-        usb_create_ep_files(&dev->kobj, &udev->ep0, udev);
+        usb_create_ep_files(dev, &udev->ep0, udev);
 }
 
 void usb_remove_sysfs_dev_files (struct usb_device *udev)
@@ -524,7 +327,7 @@ static inline void usb_create_intf_ep_files(struct usb_interface *intf,
 
         iface_desc = intf->cur_altsetting;
         for (i = 0; i < iface_desc->desc.bNumEndpoints; ++i)
-                usb_create_ep_files(&intf->dev.kobj, &iface_desc->endpoint[i],
+                usb_create_ep_files(&intf->dev, &iface_desc->endpoint[i],
                                 udev);
 }
 
diff --git a/drivers/usb/core/usb.c b/drivers/usb/core/usb.c
index b7fdc1cd134a..fb488c8a860c 100644
--- a/drivers/usb/core/usb.c
+++ b/drivers/usb/core/usb.c
@@ -991,6 +991,8 @@ void usb_buffer_unmap_sg (struct usb_device *dev, unsigned pipe,
 
 static int verify_suspended(struct device *dev, void *unused)
 {
+        if (dev->driver == NULL)
+                return 0;
         return (dev->power.power_state.event == PM_EVENT_ON) ? -EBUSY : 0;
 }
 
@@ -1207,6 +1209,7 @@ EXPORT_SYMBOL(usb_ifnum_to_if);
 EXPORT_SYMBOL(usb_altnum_to_altsetting);
 
 EXPORT_SYMBOL(usb_reset_device);
+EXPORT_SYMBOL(usb_reset_composite_device);
 
 EXPORT_SYMBOL(__usb_get_extra_descriptor);
 
diff --git a/drivers/usb/core/usb.h b/drivers/usb/core/usb.h
index 4647e1ebc68d..7a650c763a62 100644
--- a/drivers/usb/core/usb.h
+++ b/drivers/usb/core/usb.h
@@ -4,6 +4,9 @@ extern void usb_create_sysfs_dev_files (struct usb_device *dev);
 extern void usb_remove_sysfs_dev_files (struct usb_device *dev);
 extern void usb_create_sysfs_intf_files (struct usb_interface *intf);
 extern void usb_remove_sysfs_intf_files (struct usb_interface *intf);
+extern void usb_create_ep_files(struct device *parent, struct usb_host_endpoint *endpoint,
+                                struct usb_device *udev);
+extern void usb_remove_ep_files(struct usb_host_endpoint *endpoint);
 
 extern void usb_disable_endpoint (struct usb_device *dev, unsigned int epaddr);
 extern void usb_disable_interface (struct usb_device *dev,
diff --git a/drivers/usb/gadget/ether.c b/drivers/usb/gadget/ether.c
index 9c4422ac9de4..078daa026718 100644
--- a/drivers/usb/gadget/ether.c
+++ b/drivers/usb/gadget/ether.c
@@ -49,7 +49,7 @@
 #include <asm/unaligned.h>
 
 #include <linux/usb_ch9.h>
-#include <linux/usb_cdc.h>
+#include <linux/usb/cdc.h>
 #include <linux/usb_gadget.h>
 
 #include <linux/random.h>
@@ -101,9 +101,9 @@ static const char driver_desc [] = DRIVER_DESC;
 
 /* CDC and RNDIS support the same host-chosen outgoing packet filters. */
 #define DEFAULT_FILTER  (USB_CDC_PACKET_TYPE_BROADCAST \
-                        |USB_CDC_PACKET_TYPE_ALL_MULTICAST \
-                        |USB_CDC_PACKET_TYPE_PROMISCUOUS \
-                        |USB_CDC_PACKET_TYPE_DIRECTED)
+                        |USB_CDC_PACKET_TYPE_ALL_MULTICAST \
+                        |USB_CDC_PACKET_TYPE_PROMISCUOUS \
+                        |USB_CDC_PACKET_TYPE_DIRECTED)
 
 
 /*-------------------------------------------------------------------------*/
@@ -318,7 +318,7 @@ static inline int rndis_active(struct eth_dev *dev)
 #define DEFAULT_QLEN    2       /* double buffering by default */
 
 /* peak bulk transfer bits-per-second */
-#define HS_BPS          (13 * 512 * 8 * 1000 * 8)
+#define HS_BPS          (13 * 512 * 8 * 1000 * 8)
 #define FS_BPS          (19 *  64 * 1 * 1000 * 8)
 
 #ifdef CONFIG_USB_GADGET_DUALSPEED
@@ -466,7 +466,7 @@ eth_config = {
 };
 
 #ifdef  CONFIG_USB_ETH_RNDIS
-static struct usb_config_descriptor 
+static struct usb_config_descriptor
 rndis_config = {
         .bLength =              sizeof rndis_config,
         .bDescriptorType =      USB_DT_CONFIG,
@@ -511,7 +511,7 @@ static const struct usb_interface_descriptor
 rndis_control_intf = {
         .bLength =              sizeof rndis_control_intf,
         .bDescriptorType =      USB_DT_INTERFACE,
-          
+
         .bInterfaceNumber =     0,
         .bNumEndpoints =        1,
         .bInterfaceClass =      USB_CLASS_COMM,
@@ -545,20 +545,20 @@ static const struct usb_cdc_union_desc union_desc = {
 #ifdef  CONFIG_USB_ETH_RNDIS
 
 static const struct usb_cdc_call_mgmt_descriptor call_mgmt_descriptor = {
-        .bLength =              sizeof call_mgmt_descriptor,
-        .bDescriptorType =      USB_DT_CS_INTERFACE,
-        .bDescriptorSubType =   USB_CDC_CALL_MANAGEMENT_TYPE,
+        .bLength =              sizeof call_mgmt_descriptor,
+        .bDescriptorType =      USB_DT_CS_INTERFACE,
+        .bDescriptorSubType =   USB_CDC_CALL_MANAGEMENT_TYPE,
 
-        .bmCapabilities =       0x00,
-        .bDataInterface =       0x01,
+        .bmCapabilities =       0x00,
+        .bDataInterface =       0x01,
 };
 
 static const struct usb_cdc_acm_descriptor acm_descriptor = {
-        .bLength =              sizeof acm_descriptor,
-        .bDescriptorType =      USB_DT_CS_INTERFACE,
-        .bDescriptorSubType =   USB_CDC_ACM_TYPE,
+        .bLength =              sizeof acm_descriptor,
+        .bDescriptorType =      USB_DT_CS_INTERFACE,
+        .bDescriptorSubType =   USB_CDC_ACM_TYPE,
 
-        .bmCapabilities =       0x00,
+        .bmCapabilities =       0x00,
 };
 
 #endif
@@ -595,7 +595,7 @@ static const struct usb_cdc_ether_desc ether_desc = {
  * RNDIS requires the status endpoint, since it uses that encapsulation
  * mechanism for its funky RPC scheme.
  */
- 
+
 #define LOG2_STATUS_INTERVAL_MSEC       5       /* 1 << 5 == 32 msec */
 #define STATUS_BYTECOUNT                16      /* 8 byte header + data */
 
@@ -978,7 +978,7 @@ set_ether_config (struct eth_dev *dev, gfp_t gfp_flags)
 
                 result = usb_ep_enable (dev->status_ep, dev->status);
                 if (result != 0) {
-                        DEBUG (dev, "enable %s --> %d\n", 
+                        DEBUG (dev, "enable %s --> %d\n",
                                 dev->status_ep->name, result);
                         goto done;
                 }
@@ -1002,15 +1002,15 @@ set_ether_config (struct eth_dev *dev, gfp_t gfp_flags)
         if (!cdc_active(dev)) {
                 result = usb_ep_enable (dev->in_ep, dev->in);
                 if (result != 0) {
-                        DEBUG(dev, "enable %s --> %d\n", 
+                        DEBUG(dev, "enable %s --> %d\n",
                                 dev->in_ep->name, result);
                         goto done;
                 }
 
                 result = usb_ep_enable (dev->out_ep, dev->out);
                 if (result != 0) {
-                        DEBUG (dev, "enable %s --> %d\n", 
-                                dev->in_ep->name, result);
+                        DEBUG (dev, "enable %s --> %d\n",
+                                dev->out_ep->name, result);
                         goto done;
                 }
         }
@@ -1144,7 +1144,7 @@ eth_set_config (struct eth_dev *dev, unsigned number, gfp_t gfp_flags)
 #ifdef CONFIG_USB_GADGET_DUALSPEED
                 case USB_SPEED_HIGH:    speed = "high"; break;
 #endif
-                default:                speed = "?"; break;
+                default:                speed = "?"; break;
                 }
 
                 dev->config = number;
@@ -1206,7 +1206,7 @@ static void issue_start_status (struct eth_dev *dev)
         struct usb_request              *req = dev->stat_req;
         struct usb_cdc_notification     *event;
         int                             value;
- 
+
         DEBUG (dev, "%s, flush old status first\n", __FUNCTION__);
 
         /* flush old status
@@ -1268,7 +1268,7 @@ static void rndis_command_complete (struct usb_ep *ep, struct usb_request *req)
 {
         struct eth_dev          *dev = ep->driver_data;
         int                     status;
-        
+
         /* received RNDIS command from USB_CDC_SEND_ENCAPSULATED_COMMAND */
         spin_lock(&dev->lock);
         status = rndis_msg_parser (dev->rndis_config, (u8 *) req->buf);
@@ -1472,7 +1472,7 @@ done_set_intf:
 
 #endif /* DEV_CONFIG_CDC */
 
-#ifdef CONFIG_USB_ETH_RNDIS             
+#ifdef CONFIG_USB_ETH_RNDIS
         /* RNDIS uses the CDC command encapsulation mechanism to implement
          * an RPC scheme, with much getting/setting of attributes by OID.
          */
@@ -1489,7 +1489,7 @@ done_set_intf:
                 req->complete = rndis_command_complete;
                 /* later, rndis_control_ack () sends a notification */
                 break;
-                
+
         case USB_CDC_GET_ENCAPSULATED_RESPONSE:
                 if ((USB_DIR_IN|USB_TYPE_CLASS|USB_RECIP_INTERFACE)
                                         == ctrl->bRequestType
@@ -1641,7 +1641,7 @@ rx_submit (struct eth_dev *dev, struct usb_request *req, gfp_t gfp_flags)
                 DEBUG (dev, "no rx skb\n");
                 goto enomem;
         }
-        
+
         /* Some platforms perform better when IP packets are aligned,
          * but on at least one, checksumming fails otherwise.  Note:
          * RNDIS headers involve variable numbers of LE32 values.
@@ -1720,7 +1720,7 @@ quiesce:
         case -EOVERFLOW:
                 dev->stats.rx_over_errors++;
                 // FALLTHROUGH
-            
+
         default:
                 dev->stats.rx_errors++;
                 DEBUG (dev, "rx status %d\n", status);
@@ -1915,7 +1915,7 @@ static int eth_start_xmit (struct sk_buff *skb, struct net_device *net)
                                 sizeof (struct rndis_packet_msg_type));
                 if (!skb_rndis)
                         goto drop;
-        
+
                 dev_kfree_skb_any (skb);
                 skb = skb_rndis;
                 rndis_add_hdr (skb);
@@ -2001,7 +2001,7 @@ static int rndis_control_ack (struct net_device *net)
         struct eth_dev          *dev = netdev_priv(net);
         u32                     length;
         struct usb_request      *resp = dev->stat_req;
-        
+
         /* in case RNDIS calls this after disconnect */
         if (!dev->status) {
                 DEBUG (dev, "status ENODEV\n");
@@ -2021,16 +2021,16 @@ static int rndis_control_ack (struct net_device *net)
         resp->length = 8;
         resp->complete = rndis_control_ack_complete;
         resp->context = dev;
-        
+
         *((__le32 *) resp->buf) = __constant_cpu_to_le32 (1);
         *((__le32 *) resp->buf + 1) = __constant_cpu_to_le32 (0);
-        
+
         length = usb_ep_queue (dev->status_ep, resp, GFP_ATOMIC);
         if (length < 0) {
                 resp->status = 0;
                 rndis_control_ack_complete (dev->status_ep, resp);
         }
-        
+
         return 0;
 }
 
@@ -2047,7 +2047,7 @@ static void eth_start (struct eth_dev *dev, gfp_t gfp_flags)
         /* fill the rx queue */
         rx_fill (dev, gfp_flags);
 
-        /* and open the tx floodgates */ 
+        /* and open the tx floodgates */
         atomic_set (&dev->tx_qlen, 0);
         netif_wake_queue (dev->net);
         if (rndis_active(dev)) {
@@ -2076,7 +2076,7 @@ static int eth_stop (struct net_device *net)
         netif_stop_queue (net);
 
         DEBUG (dev, "stop stats: rx/tx %ld/%ld, errs %ld/%ld\n",
-                dev->stats.rx_packets, dev->stats.tx_packets, 
+                dev->stats.rx_packets, dev->stats.tx_packets,
                 dev->stats.rx_errors, dev->stats.tx_errors
                 );
 
@@ -2095,7 +2095,7 @@ static int eth_stop (struct net_device *net)
                         usb_ep_enable (dev->status_ep, dev->status);
                 }
         }
-        
+
         if (rndis_active(dev)) {
                 rndis_set_param_medium (dev->rndis_config,
                                         NDIS_MEDIUM_802_3, 0);
@@ -2301,7 +2301,7 @@ autoconf_fail:
                 return -ENODEV;
         }
         in_ep->driver_data = in_ep;     /* claim */
-        
+
         out_ep = usb_ep_autoconfig (gadget, &fs_sink_desc);
         if (!out_ep)
                 goto autoconf_fail;
@@ -2374,8 +2374,8 @@ autoconf_fail:
 #endif
         }
 
-        net = alloc_etherdev (sizeof *dev);
-        if (!net)
+        net = alloc_etherdev (sizeof *dev);
+        if (!net)
                 return status;
         dev = netdev_priv(net);
         spin_lock_init (&dev->lock);
@@ -2454,7 +2454,7 @@ autoconf_fail:
         dev->gadget = gadget;
         set_gadget_data (gadget, dev);
         gadget->ep0->driver_data = dev;
-        
+
         /* two kinds of host-initiated state changes:
          *  - iff DATA transfer is active, carrier is "on"
          *  - tx queueing enabled if open *and* carrier is "on"
@@ -2462,8 +2462,8 @@ autoconf_fail:
         netif_stop_queue (dev->net);
         netif_carrier_off (dev->net);
 
-        SET_NETDEV_DEV (dev->net, &gadget->dev);
-        status = register_netdev (dev->net);
+        SET_NETDEV_DEV (dev->net, &gadget->dev);
+        status = register_netdev (dev->net);
         if (status < 0)
                 goto fail1;
 
@@ -2488,7 +2488,7 @@ autoconf_fail:
                 u32     vendorID = 0;
 
                 /* FIXME RNDIS vendor id == "vendor NIC code" == ? */
-                
+
                 dev->rndis_config = rndis_register (rndis_control_ack);
                 if (dev->rndis_config < 0) {
 fail0:
@@ -2496,7 +2496,7 @@ fail0:
                         status = -ENODEV;
                         goto fail;
                 }
-                
+
                 /* these set up a lot of the OIDs that RNDIS needs */
                 rndis_set_host_mac (dev->rndis_config, dev->host_mac);
                 if (rndis_set_param_dev (dev->rndis_config, dev->net,
@@ -2556,7 +2556,7 @@ static struct usb_gadget_driver eth_driver = {
         .suspend        = eth_suspend,
         .resume         = eth_resume,
 
-        .driver         = {
+        .driver = {
                 .name           = (char *) shortname,
                 .owner          = THIS_MODULE,
         },
diff --git a/drivers/usb/gadget/file_storage.c b/drivers/usb/gadget/file_storage.c
index 6f887478b148..a43dc908ac59 100644
--- a/drivers/usb/gadget/file_storage.c
+++ b/drivers/usb/gadget/file_storage.c
@@ -1906,7 +1906,6 @@ static int fsync_sub(struct lun *curlun)
 
         inode = filp->f_dentry->d_inode;
         mutex_lock(&inode->i_mutex);
-        current->flags |= PF_SYNCWRITE;
         rc = filemap_fdatawrite(inode->i_mapping);
         err = filp->f_op->fsync(filp, filp->f_dentry, 1);
         if (!rc)
@@ -1914,7 +1913,6 @@ static int fsync_sub(struct lun *curlun)
         err = filemap_fdatawait(inode->i_mapping);
         if (!rc)
                 rc = err;
-        current->flags &= ~PF_SYNCWRITE;
         mutex_unlock(&inode->i_mutex);
         VLDBG(curlun, "fdatasync -> %d\n", rc);
         return rc;
diff --git a/drivers/usb/gadget/goku_udc.c b/drivers/usb/gadget/goku_udc.c
index 66b81bbf6bee..5378c1757292 100644
--- a/drivers/usb/gadget/goku_udc.c
+++ b/drivers/usb/gadget/goku_udc.c
@@ -1850,7 +1850,6 @@ static int goku_probe(struct pci_dev *pdev, const struct pci_device_id *id)
         unsigned long           resource, len;
         void __iomem            *base = NULL;
         int                     retval;
-        char                    buf [8], *bufp;
 
         /* if you want to support more than one controller in a system,
          * usb_gadget_driver_{register,unregister}() must change.
@@ -1913,20 +1912,14 @@ static int goku_probe(struct pci_dev *pdev, const struct pci_device_id *id)
         pci_set_drvdata(pdev, dev);
         INFO(dev, "%s\n", driver_desc);
         INFO(dev, "version: " DRIVER_VERSION " %s\n", dmastr());
-#ifndef __sparc__
-        scnprintf(buf, sizeof buf, "%d", pdev->irq);
-        bufp = buf;
-#else
-        bufp = __irq_itoa(pdev->irq);
-#endif
-        INFO(dev, "irq %s, pci mem %p\n", bufp, base);
+        INFO(dev, "irq %d, pci mem %p\n", pdev->irq, base);
 
         /* init to known state, then setup irqs */
         udc_reset(dev);
         udc_reinit (dev);
         if (request_irq(pdev->irq, goku_irq, SA_SHIRQ/*|SA_SAMPLE_RANDOM*/,
                         driver_name, dev) != 0) {
-                DBG(dev, "request interrupt %s failed\n", bufp);
+                DBG(dev, "request interrupt %d failed\n", pdev->irq);
                 retval = -EBUSY;
                 goto done;
         }
diff --git a/drivers/usb/gadget/inode.c b/drivers/usb/gadget/inode.c
index 0eb010a3f5bc..3bdc5e3ba234 100644
--- a/drivers/usb/gadget/inode.c
+++ b/drivers/usb/gadget/inode.c
@@ -528,7 +528,7 @@ struct kiocb_priv {
         struct usb_request      *req;
         struct ep_data          *epdata;
         void                    *buf;
-        char __user             *ubuf;
+        char __user             *ubuf;          /* NULL for writes */
         unsigned                actual;
 };
 
@@ -566,7 +566,6 @@ static ssize_t ep_aio_read_retry(struct kiocb *iocb)
                 status = priv->actual;
         kfree(priv->buf);
         kfree(priv);
-        aio_put_req(iocb);
         return status;
 }
 
@@ -580,8 +579,8 @@ static void ep_aio_complete(struct usb_ep *ep, struct usb_request *req)
         spin_lock(&epdata->dev->lock);
         priv->req = NULL;
         priv->epdata = NULL;
-        if (NULL == iocb->ki_retry
-                        || unlikely(0 == req->actual)
+        if (priv->ubuf == NULL
+                        || unlikely(req->actual == 0)
                         || unlikely(kiocbIsCancelled(iocb))) {
                 kfree(req->buf);
                 kfree(priv);
@@ -618,7 +617,7 @@ ep_aio_rwtail(
         char __user     *ubuf
 )
 {
-        struct kiocb_priv       *priv = (void *) &iocb->private;
+        struct kiocb_priv       *priv;
         struct usb_request      *req;
         ssize_t                 value;
 
@@ -670,7 +669,7 @@ fail:
                 kfree(priv);
                 put_ep(epdata);
         } else
-                value = -EIOCBQUEUED;
+                value = (ubuf ? -EIOCBRETRY : -EIOCBQUEUED);
         return value;
 }
 
@@ -1039,7 +1038,7 @@ scan:
                 /* ep0 can't deliver events when STATE_SETUP */
                 for (i = 0; i < n; i++) {
                         if (dev->event [i].type == GADGETFS_SETUP) {
-                                len = n = i + 1;
+                                len = i + 1;
                                 len *= sizeof (struct usb_gadgetfs_event);
                                 n = 0;
                                 break;
@@ -1587,13 +1586,13 @@ gadgetfs_create_file (struct super_block *sb, char const *name,
 static int activate_ep_files (struct dev_data *dev)
 {
         struct usb_ep   *ep;
+        struct ep_data  *data;
 
         gadget_for_each_ep (ep, dev->gadget) {
-                struct ep_data  *data;
 
                 data = kzalloc(sizeof(*data), GFP_KERNEL);
                 if (!data)
-                        goto enomem;
+                        goto enomem0;
                 data->state = STATE_EP_DISABLED;
                 init_MUTEX (&data->lock);
                 init_waitqueue_head (&data->wait);
@@ -1608,21 +1607,23 @@ static int activate_ep_files (struct dev_data *dev)
 
                 data->req = usb_ep_alloc_request (ep, GFP_KERNEL);
                 if (!data->req)
-                        goto enomem;
+                        goto enomem1;
 
                 data->inode = gadgetfs_create_file (dev->sb, data->name,
                                 data, &ep_config_operations,
                                 &data->dentry);
-                if (!data->inode) {
-                        usb_ep_free_request(ep, data->req);
-                        kfree (data);
-                        goto enomem;
-                }
+                if (!data->inode)
+                        goto enomem2;
                 list_add_tail (&data->epfiles, &dev->epfiles);
         }
         return 0;
 
-enomem:
+enomem2:
+        usb_ep_free_request (ep, data->req);
+enomem1:
+        put_dev (dev);
+        kfree (data);
+enomem0:
         DBG (dev, "%s enomem\n", __FUNCTION__);
         destroy_ep_files (dev);
         return -ENOMEM;
@@ -1793,7 +1794,7 @@ static struct usb_gadget_driver probe_driver = {
  *
  * After initialization, the device stays active for as long as that
  * $CHIP file is open.  Events may then be read from that descriptor,
- * such configuration notifications.  More complex drivers will handle
+ * such as configuration notifications.  More complex drivers will handle
  * some control requests in user space.
  */
 
@@ -2033,12 +2034,10 @@ gadgetfs_fill_super (struct super_block *sb, void *opts, int silent)
                         NULL, &simple_dir_operations,
                         S_IFDIR | S_IRUGO | S_IXUGO);
         if (!inode)
-                return -ENOMEM;
+                goto enomem0;
         inode->i_op = &simple_dir_inode_operations;
-        if (!(d = d_alloc_root (inode))) {
-                iput (inode);
-                return -ENOMEM;
-        }
+        if (!(d = d_alloc_root (inode)))
+                goto enomem1;
         sb->s_root = d;
 
         /* the ep0 file is named after the controller we expect;
@@ -2046,29 +2045,36 @@ gadgetfs_fill_super (struct super_block *sb, void *opts, int silent)
          */
         dev = dev_new ();
         if (!dev)
-                return -ENOMEM;
+                goto enomem2;
 
         dev->sb = sb;
-        if (!(inode = gadgetfs_create_file (sb, CHIP,
+        if (!gadgetfs_create_file (sb, CHIP,
                                 dev, &dev_init_operations,
-                                &dev->dentry))) {
-                put_dev(dev);
-                return -ENOMEM;
-        }
+                                &dev->dentry))
+                goto enomem3;
 
         /* other endpoint files are available after hardware setup,
          * from binding to a controller.
          */
         the_device = dev;
         return 0;
+
+enomem3:
+        put_dev (dev);
+enomem2:
+        dput (d);
+enomem1:
+        iput (inode);
+enomem0:
+        return -ENOMEM;
 }
 
 /* "mount -t gadgetfs path /dev/gadget" ends up here */
-static struct super_block *
+static int
 gadgetfs_get_sb (struct file_system_type *t, int flags,
-                const char *path, void *opts)
+                const char *path, void *opts, struct vfsmount *mnt)
 {
-        return get_sb_single (t, flags, opts, gadgetfs_fill_super);
+        return get_sb_single (t, flags, opts, gadgetfs_fill_super, mnt);
 }
 
 static void
diff --git a/drivers/usb/gadget/net2280.c b/drivers/usb/gadget/net2280.c
index 0b9293493957..1facdea56a8a 100644
--- a/drivers/usb/gadget/net2280.c
+++ b/drivers/usb/gadget/net2280.c
@@ -2822,7 +2822,6 @@ static int net2280_probe (struct pci_dev *pdev, const struct pci_device_id *id)
         unsigned long           resource, len;
         void                    __iomem *base = NULL;
         int                     retval, i;
-        char                    buf [8], *bufp;
 
         /* if you want to support more than one controller in a system,
          * usb_gadget_driver_{register,unregister}() must change.
@@ -2896,15 +2895,10 @@ static int net2280_probe (struct pci_dev *pdev, const struct pci_device_id *id)
                 retval = -ENODEV;
                 goto done;
         }
-#ifndef __sparc__
-        scnprintf (buf, sizeof buf, "%d", pdev->irq);
-        bufp = buf;
-#else
-        bufp = __irq_itoa(pdev->irq);
-#endif
+
         if (request_irq (pdev->irq, net2280_irq, SA_SHIRQ, driver_name, dev)
                         != 0) {
-                ERROR (dev, "request interrupt %s failed\n", bufp);
+                ERROR (dev, "request interrupt %d failed\n", pdev->irq);
                 retval = -EBUSY;
                 goto done;
         }
@@ -2953,8 +2947,8 @@ static int net2280_probe (struct pci_dev *pdev, const struct pci_device_id *id)
 
         /* done */
         INFO (dev, "%s\n", driver_desc);
-        INFO (dev, "irq %s, pci mem %p, chip rev %04x\n",
-                        bufp, base, dev->chiprev);
+        INFO (dev, "irq %d, pci mem %p, chip rev %04x\n",
+                        pdev->irq, base, dev->chiprev);
         INFO (dev, "version: " DRIVER_VERSION "; dma %s\n",
                         use_dma
                                 ? (use_dma_chaining ? "chaining" : "enabled")
@@ -2972,6 +2966,22 @@ done:
         return retval;
 }
 
+/* make sure the board is quiescent; otherwise it will continue
+ * generating IRQs across the upcoming reboot.
+ */
+
+static void net2280_shutdown (struct pci_dev *pdev)
+{
+        struct net2280          *dev = pci_get_drvdata (pdev);
+
+        /* disable IRQs */
+        writel (0, &dev->regs->pciirqenb0);
+        writel (0, &dev->regs->pciirqenb1);
+
+        /* disable the pullup so the host will think we're gone */
+        writel (0, &dev->usb->usbctl);
+}
+
 
 /*-------------------------------------------------------------------------*/
 
@@ -3001,6 +3011,7 @@ static struct pci_driver net2280_pci_driver = {
 
         .probe =        net2280_probe,
         .remove =       net2280_remove,
+        .shutdown =     net2280_shutdown,
 
         /* FIXME add power management support */
 };
diff --git a/drivers/usb/gadget/pxa2xx_udc.c b/drivers/usb/gadget/pxa2xx_udc.c
index 680f7fc5b171..269ce7f4ad66 100644
--- a/drivers/usb/gadget/pxa2xx_udc.c
+++ b/drivers/usb/gadget/pxa2xx_udc.c
@@ -53,12 +53,14 @@
 #include <asm/mach-types.h>
 #include <asm/unaligned.h>
 #include <asm/hardware.h>
+#ifdef CONFIG_ARCH_PXA
 #include <asm/arch/pxa-regs.h>
+#endif
 
 #include <linux/usb_ch9.h>
 #include <linux/usb_gadget.h>
 
-#include <asm/arch/udc.h>
+#include <asm/arch/hardware/intel_udc.h>
 
 
 /*
@@ -545,6 +547,7 @@ write_ep0_fifo (struct pxa2xx_ep *ep, struct pxa2xx_request *req)
                 count = req->req.length;
                 done (ep, req, 0);
                 ep0_idle(ep->dev);
+#ifndef CONFIG_ARCH_IXP4XX
 #if 1
                 /* This seems to get rid of lost status irqs in some cases:
                  * host responds quickly, or next request involves config
@@ -565,6 +568,7 @@ write_ep0_fifo (struct pxa2xx_ep *ep, struct pxa2xx_request *req)
                         } while (count);
                 }
 #endif
+#endif
         } else if (ep->dev->req_pending)
                 ep0start(ep->dev, 0, "IN");
         return is_short;
@@ -1585,7 +1589,7 @@ int usb_gadget_register_driver(struct usb_gadget_driver *driver)
         int                     retval;
 
         if (!driver
-                        || driver->speed != USB_SPEED_FULL
+                        || driver->speed < USB_SPEED_FULL
                         || !driver->bind
                         || !driver->unbind
                         || !driver->disconnect
@@ -2427,6 +2431,7 @@ static struct pxa2xx_udc memory = {
 #define PXA210_B1               0x00000123
 #define PXA210_B0               0x00000122
 #define IXP425_A0               0x000001c1
+#define IXP465_AD               0x00000200
 
 /*
  *      probe - binds to the platform device
@@ -2463,6 +2468,8 @@ static int __init pxa2xx_udc_probe(struct platform_device *pdev)
                 break;
 #elif   defined(CONFIG_ARCH_IXP4XX)
         case IXP425_A0:
+        case IXP465_AD:
+                dev->has_cfr = 1;
                 out_dma = 0;
                 break;
 #endif
@@ -2575,10 +2582,12 @@ static int __exit pxa2xx_udc_remove(struct platform_device *pdev)
                 free_irq(IRQ_USB, dev);
                 dev->got_irq = 0;
         }
+#ifdef CONFIG_ARCH_LUBBOCK
         if (machine_is_lubbock()) {
                 free_irq(LUBBOCK_USB_DISC_IRQ, dev);
                 free_irq(LUBBOCK_USB_IRQ, dev);
         }
+#endif
         platform_set_drvdata(pdev, NULL);
         the_controller = NULL;
         return 0;
diff --git a/drivers/usb/gadget/rndis.c b/drivers/usb/gadget/rndis.c
index 6d6eaad73968..3ff6db7828a0 100644
--- a/drivers/usb/gadget/rndis.c
+++ b/drivers/usb/gadget/rndis.c
@@ -1,23 +1,23 @@
-/* 
+/*
  * RNDIS MSG parser
- * 
+ *
  * Version:     $Id: rndis.c,v 1.19 2004/03/25 21:33:46 robert Exp $
- * 
+ *
  * Authors:     Benedikt Spranger, Pengutronix
- *              Robert Schwebel, Pengutronix
- * 
+ *              Robert Schwebel, Pengutronix
+ *
  *              This program is free software; you can redistribute it and/or
  *              modify it under the terms of the GNU General Public License
- *              version 2, as published by the Free Software Foundation. 
- * 
+ *              version 2, as published by the Free Software Foundation.
+ *
  *              This software was originally developed in conformance with
  *              Microsoft's Remote NDIS Specification License Agreement.
- *              
+ *
  * 03/12/2004 Kai-Uwe Bloem <linux-development@auerswald.de>
  *              Fixed message length bug in init_response
- * 
+ *
  * 03/25/2004 Kai-Uwe Bloem <linux-development@auerswald.de>
- *              Fixed rndis_rm_hdr length bug.
+ *              Fixed rndis_rm_hdr length bug.
  *
  * Copyright (C) 2004 by David Brownell
  *              updates to merge with Linux 2.6, better match RNDIS spec
@@ -82,7 +82,7 @@ static rndis_resp_t *rndis_add_response (int configNr, u32 length);
 
 
 /* supported OIDs */
-static const u32 oid_supported_list [] = 
+static const u32 oid_supported_list [] =
 {
         /* the general stuff */
         OID_GEN_SUPPORTED_LIST,
@@ -103,7 +103,7 @@ static const u32 oid_supported_list [] =
 #if 0
         OID_GEN_RNDIS_CONFIG_PARAMETER,
 #endif
-        
+
         /* the statistical stuff */
         OID_GEN_XMIT_OK,
         OID_GEN_RCV_OK,
@@ -127,14 +127,14 @@ static const u32 oid_supported_list [] =
         OID_GEN_TRANSMIT_QUEUE_LENGTH,
 #endif  /* RNDIS_OPTIONAL_STATS */
 
-        /* mandatory 802.3 */
+        /* mandatory 802.3 */
         /* the general stuff */
         OID_802_3_PERMANENT_ADDRESS,
         OID_802_3_CURRENT_ADDRESS,
         OID_802_3_MULTICAST_LIST,
         OID_802_3_MAC_OPTIONS,
         OID_802_3_MAXIMUM_LIST_SIZE,
-        
+
         /* the statistical stuff */
         OID_802_3_RCV_ERROR_ALIGNMENT,
         OID_802_3_XMIT_ONE_COLLISION,
@@ -172,8 +172,8 @@ static int
 gen_ndis_query_resp (int configNr, u32 OID, u8 *buf, unsigned buf_len,
                 rndis_resp_t *r)
 {
-        int                     retval = -ENOTSUPP;
-        u32                     length = 4;     /* usually */
+        int                     retval = -ENOTSUPP;
+        u32                     length = 4;     /* usually */
         __le32                  *outbuf;
         int                     i, count;
         rndis_query_cmplt_type  *resp;
@@ -211,27 +211,27 @@ gen_ndis_query_resp (int configNr, u32 OID, u8 *buf, unsigned buf_len,
                         outbuf[i] = cpu_to_le32 (oid_supported_list[i]);
                 retval = 0;
                 break;
-                
+
         /* mandatory */
         case OID_GEN_HARDWARE_STATUS:
                 DEBUG("%s: OID_GEN_HARDWARE_STATUS\n", __FUNCTION__);
-                /* Bogus question! 
+                /* Bogus question!
                  * Hardware must be ready to receive high level protocols.
-                 * BTW: 
+                 * BTW:
                  * reddite ergo quae sunt Caesaris Caesari
                  * et quae sunt Dei Deo!
                  */
                 *outbuf = __constant_cpu_to_le32 (0);
                 retval = 0;
                 break;
-                
+
         /* mandatory */
         case OID_GEN_MEDIA_SUPPORTED:
                 DEBUG("%s: OID_GEN_MEDIA_SUPPORTED\n", __FUNCTION__);
                 *outbuf = cpu_to_le32 (rndis_per_dev_params [configNr].medium);
                 retval = 0;
                 break;
-                
+
         /* mandatory */
         case OID_GEN_MEDIA_IN_USE:
                 DEBUG("%s: OID_GEN_MEDIA_IN_USE\n", __FUNCTION__);
@@ -239,7 +239,7 @@ gen_ndis_query_resp (int configNr, u32 OID, u8 *buf, unsigned buf_len,
                 *outbuf = cpu_to_le32 (rndis_per_dev_params [configNr].medium);
                 retval = 0;
                 break;
-                
+
         /* mandatory */
         case OID_GEN_MAXIMUM_FRAME_SIZE:
                 DEBUG("%s: OID_GEN_MAXIMUM_FRAME_SIZE\n", __FUNCTION__);
@@ -249,7 +249,7 @@ gen_ndis_query_resp (int configNr, u32 OID, u8 *buf, unsigned buf_len,
                         retval = 0;
                 }
                 break;
-                
+
         /* mandatory */
         case OID_GEN_LINK_SPEED:
                 if (rndis_debug > 1)
@@ -272,7 +272,7 @@ gen_ndis_query_resp (int configNr, u32 OID, u8 *buf, unsigned buf_len,
                         retval = 0;
                 }
                 break;
-                
+
         /* mandatory */
         case OID_GEN_RECEIVE_BLOCK_SIZE:
                 DEBUG("%s: OID_GEN_RECEIVE_BLOCK_SIZE\n", __FUNCTION__);
@@ -282,7 +282,7 @@ gen_ndis_query_resp (int configNr, u32 OID, u8 *buf, unsigned buf_len,
                         retval = 0;
                 }
                 break;
-                
+
         /* mandatory */
         case OID_GEN_VENDOR_ID:
                 DEBUG("%s: OID_GEN_VENDOR_ID\n", __FUNCTION__);
@@ -290,7 +290,7 @@ gen_ndis_query_resp (int configNr, u32 OID, u8 *buf, unsigned buf_len,
                         rndis_per_dev_params [configNr].vendorID);
                 retval = 0;
                 break;
-                
+
         /* mandatory */
         case OID_GEN_VENDOR_DESCRIPTION:
                 DEBUG("%s: OID_GEN_VENDOR_DESCRIPTION\n", __FUNCTION__);
@@ -356,7 +356,7 @@ gen_ndis_query_resp (int configNr, u32 OID, u8 *buf, unsigned buf_len,
                         DEBUG("%s: OID_GEN_XMIT_OK\n", __FUNCTION__);
                 if (rndis_per_dev_params [configNr].stats) {
                         *outbuf = cpu_to_le32 (
-                            rndis_per_dev_params [configNr].stats->tx_packets - 
+                            rndis_per_dev_params [configNr].stats->tx_packets -
                             rndis_per_dev_params [configNr].stats->tx_errors -
                             rndis_per_dev_params [configNr].stats->tx_dropped);
                         retval = 0;
@@ -369,13 +369,13 @@ gen_ndis_query_resp (int configNr, u32 OID, u8 *buf, unsigned buf_len,
                         DEBUG("%s: OID_GEN_RCV_OK\n", __FUNCTION__);
                 if (rndis_per_dev_params [configNr].stats) {
                         *outbuf = cpu_to_le32 (
-                            rndis_per_dev_params [configNr].stats->rx_packets - 
+                            rndis_per_dev_params [configNr].stats->rx_packets -
                             rndis_per_dev_params [configNr].stats->rx_errors -
                             rndis_per_dev_params [configNr].stats->rx_dropped);
                         retval = 0;
                 }
                 break;
-                
+
         /* mandatory */
         case OID_GEN_XMIT_ERROR:
                 if (rndis_debug > 1)
@@ -386,7 +386,7 @@ gen_ndis_query_resp (int configNr, u32 OID, u8 *buf, unsigned buf_len,
                         retval = 0;
                 }
                 break;
-                
+
         /* mandatory */
         case OID_GEN_RCV_ERROR:
                 if (rndis_debug > 1)
@@ -397,7 +397,7 @@ gen_ndis_query_resp (int configNr, u32 OID, u8 *buf, unsigned buf_len,
                         retval = 0;
                 }
                 break;
-                
+
         /* mandatory */
         case OID_GEN_RCV_NO_BUFFER:
                 DEBUG("%s: OID_GEN_RCV_NO_BUFFER\n", __FUNCTION__);
@@ -411,7 +411,7 @@ gen_ndis_query_resp (int configNr, u32 OID, u8 *buf, unsigned buf_len,
 #ifdef  RNDIS_OPTIONAL_STATS
         case OID_GEN_DIRECTED_BYTES_XMIT:
                 DEBUG("%s: OID_GEN_DIRECTED_BYTES_XMIT\n", __FUNCTION__);
-                /* 
+                /*
                  * Aunt Tilly's size of shoes
                  * minus antarctica count of penguins
                  * divided by weight of Alpha Centauri
@@ -419,7 +419,7 @@ gen_ndis_query_resp (int configNr, u32 OID, u8 *buf, unsigned buf_len,
                 if (rndis_per_dev_params [configNr].stats) {
                         *outbuf = cpu_to_le32 (
                                 (rndis_per_dev_params [configNr]
-                                        .stats->tx_packets - 
+                                        .stats->tx_packets -
                                  rndis_per_dev_params [configNr]
                                          .stats->tx_errors -
                                  rndis_per_dev_params [configNr]
@@ -428,14 +428,14 @@ gen_ndis_query_resp (int configNr, u32 OID, u8 *buf, unsigned buf_len,
                         retval = 0;
                 }
                 break;
-                
+
         case OID_GEN_DIRECTED_FRAMES_XMIT:
                 DEBUG("%s: OID_GEN_DIRECTED_FRAMES_XMIT\n", __FUNCTION__);
                 /* dito */
                 if (rndis_per_dev_params [configNr].stats) {
                         *outbuf = cpu_to_le32 (
                                 (rndis_per_dev_params [configNr]
-                                        .stats->tx_packets - 
+                                        .stats->tx_packets -
                                  rndis_per_dev_params [configNr]
                                          .stats->tx_errors -
                                  rndis_per_dev_params [configNr]
@@ -444,7 +444,7 @@ gen_ndis_query_resp (int configNr, u32 OID, u8 *buf, unsigned buf_len,
                         retval = 0;
                 }
                 break;
-                
+
         case OID_GEN_MULTICAST_BYTES_XMIT:
                 DEBUG("%s: OID_GEN_MULTICAST_BYTES_XMIT\n", __FUNCTION__);
                 if (rndis_per_dev_params [configNr].stats) {
@@ -453,7 +453,7 @@ gen_ndis_query_resp (int configNr, u32 OID, u8 *buf, unsigned buf_len,
                         retval = 0;
                 }
                 break;
-                
+
         case OID_GEN_MULTICAST_FRAMES_XMIT:
                 DEBUG("%s: OID_GEN_MULTICAST_FRAMES_XMIT\n", __FUNCTION__);
                 if (rndis_per_dev_params [configNr].stats) {
@@ -462,7 +462,7 @@ gen_ndis_query_resp (int configNr, u32 OID, u8 *buf, unsigned buf_len,
                         retval = 0;
                 }
                 break;
-                
+
         case OID_GEN_BROADCAST_BYTES_XMIT:
                 DEBUG("%s: OID_GEN_BROADCAST_BYTES_XMIT\n", __FUNCTION__);
                 if (rndis_per_dev_params [configNr].stats) {
@@ -471,7 +471,7 @@ gen_ndis_query_resp (int configNr, u32 OID, u8 *buf, unsigned buf_len,
                         retval = 0;
                 }
                 break;
-                
+
         case OID_GEN_BROADCAST_FRAMES_XMIT:
                 DEBUG("%s: OID_GEN_BROADCAST_FRAMES_XMIT\n", __FUNCTION__);
                 if (rndis_per_dev_params [configNr].stats) {
@@ -480,19 +480,19 @@ gen_ndis_query_resp (int configNr, u32 OID, u8 *buf, unsigned buf_len,
                         retval = 0;
                 }
                 break;
-                
+
         case OID_GEN_DIRECTED_BYTES_RCV:
                 DEBUG("%s: OID_GEN_DIRECTED_BYTES_RCV\n", __FUNCTION__);
                 *outbuf = __constant_cpu_to_le32 (0);
                 retval = 0;
                 break;
-                
+
         case OID_GEN_DIRECTED_FRAMES_RCV:
                 DEBUG("%s: OID_GEN_DIRECTED_FRAMES_RCV\n", __FUNCTION__);
                 *outbuf = __constant_cpu_to_le32 (0);
                 retval = 0;
                 break;
-                
+
         case OID_GEN_MULTICAST_BYTES_RCV:
                 DEBUG("%s: OID_GEN_MULTICAST_BYTES_RCV\n", __FUNCTION__);
                 if (rndis_per_dev_params [configNr].stats) {
@@ -501,7 +501,7 @@ gen_ndis_query_resp (int configNr, u32 OID, u8 *buf, unsigned buf_len,
                         retval = 0;
                 }
                 break;
-                
+
         case OID_GEN_MULTICAST_FRAMES_RCV:
                 DEBUG("%s: OID_GEN_MULTICAST_FRAMES_RCV\n", __FUNCTION__);
                 if (rndis_per_dev_params [configNr].stats) {
@@ -510,7 +510,7 @@ gen_ndis_query_resp (int configNr, u32 OID, u8 *buf, unsigned buf_len,
                         retval = 0;
                 }
                 break;
-                
+
         case OID_GEN_BROADCAST_BYTES_RCV:
                 DEBUG("%s: OID_GEN_BROADCAST_BYTES_RCV\n", __FUNCTION__);
                 if (rndis_per_dev_params [configNr].stats) {
@@ -519,7 +519,7 @@ gen_ndis_query_resp (int configNr, u32 OID, u8 *buf, unsigned buf_len,
                         retval = 0;
                 }
                 break;
-                
+
         case OID_GEN_BROADCAST_FRAMES_RCV:
                 DEBUG("%s: OID_GEN_BROADCAST_FRAMES_RCV\n", __FUNCTION__);
                 if (rndis_per_dev_params [configNr].stats) {
@@ -528,7 +528,7 @@ gen_ndis_query_resp (int configNr, u32 OID, u8 *buf, unsigned buf_len,
                         retval = 0;
                 }
                 break;
-                
+
         case OID_GEN_RCV_CRC_ERROR:
                 DEBUG("%s: OID_GEN_RCV_CRC_ERROR\n", __FUNCTION__);
                 if (rndis_per_dev_params [configNr].stats) {
@@ -537,7 +537,7 @@ gen_ndis_query_resp (int configNr, u32 OID, u8 *buf, unsigned buf_len,
                         retval = 0;
                 }
                 break;
-                
+
         case OID_GEN_TRANSMIT_QUEUE_LENGTH:
                 DEBUG("%s: OID_GEN_TRANSMIT_QUEUE_LENGTH\n", __FUNCTION__);
                 *outbuf = __constant_cpu_to_le32 (0);
@@ -558,7 +558,7 @@ gen_ndis_query_resp (int configNr, u32 OID, u8 *buf, unsigned buf_len,
                         retval = 0;
                 }
                 break;
-                
+
         /* mandatory */
         case OID_802_3_CURRENT_ADDRESS:
                 DEBUG("%s: OID_802_3_CURRENT_ADDRESS\n", __FUNCTION__);
@@ -570,7 +570,7 @@ gen_ndis_query_resp (int configNr, u32 OID, u8 *buf, unsigned buf_len,
                         retval = 0;
                 }
                 break;
-                
+
         /* mandatory */
         case OID_802_3_MULTICAST_LIST:
                 DEBUG("%s: OID_802_3_MULTICAST_LIST\n", __FUNCTION__);
@@ -578,7 +578,7 @@ gen_ndis_query_resp (int configNr, u32 OID, u8 *buf, unsigned buf_len,
                 *outbuf = __constant_cpu_to_le32 (0xE0000000);
                 retval = 0;
                 break;
-                
+
         /* mandatory */
         case OID_802_3_MAXIMUM_LIST_SIZE:
                 DEBUG("%s: OID_802_3_MAXIMUM_LIST_SIZE\n", __FUNCTION__);
@@ -586,7 +586,7 @@ gen_ndis_query_resp (int configNr, u32 OID, u8 *buf, unsigned buf_len,
                 *outbuf = __constant_cpu_to_le32 (1);
                 retval = 0;
                 break;
-                
+
         case OID_802_3_MAC_OPTIONS:
                 DEBUG("%s: OID_802_3_MAC_OPTIONS\n", __FUNCTION__);
                 break;
@@ -602,56 +602,56 @@ gen_ndis_query_resp (int configNr, u32 OID, u8 *buf, unsigned buf_len,
                         retval = 0;
                 }
                 break;
-                
+
         /* mandatory */
         case OID_802_3_XMIT_ONE_COLLISION:
                 DEBUG("%s: OID_802_3_XMIT_ONE_COLLISION\n", __FUNCTION__);
                 *outbuf = __constant_cpu_to_le32 (0);
                 retval = 0;
                 break;
-                
+
         /* mandatory */
         case OID_802_3_XMIT_MORE_COLLISIONS:
                 DEBUG("%s: OID_802_3_XMIT_MORE_COLLISIONS\n", __FUNCTION__);
                 *outbuf = __constant_cpu_to_le32 (0);
                 retval = 0;
                 break;
-                
+
 #ifdef  RNDIS_OPTIONAL_STATS
         case OID_802_3_XMIT_DEFERRED:
                 DEBUG("%s: OID_802_3_XMIT_DEFERRED\n", __FUNCTION__);
                 /* TODO */
                 break;
-                
+
         case OID_802_3_XMIT_MAX_COLLISIONS:
                 DEBUG("%s: OID_802_3_XMIT_MAX_COLLISIONS\n", __FUNCTION__);
                 /* TODO */
                 break;
-                
+
         case OID_802_3_RCV_OVERRUN:
                 DEBUG("%s: OID_802_3_RCV_OVERRUN\n", __FUNCTION__);
                 /* TODO */
                 break;
-                
+
         case OID_802_3_XMIT_UNDERRUN:
                 DEBUG("%s: OID_802_3_XMIT_UNDERRUN\n", __FUNCTION__);
                 /* TODO */
                 break;
-                
+
         case OID_802_3_XMIT_HEARTBEAT_FAILURE:
                 DEBUG("%s: OID_802_3_XMIT_HEARTBEAT_FAILURE\n", __FUNCTION__);
                 /* TODO */
                 break;
-                
+
         case OID_802_3_XMIT_TIMES_CRS_LOST:
                 DEBUG("%s: OID_802_3_XMIT_TIMES_CRS_LOST\n", __FUNCTION__);
                 /* TODO */
                 break;
-                
+
         case OID_802_3_XMIT_LATE_COLLISIONS:
                 DEBUG("%s: OID_802_3_XMIT_LATE_COLLISIONS\n", __FUNCTION__);
                 /* TODO */
-                break;          
+                break;
 #endif  /* RNDIS_OPTIONAL_STATS */
 
 #ifdef  RNDIS_PM
@@ -676,23 +676,23 @@ gen_ndis_query_resp (int configNr, u32 OID, u8 *buf, unsigned buf_len,
 #endif
 
         default:
-                printk (KERN_WARNING "%s: query unknown OID 0x%08X\n", 
+                printk (KERN_WARNING "%s: query unknown OID 0x%08X\n",
                          __FUNCTION__, OID);
         }
         if (retval < 0)
                 length = 0;
-        
+
         resp->InformationBufferLength = cpu_to_le32 (length);
         r->length = length + sizeof *resp;
         resp->MessageLength = cpu_to_le32 (r->length);
         return retval;
 }
 
-static int gen_ndis_set_resp (u8 configNr, u32 OID, u8 *buf, u32 buf_len, 
-                              rndis_resp_t *r)
+static int gen_ndis_set_resp (u8 configNr, u32 OID, u8 *buf, u32 buf_len,
+                        rndis_resp_t *r)
 {
         rndis_set_cmplt_type            *resp;
-        int                             i, retval = -ENOTSUPP;
+        int                             i, retval = -ENOTSUPP;
         struct rndis_params             *params;
 
         if (!r)
@@ -745,9 +745,9 @@ update_linkstate:
                         netif_stop_queue (params->dev);
                 }
                 break;
-                
+
         case OID_802_3_MULTICAST_LIST:
-                /* I think we can ignore this */                
+                /* I think we can ignore this */
                 DEBUG("%s: OID_802_3_MULTICAST_LIST\n", __FUNCTION__);
                 retval = 0;
                 break;
@@ -796,29 +796,29 @@ update_linkstate:
 #endif  /* RNDIS_PM */
 
         default:
-                printk (KERN_WARNING "%s: set unknown OID 0x%08X, size %d\n", 
+                printk (KERN_WARNING "%s: set unknown OID 0x%08X, size %d\n",
                          __FUNCTION__, OID, buf_len);
         }
-        
+
         return retval;
 }
 
-/* 
- * Response Functions 
+/*
+ * Response Functions
  */
 
 static int rndis_init_response (int configNr, rndis_init_msg_type *buf)
 {
-        rndis_init_cmplt_type   *resp; 
+        rndis_init_cmplt_type   *resp;
         rndis_resp_t            *r;
-        
+
         if (!rndis_per_dev_params [configNr].dev) return -ENOTSUPP;
-        
+
         r = rndis_add_response (configNr, sizeof (rndis_init_cmplt_type));
         if (!r)
                 return -ENOMEM;
         resp = (rndis_init_cmplt_type *) r->buf;
-        
+
         resp->MessageType = __constant_cpu_to_le32 (
                         REMOTE_NDIS_INITIALIZE_CMPLT);
         resp->MessageLength = __constant_cpu_to_le32 (52);
@@ -837,11 +837,11 @@ static int rndis_init_response (int configNr, rndis_init_msg_type *buf)
         resp->PacketAlignmentFactor = __constant_cpu_to_le32 (0);
         resp->AFListOffset = __constant_cpu_to_le32 (0);
         resp->AFListSize = __constant_cpu_to_le32 (0);
-        
+
         if (rndis_per_dev_params [configNr].ack)
-            rndis_per_dev_params [configNr].ack (
-                        rndis_per_dev_params [configNr].dev);
-        
+                rndis_per_dev_params [configNr].ack (
+                        rndis_per_dev_params [configNr].dev);
+
         return 0;
 }
 
@@ -849,10 +849,10 @@ static int rndis_query_response (int configNr, rndis_query_msg_type *buf)
 {
         rndis_query_cmplt_type *resp;
         rndis_resp_t            *r;
-        
+
         // DEBUG("%s: OID = %08X\n", __FUNCTION__, cpu_to_le32(buf->OID));
         if (!rndis_per_dev_params [configNr].dev) return -ENOTSUPP;
-        
+
         /*
          * we need more memory:
          * gen_ndis_query_resp expects enough space for
@@ -864,10 +864,10 @@ static int rndis_query_response (int configNr, rndis_query_msg_type *buf)
         if (!r)
                 return -ENOMEM;
         resp = (rndis_query_cmplt_type *) r->buf;
-        
+
         resp->MessageType = __constant_cpu_to_le32 (REMOTE_NDIS_QUERY_CMPLT);
         resp->RequestID = buf->RequestID; /* Still LE in msg buffer */
-        
+
         if (gen_ndis_query_resp (configNr, le32_to_cpu (buf->OID),
                         le32_to_cpu(buf->InformationBufferOffset)
                                         + 8 + (u8 *) buf,
@@ -881,10 +881,10 @@ static int rndis_query_response (int configNr, rndis_query_msg_type *buf)
                 resp->InformationBufferOffset = __constant_cpu_to_le32 (0);
         } else
                 resp->Status = __constant_cpu_to_le32 (RNDIS_STATUS_SUCCESS);
-        
+
         if (rndis_per_dev_params [configNr].ack)
-            rndis_per_dev_params [configNr].ack (
-                        rndis_per_dev_params [configNr].dev);
+                rndis_per_dev_params [configNr].ack (
+                        rndis_per_dev_params [configNr].dev);
         return 0;
 }
 
@@ -893,7 +893,7 @@ static int rndis_set_response (int configNr, rndis_set_msg_type *buf)
         u32                     BufLength, BufOffset;
         rndis_set_cmplt_type    *resp;
         rndis_resp_t            *r;
-        
+
         r = rndis_add_response (configNr, sizeof (rndis_set_cmplt_type));
         if (!r)
                 return -ENOMEM;
@@ -906,26 +906,27 @@ static int rndis_set_response (int configNr, rndis_set_msg_type *buf)
         DEBUG("%s: Length: %d\n", __FUNCTION__, BufLength);
         DEBUG("%s: Offset: %d\n", __FUNCTION__, BufOffset);
         DEBUG("%s: InfoBuffer: ", __FUNCTION__);
-        
+
         for (i = 0; i < BufLength; i++) {
                 DEBUG ("%02x ", *(((u8 *) buf) + i + 8 + BufOffset));
         }
-        
+
         DEBUG ("\n");
 #endif
-        
+
         resp->MessageType = __constant_cpu_to_le32 (REMOTE_NDIS_SET_CMPLT);
         resp->MessageLength = __constant_cpu_to_le32 (16);
         resp->RequestID = buf->RequestID; /* Still LE in msg buffer */
-        if (gen_ndis_set_resp (configNr, le32_to_cpu (buf->OID), 
-                               ((u8 *) buf) + 8 + BufOffset, BufLength, r))
-            resp->Status = __constant_cpu_to_le32 (RNDIS_STATUS_NOT_SUPPORTED);
-        else resp->Status = __constant_cpu_to_le32 (RNDIS_STATUS_SUCCESS);
-        
+        if (gen_ndis_set_resp (configNr, le32_to_cpu (buf->OID),
+                        ((u8 *) buf) + 8 + BufOffset, BufLength, r))
+                resp->Status = __constant_cpu_to_le32 (RNDIS_STATUS_NOT_SUPPORTED);
+        else
+                resp->Status = __constant_cpu_to_le32 (RNDIS_STATUS_SUCCESS);
+
         if (rndis_per_dev_params [configNr].ack)
-            rndis_per_dev_params [configNr].ack (
-                        rndis_per_dev_params [configNr].dev);
-        
+                rndis_per_dev_params [configNr].ack (
+                        rndis_per_dev_params [configNr].dev);
+
         return 0;
 }
 
@@ -933,27 +934,27 @@ static int rndis_reset_response (int configNr, rndis_reset_msg_type *buf)
 {
         rndis_reset_cmplt_type  *resp;
         rndis_resp_t            *r;
-        
+
         r = rndis_add_response (configNr, sizeof (rndis_reset_cmplt_type));
         if (!r)
                 return -ENOMEM;
         resp = (rndis_reset_cmplt_type *) r->buf;
-        
+
         resp->MessageType = __constant_cpu_to_le32 (REMOTE_NDIS_RESET_CMPLT);
         resp->MessageLength = __constant_cpu_to_le32 (16);
         resp->Status = __constant_cpu_to_le32 (RNDIS_STATUS_SUCCESS);
         /* resent information */
         resp->AddressingReset = __constant_cpu_to_le32 (1);
-        
+
         if (rndis_per_dev_params [configNr].ack)
-            rndis_per_dev_params [configNr].ack (
-                        rndis_per_dev_params [configNr].dev);
+                rndis_per_dev_params [configNr].ack (
+                        rndis_per_dev_params [configNr].dev);
 
         return 0;
 }
 
 static int rndis_keepalive_response (int configNr,
-                                     rndis_keepalive_msg_type *buf)
+                                rndis_keepalive_msg_type *buf)
 {
         rndis_keepalive_cmplt_type      *resp;
         rndis_resp_t                    *r;
@@ -964,48 +965,48 @@ static int rndis_keepalive_response (int configNr,
         if (!r)
                 return -ENOMEM;
         resp = (rndis_keepalive_cmplt_type *) r->buf;
-                
+
         resp->MessageType = __constant_cpu_to_le32 (
                         REMOTE_NDIS_KEEPALIVE_CMPLT);
         resp->MessageLength = __constant_cpu_to_le32 (16);
         resp->RequestID = buf->RequestID; /* Still LE in msg buffer */
         resp->Status = __constant_cpu_to_le32 (RNDIS_STATUS_SUCCESS);
-        
+
         if (rndis_per_dev_params [configNr].ack)
-            rndis_per_dev_params [configNr].ack (
-                        rndis_per_dev_params [configNr].dev);
-        
+                rndis_per_dev_params [configNr].ack (
+                        rndis_per_dev_params [configNr].dev);
+
         return 0;
 }
 
 
-/* 
- * Device to Host Comunication 
+/*
+ * Device to Host Comunication
  */
 static int rndis_indicate_status_msg (int configNr, u32 status)
 {
-        rndis_indicate_status_msg_type  *resp;  
+        rndis_indicate_status_msg_type  *resp;
         rndis_resp_t                    *r;
-        
+
         if (rndis_per_dev_params [configNr].state == RNDIS_UNINITIALIZED)
-            return -ENOTSUPP;
-        
-        r = rndis_add_response (configNr, 
+                return -ENOTSUPP;
+
+        r = rndis_add_response (configNr,
                                 sizeof (rndis_indicate_status_msg_type));
         if (!r)
                 return -ENOMEM;
         resp = (rndis_indicate_status_msg_type *) r->buf;
-        
+
         resp->MessageType = __constant_cpu_to_le32 (
                         REMOTE_NDIS_INDICATE_STATUS_MSG);
         resp->MessageLength = __constant_cpu_to_le32 (20);
         resp->Status = cpu_to_le32 (status);
         resp->StatusBufferLength = __constant_cpu_to_le32 (0);
         resp->StatusBufferOffset = __constant_cpu_to_le32 (0);
-        
-        if (rndis_per_dev_params [configNr].ack) 
-            rndis_per_dev_params [configNr].ack (
-                        rndis_per_dev_params [configNr].dev);
+
+        if (rndis_per_dev_params [configNr].ack)
+                rndis_per_dev_params [configNr].ack (
+                        rndis_per_dev_params [configNr].dev);
         return 0;
 }
 
@@ -1013,7 +1014,7 @@ int rndis_signal_connect (int configNr)
 {
         rndis_per_dev_params [configNr].media_state
                         = NDIS_MEDIA_STATE_CONNECTED;
-        return rndis_indicate_status_msg (configNr, 
+        return rndis_indicate_status_msg (configNr,
                                           RNDIS_STATUS_MEDIA_CONNECT);
 }
 
@@ -1045,26 +1046,26 @@ void rndis_set_host_mac (int configNr, const u8 *addr)
         rndis_per_dev_params [configNr].host_mac = addr;
 }
 
-/* 
- * Message Parser 
+/*
+ * Message Parser
  */
 int rndis_msg_parser (u8 configNr, u8 *buf)
 {
         u32 MsgType, MsgLength;
         __le32 *tmp;
         struct rndis_params             *params;
-        
+
         if (!buf)
                 return -ENOMEM;
-        
-        tmp = (__le32 *) buf; 
+
+        tmp = (__le32 *) buf;
         MsgType   = le32_to_cpup(tmp++);
         MsgLength = le32_to_cpup(tmp++);
-        
+
         if (configNr >= RNDIS_MAX_CONFIGS)
                 return -ENOTSUPP;
         params = &rndis_per_dev_params [configNr];
-        
+
         /* NOTE: RNDIS is *EXTREMELY* chatty ... Windows constantly polls for
          * rx/tx statistics and link status, in addition to KEEPALIVE traffic
          * and normal HC level polling to see if there's any IN traffic.
@@ -1073,12 +1074,12 @@ int rndis_msg_parser (u8 configNr, u8 *buf)
         /* For USB: responses may take up to 10 seconds */
         switch (MsgType) {
         case REMOTE_NDIS_INITIALIZE_MSG:
-                DEBUG("%s: REMOTE_NDIS_INITIALIZE_MSG\n", 
+                DEBUG("%s: REMOTE_NDIS_INITIALIZE_MSG\n",
                         __FUNCTION__ );
                 params->state = RNDIS_INITIALIZED;
                 return  rndis_init_response (configNr,
-                                             (rndis_init_msg_type *) buf);
-                
+                                        (rndis_init_msg_type *) buf);
+
         case REMOTE_NDIS_HALT_MSG:
                 DEBUG("%s: REMOTE_NDIS_HALT_MSG\n",
                         __FUNCTION__ );
@@ -1088,37 +1089,37 @@ int rndis_msg_parser (u8 configNr, u8 *buf)
                         netif_stop_queue (params->dev);
                 }
                 return 0;
-                
+
         case REMOTE_NDIS_QUERY_MSG:
-                return rndis_query_response (configNr, 
-                                             (rndis_query_msg_type *) buf);
-                
+                return rndis_query_response (configNr,
+                                        (rndis_query_msg_type *) buf);
+
         case REMOTE_NDIS_SET_MSG:
-                return rndis_set_response (configNr, 
-                                           (rndis_set_msg_type *) buf);
-                
+                return rndis_set_response (configNr,
+                                        (rndis_set_msg_type *) buf);
+
         case REMOTE_NDIS_RESET_MSG:
-                DEBUG("%s: REMOTE_NDIS_RESET_MSG\n", 
+                DEBUG("%s: REMOTE_NDIS_RESET_MSG\n",
                         __FUNCTION__ );
                 return rndis_reset_response (configNr,
-                                             (rndis_reset_msg_type *) buf);
+                                        (rndis_reset_msg_type *) buf);
 
         case REMOTE_NDIS_KEEPALIVE_MSG:
                 /* For USB: host does this every 5 seconds */
                 if (rndis_debug > 1)
-                        DEBUG("%s: REMOTE_NDIS_KEEPALIVE_MSG\n", 
+                        DEBUG("%s: REMOTE_NDIS_KEEPALIVE_MSG\n",
                                 __FUNCTION__ );
                 return rndis_keepalive_response (configNr,
-                                                 (rndis_keepalive_msg_type *) 
+                                                 (rndis_keepalive_msg_type *)
                                                  buf);
-                
-        default: 
+
+        default:
                 /* At least Windows XP emits some undefined RNDIS messages.
                  * In one case those messages seemed to relate to the host
                  * suspending itself.
                  */
                 printk (KERN_WARNING
-                        "%s: unknown RNDIS message 0x%08X len %d\n", 
+                        "%s: unknown RNDIS message 0x%08X len %d\n",
                         __FUNCTION__ , MsgType, MsgLength);
                 {
                         unsigned i;
@@ -1142,14 +1143,14 @@ int rndis_msg_parser (u8 configNr, u8 *buf)
                 }
                 break;
         }
-        
+
         return -ENOTSUPP;
 }
 
 int rndis_register (int (* rndis_control_ack) (struct net_device *))
 {
         u8 i;
-        
+
         for (i = 0; i < RNDIS_MAX_CONFIGS; i++) {
                 if (!rndis_per_dev_params [i].used) {
                         rndis_per_dev_params [i].used = 1;
@@ -1159,32 +1160,32 @@ int rndis_register (int (* rndis_control_ack) (struct net_device *))
                 }
         }
         DEBUG("failed\n");
-        
+
         return -1;
 }
 
 void rndis_deregister (int configNr)
 {
         DEBUG("%s: \n", __FUNCTION__ );
-        
+
         if (configNr >= RNDIS_MAX_CONFIGS) return;
         rndis_per_dev_params [configNr].used = 0;
-        
+
         return;
 }
 
-int rndis_set_param_dev (u8 configNr, struct net_device *dev, 
+int rndis_set_param_dev (u8 configNr, struct net_device *dev,
                          struct net_device_stats *stats,
                          u16 *cdc_filter)
 {
         DEBUG("%s:\n", __FUNCTION__ );
         if (!dev || !stats) return -1;
         if (configNr >= RNDIS_MAX_CONFIGS) return -1;
-        
+
         rndis_per_dev_params [configNr].dev = dev;
         rndis_per_dev_params [configNr].stats = stats;
         rndis_per_dev_params [configNr].filter = cdc_filter;
-        
+
         return 0;
 }
 
@@ -1193,10 +1194,10 @@ int rndis_set_param_vendor (u8 configNr, u32 vendorID, const char *vendorDescr)
         DEBUG("%s:\n", __FUNCTION__ );
         if (!vendorDescr) return -1;
         if (configNr >= RNDIS_MAX_CONFIGS) return -1;
-        
+
         rndis_per_dev_params [configNr].vendorID = vendorID;
         rndis_per_dev_params [configNr].vendorDescr = vendorDescr;
-        
+
         return 0;
 }
 
@@ -1204,10 +1205,10 @@ int rndis_set_param_medium (u8 configNr, u32 medium, u32 speed)
 {
         DEBUG("%s: %u %u\n", __FUNCTION__, medium, speed);
         if (configNr >= RNDIS_MAX_CONFIGS) return -1;
-        
+
         rndis_per_dev_params [configNr].medium = medium;
         rndis_per_dev_params [configNr].speed = speed;
-        
+
         return 0;
 }
 
@@ -1229,9 +1230,9 @@ void rndis_free_response (int configNr, u8 *buf)
 {
         rndis_resp_t            *r;
         struct list_head        *act, *tmp;
-        
-        list_for_each_safe (act, tmp, 
-                            &(rndis_per_dev_params [configNr].resp_queue))
+
+        list_for_each_safe (act, tmp,
+                        &(rndis_per_dev_params [configNr].resp_queue))
         {
                 r = list_entry (act, rndis_resp_t, list);
                 if (r && r->buf == buf) {
@@ -1244,12 +1245,12 @@ void rndis_free_response (int configNr, u8 *buf)
 u8 *rndis_get_next_response (int configNr, u32 *length)
 {
         rndis_resp_t            *r;
-        struct list_head        *act, *tmp;
-        
+        struct list_head        *act, *tmp;
+
         if (!length) return NULL;
-        
-        list_for_each_safe (act, tmp, 
-                            &(rndis_per_dev_params [configNr].resp_queue))
+
+        list_for_each_safe (act, tmp,
+                        &(rndis_per_dev_params [configNr].resp_queue))
         {
                 r = list_entry (act, rndis_resp_t, list);
                 if (!r->send) {
@@ -1258,24 +1259,24 @@ u8 *rndis_get_next_response (int configNr, u32 *length)
                         return r->buf;
                 }
         }
-        
+
         return NULL;
 }
 
 static rndis_resp_t *rndis_add_response (int configNr, u32 length)
 {
         rndis_resp_t    *r;
-        
+
         /* NOTE:  this gets copied into ether.c USB_BUFSIZ bytes ... */
         r = kmalloc (sizeof (rndis_resp_t) + length, GFP_ATOMIC);
         if (!r) return NULL;
-        
+
         r->buf = (u8 *) (r + 1);
         r->length = length;
         r->send = 0;
-        
-        list_add_tail (&r->list, 
-                       &(rndis_per_dev_params [configNr].resp_queue));
+
+        list_add_tail (&r->list,
+                &(rndis_per_dev_params [configNr].resp_queue));
         return r;
 }
 
@@ -1301,14 +1302,14 @@ int rndis_rm_hdr(struct sk_buff *skb)
 
 #ifdef  CONFIG_USB_GADGET_DEBUG_FILES
 
-static int rndis_proc_read (char *page, char **start, off_t off, int count, int *eof, 
-                     void *data)
+static int rndis_proc_read (char *page, char **start, off_t off, int count, int *eof,
+                void *data)
 {
         char *out = page;
         int len;
         rndis_params *param = (rndis_params *) data;
-        
-        out += snprintf (out, count, 
+
+        out += snprintf (out, count,
                          "Config Nr. %d\n"
                          "used      : %s\n"
                          "state     : %s\n"
@@ -1316,8 +1317,8 @@ static int rndis_proc_read (char *page, char **start, off_t off, int count, int
                          "speed     : %d\n"
                          "cable     : %s\n"
                          "vendor ID : 0x%08X\n"
-                         "vendor    : %s\n", 
-                         param->confignr, (param->used) ? "y" : "n", 
+                         "vendor    : %s\n",
+                         param->confignr, (param->used) ? "y" : "n",
                          ({ char *s = "?";
                          switch (param->state) {
                          case RNDIS_UNINITIALIZED:
@@ -1327,32 +1328,32 @@ static int rndis_proc_read (char *page, char **start, off_t off, int count, int
                          case RNDIS_DATA_INITIALIZED:
                                 s = "RNDIS_DATA_INITIALIZED"; break;
                         }; s; }),
-                         param->medium, 
-                         (param->media_state) ? 0 : param->speed*100, 
+                         param->medium,
+                         (param->media_state) ? 0 : param->speed*100,
                          (param->media_state) ? "disconnected" : "connected",
-                         param->vendorID, param->vendorDescr);      
-        
+                         param->vendorID, param->vendorDescr);
+
         len = out - page;
         len -= off;
-        
+
         if (len < count) {
                 *eof = 1;
                 if (len <= 0)
                         return 0;
         } else
                 len = count;
-        
+
         *start = page + off;
         return len;
 }
 
-static int rndis_proc_write (struct file *file, const char __user *buffer, 
-                      unsigned long count, void *data)
+static int rndis_proc_write (struct file *file, const char __user *buffer,
+                unsigned long count, void *data)
 {
         rndis_params *p = data;
         u32 speed = 0;
         int i, fl_speed = 0;
-        
+
         for (i = 0; i < count; i++) {
                 char c;
                 if (get_user(c, buffer))
@@ -1379,15 +1380,15 @@ static int rndis_proc_write (struct file *file, const char __user *buffer,
                 case 'd':
                         rndis_signal_disconnect(p->confignr);
                         break;
-                default: 
+                default:
                         if (fl_speed) p->speed = speed;
                         else DEBUG ("%c is not valid\n", c);
                         break;
                 }
-                
+
                 buffer++;
         }
-        
+
         return count;
 }
 
@@ -1408,7 +1409,7 @@ int __init rndis_init (void)
 
                 sprintf (name, NAME_TEMPLATE, i);
                 if (!(rndis_connect_state [i]
-                                = create_proc_entry (name, 0660, NULL))) 
+                                = create_proc_entry (name, 0660, NULL)))
                 {
                         DEBUG ("%s :remove entries", __FUNCTION__);
                         while (i) {
@@ -1432,7 +1433,7 @@ int __init rndis_init (void)
                                 = NDIS_MEDIA_STATE_DISCONNECTED;
                 INIT_LIST_HEAD (&(rndis_per_dev_params [i].resp_queue));
         }
-        
+
         return 0;
 }
 
@@ -1441,7 +1442,7 @@ void rndis_exit (void)
 #ifdef  CONFIG_USB_GADGET_DEBUG_FILES
         u8 i;
         char name [20];
-        
+
         for (i = 0; i < RNDIS_MAX_CONFIGS; i++) {
                 sprintf (name, NAME_TEMPLATE, i);
                 remove_proc_entry (name, NULL);
diff --git a/drivers/usb/gadget/rndis.h b/drivers/usb/gadget/rndis.h
index 95b4c6326100..2956608be751 100644
--- a/drivers/usb/gadget/rndis.h
+++ b/drivers/usb/gadget/rndis.h
@@ -1,15 +1,15 @@
-/* 
+/*
  * RNDIS        Definitions for Remote NDIS
- * 
+ *
  * Version:     $Id: rndis.h,v 1.15 2004/03/25 21:33:46 robert Exp $
- * 
+ *
  * Authors:     Benedikt Spranger, Pengutronix
- *              Robert Schwebel, Pengutronix
- * 
- *              This program is free software; you can redistribute it and/or
+ *              Robert Schwebel, Pengutronix
+ *
+ *              This program is free software; you can redistribute it and/or
  *              modify it under the terms of the GNU General Public License
- *              version 2, as published by the Free Software Foundation. 
- * 
+ *              version 2, as published by the Free Software Foundation.
+ *
  *              This software was originally developed in conformance with
  *              Microsoft's Remote NDIS Specification License Agreement.
  */
@@ -34,7 +34,7 @@
 #define RNDIS_STATUS_MEDIA_CONNECT      0x4001000BU     /* Device connected  */
 #define RNDIS_STATUS_MEDIA_DISCONNECT   0x4001000CU     /* Device disconnected */
 /* For all not specified status messages:
- * RNDIS_STATUS_Xxx -> NDIS_STATUS_Xxx 
+ * RNDIS_STATUS_Xxx -> NDIS_STATUS_Xxx
  */
 
 /* Message Set for Connectionless (802.3) Devices */
@@ -69,7 +69,7 @@
 #define OID_PNP_ENABLE_WAKE_UP                  0xFD010106
 
 
-typedef struct rndis_init_msg_type 
+typedef struct rndis_init_msg_type
 {
         __le32  MessageType;
         __le32  MessageLength;
@@ -234,12 +234,12 @@ typedef struct rndis_params
 
         const u8                *host_mac;
         u16                     *filter;
-        struct net_device       *dev;
+        struct net_device       *dev;
         struct net_device_stats *stats;
 
         u32                     vendorID;
         const char              *vendorDescr;
-        int                     (*ack) (struct net_device *);
+        int                     (*ack) (struct net_device *);
         struct list_head        resp_queue;
 } rndis_params;
 
@@ -250,7 +250,7 @@ void rndis_deregister (int configNr);
 int  rndis_set_param_dev (u8 configNr, struct net_device *dev,
                          struct net_device_stats *stats,
                          u16 *cdc_filter);
-int  rndis_set_param_vendor (u8 configNr, u32 vendorID, 
+int  rndis_set_param_vendor (u8 configNr, u32 vendorID,
                             const char *vendorDescr);
 int  rndis_set_param_medium (u8 configNr, u32 medium, u32 speed);
 void rndis_add_hdr (struct sk_buff *skb);
diff --git a/drivers/usb/gadget/serial.c b/drivers/usb/gadget/serial.c
index b992546c394d..9d6e1d295528 100644
--- a/drivers/usb/gadget/serial.c
+++ b/drivers/usb/gadget/serial.c
@@ -45,88 +45,16 @@
 #include <asm/uaccess.h>
 
 #include <linux/usb_ch9.h>
-#include <linux/usb_cdc.h>
+#include <linux/usb/cdc.h>
 #include <linux/usb_gadget.h>
 
 #include "gadget_chips.h"
 
 
-/* Wait Cond */
-
-#define __wait_cond_interruptible(wq, condition, lock, flags, ret)      \
-do {                                                                    \
-        wait_queue_t __wait;                                            \
-        init_waitqueue_entry(&__wait, current);                         \
-                                                                        \
-        add_wait_queue(&wq, &__wait);                                   \
-        for (;;) {                                                      \
-                set_current_state(TASK_INTERRUPTIBLE);                  \
-                if (condition)                                          \
-                        break;                                          \
-                if (!signal_pending(current)) {                         \
-                        spin_unlock_irqrestore(lock, flags);            \
-                        schedule();                                     \
-                        spin_lock_irqsave(lock, flags);                 \
-                        continue;                                       \
-                }                                                       \
-                ret = -ERESTARTSYS;                                     \
-                break;                                                  \
-        }                                                               \
-        current->state = TASK_RUNNING;                                  \
-        remove_wait_queue(&wq, &__wait);                                \
-} while (0)
-        
-#define wait_cond_interruptible(wq, condition, lock, flags)             \
-({                                                                      \
-        int __ret = 0;                                                  \
-        if (!(condition))                                               \
-                __wait_cond_interruptible(wq, condition, lock, flags,   \
-                                                __ret);                 \
-        __ret;                                                          \
-})
-
-#define __wait_cond_interruptible_timeout(wq, condition, lock, flags,   \
-                                                timeout, ret)           \
-do {                                                                    \
-        signed long __timeout = timeout;                                \
-        wait_queue_t __wait;                                            \
-        init_waitqueue_entry(&__wait, current);                         \
-                                                                        \
-        add_wait_queue(&wq, &__wait);                                   \
-        for (;;) {                                                      \
-                set_current_state(TASK_INTERRUPTIBLE);                  \
-                if (__timeout == 0)                                     \
-                        break;                                          \
-                if (condition)                                          \
-                        break;                                          \
-                if (!signal_pending(current)) {                         \
-                        spin_unlock_irqrestore(lock, flags);            \
-                        __timeout = schedule_timeout(__timeout);        \
-                        spin_lock_irqsave(lock, flags);                 \
-                        continue;                                       \
-                }                                                       \
-                ret = -ERESTARTSYS;                                     \
-                break;                                                  \
-        }                                                               \
-        current->state = TASK_RUNNING;                                  \
-        remove_wait_queue(&wq, &__wait);                                \
-} while (0)
-        
-#define wait_cond_interruptible_timeout(wq, condition, lock, flags,     \
-                                                timeout)                \
-({                                                                      \
-        int __ret = 0;                                                  \
-        if (!(condition))                                               \
-                __wait_cond_interruptible_timeout(wq, condition, lock,  \
-                                                flags, timeout, __ret); \
-        __ret;                                                          \
-})
-
-
 /* Defines */
 
-#define GS_VERSION_STR                  "v2.0"
-#define GS_VERSION_NUM                  0x0200
+#define GS_VERSION_STR                  "v2.2"
+#define GS_VERSION_NUM                  0x0202
 
 #define GS_LONG_NAME                    "Gadget Serial"
 #define GS_SHORT_NAME                   "g_serial"
@@ -843,9 +771,19 @@ exit_unlock_dev:
 /*
  * gs_close
  */
+
+#define GS_WRITE_FINISHED_EVENT_SAFELY(p)                       \
+({                                                              \
+        int cond;                                               \
+                                                                \
+        spin_lock_irq(&(p)->port_lock);                         \
+        cond = !(p)->port_dev || !gs_buf_data_avail((p)->port_write_buf); \
+        spin_unlock_irq(&(p)->port_lock);                       \
+        cond;                                                   \
+})
+
 static void gs_close(struct tty_struct *tty, struct file *file)
 {
-        unsigned long flags;
         struct gs_port *port = tty->driver_data;
         struct semaphore *sem;
 
@@ -859,7 +797,7 @@ static void gs_close(struct tty_struct *tty, struct file *file)
         sem = &gs_open_close_sem[port->port_num];
         down(sem);
 
-        spin_lock_irqsave(&port->port_lock, flags);
+        spin_lock_irq(&port->port_lock);
 
         if (port->port_open_count == 0) {
                 printk(KERN_ERR
@@ -887,12 +825,11 @@ static void gs_close(struct tty_struct *tty, struct file *file)
         /* wait for write buffer to drain, or */
         /* at most GS_CLOSE_TIMEOUT seconds */
         if (gs_buf_data_avail(port->port_write_buf) > 0) {
-                spin_unlock_irqrestore(&port->port_lock, flags);
-                wait_cond_interruptible_timeout(port->port_write_wait,
-                port->port_dev == NULL
-                || gs_buf_data_avail(port->port_write_buf) == 0,
-                &port->port_lock, flags, GS_CLOSE_TIMEOUT * HZ);
-                spin_lock_irqsave(&port->port_lock, flags);
+                spin_unlock_irq(&port->port_lock);
+                wait_event_interruptible_timeout(port->port_write_wait,
+                                        GS_WRITE_FINISHED_EVENT_SAFELY(port),
+                                        GS_CLOSE_TIMEOUT * HZ);
+                spin_lock_irq(&port->port_lock);
         }
 
         /* free disconnected port on final close */
@@ -912,7 +849,7 @@ static void gs_close(struct tty_struct *tty, struct file *file)
                 port->port_num, tty, file);
 
 exit:
-        spin_unlock_irqrestore(&port->port_lock, flags);
+        spin_unlock_irq(&port->port_lock);
         up(sem);
 }
 
diff --git a/drivers/usb/host/Kconfig b/drivers/usb/host/Kconfig
index e27b79a3c05f..b93d71d28db7 100644
--- a/drivers/usb/host/Kconfig
+++ b/drivers/usb/host/Kconfig
@@ -47,12 +47,29 @@ config USB_EHCI_ROOT_HUB_TT
           controller is needed.  It's safe to say "y" even if your
           controller doesn't support this feature.
 
-          This supports the EHCI implementation from TransDimension Inc.
+          This supports the EHCI implementation that's originally
+          from ARC, and has since changed hands a few times.
+
+config USB_EHCI_TT_NEWSCHED
+        bool "Improved Transaction Translator scheduling (EXPERIMENTAL)"
+        depends on USB_EHCI_HCD && EXPERIMENTAL
+        ---help---
+          This changes the periodic scheduling code to fill more of the low
+          and full speed bandwidth available from the Transaction Translator
+          (TT) in USB 2.0 hubs.  Without this, only one transfer will be
+          issued in each microframe, significantly reducing the number of
+          periodic low/fullspeed transfers possible.
+
+          If you have multiple periodic low/fullspeed devices connected to a
+          highspeed USB hub which is connected to a highspeed USB Host
+          Controller, and some of those devices will not work correctly
+          (possibly due to "ENOSPC" or "-28" errors), say Y.
+
+          If unsure, say N.
 
 config USB_ISP116X_HCD
         tristate "ISP116X HCD support"
         depends on USB
-        default N
         ---help---
           The ISP1160 and ISP1161 chips are USB host controllers. Enable this
           option if your board has this chip. If unsure, say N.
@@ -127,7 +144,6 @@ config USB_UHCI_HCD
 config USB_SL811_HCD
         tristate "SL811HS HCD support"
         depends on USB
-        default N
         help
           The SL811HS is a single-port USB controller that supports either
           host side or peripheral side roles.  Enable this option if your
@@ -140,7 +156,6 @@ config USB_SL811_HCD
 config USB_SL811_CS
         tristate "CF/PCMCIA support for SL811HS HCD"
         depends on USB_SL811_HCD && PCMCIA
-        default N
         help
           Wraps a PCMCIA driver around the SL811HS HCD, supporting the RATOC
           REX-CFU1U CF card (often used with PDAs).  If unsure, say N.
diff --git a/drivers/usb/host/ehci-au1xxx.c b/drivers/usb/host/ehci-au1xxx.c
index 63eadeec1324..9b4697add313 100644
--- a/drivers/usb/host/ehci-au1xxx.c
+++ b/drivers/usb/host/ehci-au1xxx.c
@@ -16,10 +16,6 @@
 #include <linux/platform_device.h>
 #include <asm/mach-au1x00/au1000.h>
 
-#ifndef CONFIG_SOC_AU1200
-#error "this Alchemy chip doesn't have EHCI"
-#else                           /* Au1200 */
-
 #define USB_HOST_CONFIG   (USB_MSR_BASE + USB_MSR_MCFG)
 #define USB_MCFG_PFEN     (1<<31)
 #define USB_MCFG_RDCOMB   (1<<30)
@@ -272,6 +268,8 @@ static int ehci_hcd_au1xxx_drv_resume(struct device *dev)
         return 0;
 }
 */
+MODULE_ALIAS("au1xxx-ehci");
+/* FIXME use "struct platform_driver" */
 static struct device_driver ehci_hcd_au1xxx_driver = {
         .name = "au1xxx-ehci",
         .bus = &platform_bus_type,
@@ -280,18 +278,3 @@ static struct device_driver ehci_hcd_au1xxx_driver = {
         /*.suspend      = ehci_hcd_au1xxx_drv_suspend, */
         /*.resume       = ehci_hcd_au1xxx_drv_resume, */
 };
-
-static int __init ehci_hcd_au1xxx_init(void)
-{
-        pr_debug(DRIVER_INFO " (Au1xxx)\n");
-
-        return driver_register(&ehci_hcd_au1xxx_driver);
-}
-
-static void __exit ehci_hcd_au1xxx_cleanup(void)
-{
-        driver_unregister(&ehci_hcd_au1xxx_driver);
-}
-
-module_init(ehci_hcd_au1xxx_init);
-module_exit(ehci_hcd_au1xxx_cleanup);
diff --git a/drivers/usb/host/ehci-fsl.c b/drivers/usb/host/ehci-fsl.c
index f985f121a245..a49a689bf423 100644
--- a/drivers/usb/host/ehci-fsl.c
+++ b/drivers/usb/host/ehci-fsl.c
@@ -324,43 +324,12 @@ static int ehci_fsl_drv_remove(struct platform_device *pdev)
         return 0;
 }
 
-static struct platform_driver ehci_fsl_dr_driver = {
-        .probe = ehci_fsl_drv_probe,
-        .remove = ehci_fsl_drv_remove,
-        .driver = {
-                   .name = "fsl-usb2-dr",
-                   },
-};
+MODULE_ALIAS("fsl-ehci");
 
-static struct platform_driver ehci_fsl_mph_driver = {
+static struct platform_driver ehci_fsl_driver = {
         .probe = ehci_fsl_drv_probe,
         .remove = ehci_fsl_drv_remove,
         .driver = {
-                   .name = "fsl-usb2-mph",
+                   .name = "fsl-ehci",
                    },
 };
-
-static int __init ehci_fsl_init(void)
-{
-        int retval;
-
-        pr_debug("%s: block sizes: qh %Zd qtd %Zd itd %Zd sitd %Zd\n",
-                 hcd_name,
-                 sizeof(struct ehci_qh), sizeof(struct ehci_qtd),
-                 sizeof(struct ehci_itd), sizeof(struct ehci_sitd));
-
-        retval = platform_driver_register(&ehci_fsl_dr_driver);
-        if (retval)
-                return retval;
-
-        return platform_driver_register(&ehci_fsl_mph_driver);
-}
-
-static void __exit ehci_fsl_cleanup(void)
-{
-        platform_driver_unregister(&ehci_fsl_mph_driver);
-        platform_driver_unregister(&ehci_fsl_dr_driver);
-}
-
-module_init(ehci_fsl_init);
-module_exit(ehci_fsl_cleanup);
diff --git a/drivers/usb/host/ehci-hcd.c b/drivers/usb/host/ehci-hcd.c
index 79f2d8b9bfb6..9b37e508ada3 100644
--- a/drivers/usb/host/ehci-hcd.c
+++ b/drivers/usb/host/ehci-hcd.c
@@ -889,19 +889,59 @@ MODULE_LICENSE ("GPL");
 
 #ifdef CONFIG_PCI
 #include "ehci-pci.c"
-#define EHCI_BUS_GLUED
+#define PCI_DRIVER              ehci_pci_driver
 #endif
 
 #ifdef CONFIG_PPC_83xx
 #include "ehci-fsl.c"
-#define EHCI_BUS_GLUED
+#define PLATFORM_DRIVER         ehci_fsl_driver
 #endif
 
-#ifdef CONFIG_SOC_AU1X00
+#ifdef CONFIG_SOC_AU1200
 #include "ehci-au1xxx.c"
-#define EHCI_BUS_GLUED
+#define PLATFORM_DRIVER         ehci_hcd_au1xxx_driver
 #endif
 
-#ifndef EHCI_BUS_GLUED
+#if !defined(PCI_DRIVER) && !defined(PLATFORM_DRIVER)
 #error "missing bus glue for ehci-hcd"
 #endif
+
+static int __init ehci_hcd_init(void)
+{
+        int retval = 0;
+
+        pr_debug("%s: block sizes: qh %Zd qtd %Zd itd %Zd sitd %Zd\n",
+                 hcd_name,
+                 sizeof(struct ehci_qh), sizeof(struct ehci_qtd),
+                 sizeof(struct ehci_itd), sizeof(struct ehci_sitd));
+
+#ifdef PLATFORM_DRIVER
+        retval = platform_driver_register(&PLATFORM_DRIVER);
+        if (retval < 0)
+                return retval;
+#endif
+
+#ifdef PCI_DRIVER
+        retval = pci_register_driver(&PCI_DRIVER);
+        if (retval < 0) {
+#ifdef PLATFORM_DRIVER
+                platform_driver_unregister(&PLATFORM_DRIVER);
+#endif
+        }
+#endif
+
+        return retval;
+}
+module_init(ehci_hcd_init);
+
+static void __exit ehci_hcd_cleanup(void)
+{
+#ifdef PLATFORM_DRIVER
+        platform_driver_unregister(&PLATFORM_DRIVER);
+#endif
+#ifdef PCI_DRIVER
+        pci_unregister_driver(&PCI_DRIVER);
+#endif
+}
+module_exit(ehci_hcd_cleanup);
+
diff --git a/drivers/usb/host/ehci-pci.c b/drivers/usb/host/ehci-pci.c
index a1bd2bea6deb..cadffacd945b 100644
--- a/drivers/usb/host/ehci-pci.c
+++ b/drivers/usb/host/ehci-pci.c
@@ -76,6 +76,30 @@ static int ehci_pci_setup(struct usb_hcd *hcd)
         dbg_hcs_params(ehci, "reset");
         dbg_hcc_params(ehci, "reset");
 
+        /* ehci_init() causes memory for DMA transfers to be
+         * allocated.  Thus, any vendor-specific workarounds based on
+         * limiting the type of memory used for DMA transfers must
+         * happen before ehci_init() is called. */
+        switch (pdev->vendor) {
+        case PCI_VENDOR_ID_NVIDIA:
+                /* NVidia reports that certain chips don't handle
+                 * QH, ITD, or SITD addresses above 2GB.  (But TD,
+                 * data buffer, and periodic schedule are normal.)
+                 */
+                switch (pdev->device) {
+                case 0x003c:    /* MCP04 */
+                case 0x005b:    /* CK804 */
+                case 0x00d8:    /* CK8 */
+                case 0x00e8:    /* CK8S */
+                        if (pci_set_consistent_dma_mask(pdev,
+                                                DMA_31BIT_MASK) < 0)
+                                ehci_warn(ehci, "can't enable NVidia "
+                                        "workaround for >2GB RAM\n");
+                        break;
+                }
+                break;
+        }
+
         /* cache this readonly data; minimize chip reads */
         ehci->hcs_params = readl(&ehci->caps->hcs_params);
 
@@ -88,8 +112,6 @@ static int ehci_pci_setup(struct usb_hcd *hcd)
         if (retval)
                 return retval;
 
-        /* NOTE:  only the parts below this line are PCI-specific */
-
         switch (pdev->vendor) {
         case PCI_VENDOR_ID_TDI:
                 if (pdev->device == PCI_DEVICE_ID_TDI_EHCI) {
@@ -107,19 +129,6 @@ static int ehci_pci_setup(struct usb_hcd *hcd)
                 break;
         case PCI_VENDOR_ID_NVIDIA:
                 switch (pdev->device) {
-                /* NVidia reports that certain chips don't handle
-                 * QH, ITD, or SITD addresses above 2GB.  (But TD,
-                 * data buffer, and periodic schedule are normal.)
-                 */
-                case 0x003c:    /* MCP04 */
-                case 0x005b:    /* CK804 */
-                case 0x00d8:    /* CK8 */
-                case 0x00e8:    /* CK8S */
-                        if (pci_set_consistent_dma_mask(pdev,
-                                                DMA_31BIT_MASK) < 0)
-                                ehci_warn(ehci, "can't enable NVidia "
-                                        "workaround for >2GB RAM\n");
-                        break;
                 /* Some NForce2 chips have problems with selective suspend;
                  * fixed in newer silicon.
                  */
@@ -370,23 +379,3 @@ static struct pci_driver ehci_pci_driver = {
         .resume =       usb_hcd_pci_resume,
 #endif
 };
-
-static int __init ehci_hcd_pci_init(void)
-{
-        if (usb_disabled())
-                return -ENODEV;
-
-        pr_debug("%s: block sizes: qh %Zd qtd %Zd itd %Zd sitd %Zd\n",
-                hcd_name,
-                sizeof(struct ehci_qh), sizeof(struct ehci_qtd),
-                sizeof(struct ehci_itd), sizeof(struct ehci_sitd));
-
-        return pci_register_driver(&ehci_pci_driver);
-}
-module_init(ehci_hcd_pci_init);
-
-static void __exit ehci_hcd_pci_cleanup(void)
-{
-        pci_unregister_driver(&ehci_pci_driver);
-}
-module_exit(ehci_hcd_pci_cleanup);
diff --git a/drivers/usb/host/ehci-sched.c b/drivers/usb/host/ehci-sched.c
index 5871944e6145..4859900bd135 100644
--- a/drivers/usb/host/ehci-sched.c
+++ b/drivers/usb/host/ehci-sched.c
@@ -163,6 +163,190 @@ static int same_tt (struct usb_device *dev1, struct usb_device *dev2)
                 return 1;
 }
 
+#ifdef CONFIG_USB_EHCI_TT_NEWSCHED
+
+/* Which uframe does the low/fullspeed transfer start in?
+ *
+ * The parameter is the mask of ssplits in "H-frame" terms
+ * and this returns the transfer start uframe in "B-frame" terms,
+ * which allows both to match, e.g. a ssplit in "H-frame" uframe 0
+ * will cause a transfer in "B-frame" uframe 0.  "B-frames" lag
+ * "H-frames" by 1 uframe.  See the EHCI spec sec 4.5 and figure 4.7.
+ */
+static inline unsigned char tt_start_uframe(struct ehci_hcd *ehci, __le32 mask)
+{
+        unsigned char smask = QH_SMASK & le32_to_cpu(mask);
+        if (!smask) {
+                ehci_err(ehci, "invalid empty smask!\n");
+                /* uframe 7 can't have bw so this will indicate failure */
+                return 7;
+        }
+        return ffs(smask) - 1;
+}
+
+static const unsigned char
+max_tt_usecs[] = { 125, 125, 125, 125, 125, 125, 30, 0 };
+
+/* carryover low/fullspeed bandwidth that crosses uframe boundries */
+static inline void carryover_tt_bandwidth(unsigned short tt_usecs[8])
+{
+        int i;
+        for (i=0; i<7; i++) {
+                if (max_tt_usecs[i] < tt_usecs[i]) {
+                        tt_usecs[i+1] += tt_usecs[i] - max_tt_usecs[i];
+                        tt_usecs[i] = max_tt_usecs[i];
+                }
+        }
+}
+
+/* How many of the tt's periodic downstream 1000 usecs are allocated?
+ *
+ * While this measures the bandwidth in terms of usecs/uframe,
+ * the low/fullspeed bus has no notion of uframes, so any particular
+ * low/fullspeed transfer can "carry over" from one uframe to the next,
+ * since the TT just performs downstream transfers in sequence.
+ *
+ * For example two seperate 100 usec transfers can start in the same uframe,
+ * and the second one would "carry over" 75 usecs into the next uframe.
+ */
+static void
+periodic_tt_usecs (
+        struct ehci_hcd *ehci,
+        struct usb_device *dev,
+        unsigned frame,
+        unsigned short tt_usecs[8]
+)
+{
+        __le32                  *hw_p = &ehci->periodic [frame];
+        union ehci_shadow       *q = &ehci->pshadow [frame];
+        unsigned char           uf;
+
+        memset(tt_usecs, 0, 16);
+
+        while (q->ptr) {
+                switch (Q_NEXT_TYPE(*hw_p)) {
+                case Q_TYPE_ITD:
+                        hw_p = &q->itd->hw_next;
+                        q = &q->itd->itd_next;
+                        continue;
+                case Q_TYPE_QH:
+                        if (same_tt(dev, q->qh->dev)) {
+                                uf = tt_start_uframe(ehci, q->qh->hw_info2);
+                                tt_usecs[uf] += q->qh->tt_usecs;
+                        }
+                        hw_p = &q->qh->hw_next;
+                        q = &q->qh->qh_next;
+                        continue;
+                case Q_TYPE_SITD:
+                        if (same_tt(dev, q->sitd->urb->dev)) {
+                                uf = tt_start_uframe(ehci, q->sitd->hw_uframe);
+                                tt_usecs[uf] += q->sitd->stream->tt_usecs;
+                        }
+                        hw_p = &q->sitd->hw_next;
+                        q = &q->sitd->sitd_next;
+                        continue;
+                // case Q_TYPE_FSTN:
+                default:
+                        ehci_dbg(ehci,
+                                  "ignoring periodic frame %d FSTN\n", frame);
+                        hw_p = &q->fstn->hw_next;
+                        q = &q->fstn->fstn_next;
+                }
+        }
+
+        carryover_tt_bandwidth(tt_usecs);
+
+        if (max_tt_usecs[7] < tt_usecs[7])
+                ehci_err(ehci, "frame %d tt sched overrun: %d usecs\n",
+                        frame, tt_usecs[7] - max_tt_usecs[7]);
+}
+
+/*
+ * Return true if the device's tt's downstream bus is available for a
+ * periodic transfer of the specified length (usecs), starting at the
+ * specified frame/uframe.  Note that (as summarized in section 11.19
+ * of the usb 2.0 spec) TTs can buffer multiple transactions for each
+ * uframe.
+ *
+ * The uframe parameter is when the fullspeed/lowspeed transfer
+ * should be executed in "B-frame" terms, which is the same as the
+ * highspeed ssplit's uframe (which is in "H-frame" terms).  For example
+ * a ssplit in "H-frame" 0 causes a transfer in "B-frame" 0.
+ * See the EHCI spec sec 4.5 and fig 4.7.
+ *
+ * This checks if the full/lowspeed bus, at the specified starting uframe,
+ * has the specified bandwidth available, according to rules listed
+ * in USB 2.0 spec section 11.18.1 fig 11-60.
+ *
+ * This does not check if the transfer would exceed the max ssplit
+ * limit of 16, specified in USB 2.0 spec section 11.18.4 requirement #4,
+ * since proper scheduling limits ssplits to less than 16 per uframe.
+ */
+static int tt_available (
+        struct ehci_hcd         *ehci,
+        unsigned                period,
+        struct usb_device       *dev,
+        unsigned                frame,
+        unsigned                uframe,
+        u16                     usecs
+)
+{
+        if ((period == 0) || (uframe >= 7))     /* error */
+                return 0;
+
+        for (; frame < ehci->periodic_size; frame += period) {
+                unsigned short tt_usecs[8];
+
+                periodic_tt_usecs (ehci, dev, frame, tt_usecs);
+
+                ehci_vdbg(ehci, "tt frame %d check %d usecs start uframe %d in"
+                        " schedule %d/%d/%d/%d/%d/%d/%d/%d\n",
+                        frame, usecs, uframe,
+                        tt_usecs[0], tt_usecs[1], tt_usecs[2], tt_usecs[3],
+                        tt_usecs[4], tt_usecs[5], tt_usecs[6], tt_usecs[7]);
+
+                if (max_tt_usecs[uframe] <= tt_usecs[uframe]) {
+                        ehci_vdbg(ehci, "frame %d uframe %d fully scheduled\n",
+                                frame, uframe);
+                        return 0;
+                }
+
+                /* special case for isoc transfers larger than 125us:
+                 * the first and each subsequent fully used uframe
+                 * must be empty, so as to not illegally delay
+                 * already scheduled transactions
+                 */
+                if (125 < usecs) {
+                        int ufs = (usecs / 125) - 1;
+                        int i;
+                        for (i = uframe; i < (uframe + ufs) && i < 8; i++)
+                                if (0 < tt_usecs[i]) {
+                                        ehci_vdbg(ehci,
+                                                "multi-uframe xfer can't fit "
+                                                "in frame %d uframe %d\n",
+                                                frame, i);
+                                        return 0;
+                                }
+                }
+
+                tt_usecs[uframe] += usecs;
+
+                carryover_tt_bandwidth(tt_usecs);
+
+                /* fail if the carryover pushed bw past the last uframe's limit */
+                if (max_tt_usecs[7] < tt_usecs[7]) {
+                        ehci_vdbg(ehci,
+                                "tt unavailable usecs %d frame %d uframe %d\n",
+                                usecs, frame, uframe);
+                        return 0;
+                }
+        }
+
+        return 1;
+}
+
+#else
+
 /* return true iff the device's transaction translator is available
  * for a periodic transfer starting at the specified frame, using
  * all the uframes in the mask.
@@ -237,6 +421,8 @@ static int tt_no_collision (
         return 1;
 }
 
+#endif /* CONFIG_USB_EHCI_TT_NEWSCHED */
+
 /*-------------------------------------------------------------------------*/
 
 static int enable_periodic (struct ehci_hcd *ehci)
@@ -481,7 +667,7 @@ static int check_intr_schedule (
 )
 {
         int             retval = -ENOSPC;
-        u8              mask;
+        u8              mask = 0;
 
         if (qh->c_usecs && uframe >= 6)         /* FSTN territory? */
                 goto done;
@@ -494,6 +680,24 @@ static int check_intr_schedule (
                 goto done;
         }
 
+#ifdef CONFIG_USB_EHCI_TT_NEWSCHED
+        if (tt_available (ehci, qh->period, qh->dev, frame, uframe,
+                                qh->tt_usecs)) {
+                unsigned i;
+
+                /* TODO : this may need FSTN for SSPLIT in uframe 5. */
+                for (i=uframe+1; i<8 && i<uframe+4; i++)
+                        if (!check_period (ehci, frame, i,
+                                                qh->period, qh->c_usecs))
+                                goto done;
+                        else
+                                mask |= 1 << i;
+
+                retval = 0;
+
+                *c_maskp = cpu_to_le32 (mask << 8);
+        }
+#else
         /* Make sure this tt's buffer is also available for CSPLITs.
          * We pessimize a bit; probably the typical full speed case
          * doesn't need the second CSPLIT.
@@ -514,6 +718,7 @@ static int check_intr_schedule (
                         goto done;
                 retval = 0;
         }
+#endif
 done:
         return retval;
 }
@@ -1047,12 +1252,21 @@ sitd_slot_ok (
                 frame = uframe >> 3;
                 uf = uframe & 7;
 
+#ifdef CONFIG_USB_EHCI_TT_NEWSCHED
+                /* The tt's fullspeed bus bandwidth must be available.
+                 * tt_available scheduling guarantees 10+% for control/bulk.
+                 */
+                if (!tt_available (ehci, period_uframes << 3,
+                                stream->udev, frame, uf, stream->tt_usecs))
+                        return 0;
+#else
                 /* tt must be idle for start(s), any gap, and csplit.
                  * assume scheduling slop leaves 10+% for control/bulk.
                  */
                 if (!tt_no_collision (ehci, period_uframes << 3,
                                 stream->udev, frame, mask))
                         return 0;
+#endif
 
                 /* check starts (OUT uses more than one) */
                 max_used = 100 - stream->usecs;
diff --git a/drivers/usb/host/isp116x-hcd.c b/drivers/usb/host/isp116x-hcd.c
index e99210b7909b..14386254c870 100644
--- a/drivers/usb/host/isp116x-hcd.c
+++ b/drivers/usb/host/isp116x-hcd.c
@@ -63,7 +63,7 @@
 #include <linux/init.h>
 #include <linux/list.h>
 #include <linux/usb.h>
-#include <linux/usb_isp116x.h>
+#include <linux/usb/isp116x.h>
 #include <linux/platform_device.h>
 
 #include <asm/io.h>
@@ -781,7 +781,7 @@ static int isp116x_urb_enqueue(struct usb_hcd *hcd,
                 if (ep->branch < PERIODIC_SIZE)
                         break;
 
-                ret = ep->branch = balance(isp116x, ep->period, ep->load);
+                ep->branch = ret = balance(isp116x, ep->period, ep->load);
                 if (ret < 0)
                         goto fail;
                 ret = 0;
diff --git a/drivers/usb/host/sl811-hcd.c b/drivers/usb/host/sl811-hcd.c
index a92343052751..6b4bc3f2bd86 100644
--- a/drivers/usb/host/sl811-hcd.c
+++ b/drivers/usb/host/sl811-hcd.c
@@ -46,7 +46,7 @@
 #include <linux/list.h>
 #include <linux/interrupt.h>
 #include <linux/usb.h>
-#include <linux/usb_sl811.h>
+#include <linux/usb/sl811.h>
 #include <linux/platform_device.h>
 
 #include <asm/io.h>
diff --git a/drivers/usb/host/sl811_cs.c b/drivers/usb/host/sl811_cs.c
index 302aa1ec312f..54f554e0f0ad 100644
--- a/drivers/usb/host/sl811_cs.c
+++ b/drivers/usb/host/sl811_cs.c
@@ -27,7 +27,7 @@
 #include <pcmcia/cisreg.h>
 #include <pcmcia/ds.h>
 
-#include <linux/usb_sl811.h>
+#include <linux/usb/sl811.h>
 
 MODULE_AUTHOR("Botond Botyanszki");
 MODULE_DESCRIPTION("REX-CFU1U PCMCIA driver for 2.6");
diff --git a/drivers/usb/host/uhci-debug.c b/drivers/usb/host/uhci-debug.c
index e1239319655c..6637a0e49978 100644
--- a/drivers/usb/host/uhci-debug.c
+++ b/drivers/usb/host/uhci-debug.c
@@ -98,6 +98,7 @@ static int uhci_show_urbp(struct urb_priv *urbp, char *buf, int len, int space)
         char *out = buf;
         struct uhci_td *td;
         int i, nactive, ninactive;
+        char *ptype;
 
         if (len < 200)
                 return 0;
@@ -110,13 +111,15 @@ static int uhci_show_urbp(struct urb_priv *urbp, char *buf, int len, int space)
                         (usb_pipein(urbp->urb->pipe) ? "IN" : "OUT"));
 
         switch (usb_pipetype(urbp->urb->pipe)) {
-        case PIPE_ISOCHRONOUS: out += sprintf(out, "ISO"); break;
-        case PIPE_INTERRUPT: out += sprintf(out, "INT"); break;
-        case PIPE_BULK: out += sprintf(out, "BLK"); break;
-        case PIPE_CONTROL: out += sprintf(out, "CTL"); break;
+        case PIPE_ISOCHRONOUS: ptype = "ISO"; break;
+        case PIPE_INTERRUPT: ptype = "INT"; break;
+        case PIPE_BULK: ptype = "BLK"; break;
+        default:
+        case PIPE_CONTROL: ptype = "CTL"; break;
         }
 
-        out += sprintf(out, "%s", (urbp->fsbr ? " FSBR" : ""));
+        out += sprintf(out, "%s%s", ptype, (urbp->fsbr ? " FSBR" : ""));
+        out += sprintf(out, " Actlen=%d", urbp->urb->actual_length);
 
         if (urbp->urb->status != -EINPROGRESS)
                 out += sprintf(out, " Status=%d", urbp->urb->status);
@@ -124,7 +127,8 @@ static int uhci_show_urbp(struct urb_priv *urbp, char *buf, int len, int space)
 
         i = nactive = ninactive = 0;
         list_for_each_entry(td, &urbp->td_list, list) {
-                if (++i <= 10 || debug > 2) {
+                if (urbp->qh->type != USB_ENDPOINT_XFER_ISOC &&
+                                (++i <= 10 || debug > 2)) {
                         out += sprintf(out, "%*s%d: ", space + 2, "", i);
                         out += uhci_show_td(td, out, len - (out - buf), 0);
                 } else {
@@ -147,13 +151,27 @@ static int uhci_show_qh(struct uhci_qh *qh, char *buf, int len, int space)
         char *out = buf;
         int i, nurbs;
         __le32 element = qh_element(qh);
+        char *qtype;
 
         /* Try to make sure there's enough memory */
-        if (len < 80 * 6)
+        if (len < 80 * 7)
                 return 0;
 
-        out += sprintf(out, "%*s[%p] link (%08x) element (%08x)\n", space, "",
-                        qh, le32_to_cpu(qh->link), le32_to_cpu(element));
+        switch (qh->type) {
+        case USB_ENDPOINT_XFER_ISOC: qtype = "ISO"; break;
+        case USB_ENDPOINT_XFER_INT: qtype = "INT"; break;
+        case USB_ENDPOINT_XFER_BULK: qtype = "BLK"; break;
+        case USB_ENDPOINT_XFER_CONTROL: qtype = "CTL"; break;
+        default: qtype = "Skel" ; break;
+        }
+
+        out += sprintf(out, "%*s[%p] %s QH link (%08x) element (%08x)\n",
+                        space, "", qh, qtype,
+                        le32_to_cpu(qh->link), le32_to_cpu(element));
+        if (qh->type == USB_ENDPOINT_XFER_ISOC)
+                out += sprintf(out, "%*s    period %d frame %x desc [%p]\n",
+                                space, "", qh->period, qh->iso_frame,
+                                qh->iso_packet_desc);
 
         if (element & UHCI_PTR_QH)
                 out += sprintf(out, "%*s  Element points to QH (bug?)\n", space, "");
@@ -261,7 +279,8 @@ static int uhci_show_root_hub_state(struct uhci_hcd *uhci, char *buf, int len)
             default:
                 rh_state = "?";                 break;
         }
-        out += sprintf(out, "Root-hub state: %s\n", rh_state);
+        out += sprintf(out, "Root-hub state: %s   FSBR: %d\n",
+                        rh_state, uhci->fsbr_is_on);
         return out - buf;
 }
 
@@ -275,7 +294,7 @@ static int uhci_show_status(struct uhci_hcd *uhci, char *buf, int len)
         unsigned short portsc1, portsc2;
 
         /* Try to make sure there's enough memory */
-        if (len < 80 * 6)
+        if (len < 80 * 9)
                 return 0;
 
         usbcmd    = inw(io_addr + 0);
@@ -314,6 +333,10 @@ static int uhci_show_status(struct uhci_hcd *uhci, char *buf, int len)
         out += sprintf(out, "  sof       =       %02x\n", sof);
         out += uhci_show_sc(1, portsc1, out, len - (out - buf));
         out += uhci_show_sc(2, portsc2, out, len - (out - buf));
+        out += sprintf(out, "Most recent frame: %x (%d)   "
+                        "Last ISO frame: %x (%d)\n",
+                        uhci->frame_number, uhci->frame_number & 1023,
+                        uhci->last_iso_frame, uhci->last_iso_frame & 1023);
 
         return out - buf;
 }
diff --git a/drivers/usb/host/uhci-hcd.c b/drivers/usb/host/uhci-hcd.c
index d225e11f4055..7b48567622ef 100644
--- a/drivers/usb/host/uhci-hcd.c
+++ b/drivers/usb/host/uhci-hcd.c
@@ -13,7 +13,7 @@
  * (C) Copyright 2000 Yggdrasil Computing, Inc. (port of new PCI interface
  *               support from usb-ohci.c by Adam Richter, adam@yggdrasil.com).
  * (C) Copyright 1999 Gregory P. Smith (from usb-ohci.c)
- * (C) Copyright 2004-2005 Alan Stern, stern@rowland.harvard.edu
+ * (C) Copyright 2004-2006 Alan Stern, stern@rowland.harvard.edu
  *
  * Intel documents this fairly well, and as far as I know there
  * are no royalties or anything like that, but even so there are
@@ -31,7 +31,6 @@
 #include <linux/ioport.h>
 #include <linux/sched.h>
 #include <linux/slab.h>
-#include <linux/smp_lock.h>
 #include <linux/errno.h>
 #include <linux/unistd.h>
 #include <linux/interrupt.h>
@@ -88,15 +87,6 @@ static void suspend_rh(struct uhci_hcd *uhci, enum uhci_rh_state new_state);
 static void wakeup_rh(struct uhci_hcd *uhci);
 static void uhci_get_current_frame_number(struct uhci_hcd *uhci);
 
-/* If a transfer is still active after this much time, turn off FSBR */
-#define IDLE_TIMEOUT    msecs_to_jiffies(50)
-#define FSBR_DELAY      msecs_to_jiffies(50)
-
-/* When we timeout an idle transfer for FSBR, we'll switch it over to */
-/* depth first traversal. We'll do it in groups of this number of TDs */
-/* to make sure it doesn't hog all of the bandwidth */
-#define DEPTH_INTERVAL 5
-
 #include "uhci-debug.c"
 #include "uhci-q.c"
 #include "uhci-hub.c"
@@ -120,22 +110,29 @@ static void finish_reset(struct uhci_hcd *uhci)
         uhci->is_stopped = UHCI_IS_STOPPED;
         uhci_to_hcd(uhci)->state = HC_STATE_HALT;
         uhci_to_hcd(uhci)->poll_rh = 0;
+
+        uhci->dead = 0;         /* Full reset resurrects the controller */
 }
 
 /*
  * Last rites for a defunct/nonfunctional controller
  * or one we don't want to use any more.
  */
-static void hc_died(struct uhci_hcd *uhci)
+static void uhci_hc_died(struct uhci_hcd *uhci)
 {
+        uhci_get_current_frame_number(uhci);
         uhci_reset_hc(to_pci_dev(uhci_dev(uhci)), uhci->io_addr);
         finish_reset(uhci);
-        uhci->hc_inaccessible = 1;
+        uhci->dead = 1;
+
+        /* The current frame may already be partway finished */
+        ++uhci->frame_number;
 }
 
 /*
- * Initialize a controller that was newly discovered or has just been
- * resumed.  In either case we can't be sure of its previous state.
+ * Initialize a controller that was newly discovered or has lost power
+ * or otherwise been reset while it was suspended.  In none of these cases
+ * can we be sure of its previous state.
  */
 static void check_and_reset_hc(struct uhci_hcd *uhci)
 {
@@ -155,7 +152,8 @@ static void configure_hc(struct uhci_hcd *uhci)
         outl(uhci->frame_dma_handle, uhci->io_addr + USBFLBASEADD);
 
         /* Set the current frame number */
-        outw(uhci->frame_number, uhci->io_addr + USBFRNUM);
+        outw(uhci->frame_number & UHCI_MAX_SOF_NUMBER,
+                        uhci->io_addr + USBFRNUM);
 
         /* Mark controller as not halted before we enable interrupts */
         uhci_to_hcd(uhci)->state = HC_STATE_SUSPENDED;
@@ -207,7 +205,8 @@ __acquires(uhci->lock)
         int int_enable;
 
         auto_stop = (new_state == UHCI_RH_AUTO_STOPPED);
-        dev_dbg(uhci_dev(uhci), "%s%s\n", __FUNCTION__,
+        dev_dbg(&uhci_to_hcd(uhci)->self.root_hub->dev,
+                        "%s%s\n", __FUNCTION__,
                         (auto_stop ? " (auto-stop)" : ""));
 
         /* If we get a suspend request when we're already auto-stopped
@@ -241,27 +240,27 @@ __acquires(uhci->lock)
                 spin_unlock_irq(&uhci->lock);
                 msleep(1);
                 spin_lock_irq(&uhci->lock);
-                if (uhci->hc_inaccessible)      /* Died */
+                if (uhci->dead)
                         return;
         }
         if (!(inw(uhci->io_addr + USBSTS) & USBSTS_HCH))
-                dev_warn(uhci_dev(uhci), "Controller not stopped yet!\n");
+                dev_warn(&uhci_to_hcd(uhci)->self.root_hub->dev,
+                        "Controller not stopped yet!\n");
 
         uhci_get_current_frame_number(uhci);
-        smp_wmb();
 
         uhci->rh_state = new_state;
         uhci->is_stopped = UHCI_IS_STOPPED;
         uhci_to_hcd(uhci)->poll_rh = !int_enable;
 
         uhci_scan_schedule(uhci, NULL);
+        uhci_fsbr_off(uhci);
 }
 
 static void start_rh(struct uhci_hcd *uhci)
 {
         uhci_to_hcd(uhci)->state = HC_STATE_RUNNING;
         uhci->is_stopped = 0;
-        smp_wmb();
 
         /* Mark it configured and running with a 64-byte max packet.
          * All interrupts are enabled, even though RESUME won't do anything.
@@ -278,7 +277,8 @@ static void wakeup_rh(struct uhci_hcd *uhci)
 __releases(uhci->lock)
 __acquires(uhci->lock)
 {
-        dev_dbg(uhci_dev(uhci), "%s%s\n", __FUNCTION__,
+        dev_dbg(&uhci_to_hcd(uhci)->self.root_hub->dev,
+                        "%s%s\n", __FUNCTION__,
                         uhci->rh_state == UHCI_RH_AUTO_STOPPED ?
                                 " (auto-start)" : "");
 
@@ -293,7 +293,7 @@ __acquires(uhci->lock)
                 spin_unlock_irq(&uhci->lock);
                 msleep(20);
                 spin_lock_irq(&uhci->lock);
-                if (uhci->hc_inaccessible)      /* Died */
+                if (uhci->dead)
                         return;
 
                 /* End Global Resume and wait for EOP to be sent */
@@ -345,7 +345,7 @@ static irqreturn_t uhci_irq(struct usb_hcd *hcd, struct pt_regs *regs)
                                                         errbuf, ERRBUF_LEN);
                                         lprintk(errbuf);
                                 }
-                                hc_died(uhci);
+                                uhci_hc_died(uhci);
 
                                 /* Force a callback in case there are
                                  * pending unlinks */
@@ -368,12 +368,21 @@ static irqreturn_t uhci_irq(struct usb_hcd *hcd, struct pt_regs *regs)
 
 /*
  * Store the current frame number in uhci->frame_number if the controller
- * is runnning
+ * is runnning.  Expand from 11 bits (of which we use only 10) to a
+ * full-sized integer.
+ *
+ * Like many other parts of the driver, this code relies on being polled
+ * more than once per second as long as the controller is running.
  */
 static void uhci_get_current_frame_number(struct uhci_hcd *uhci)
 {
-        if (!uhci->is_stopped)
-                uhci->frame_number = inw(uhci->io_addr + USBFRNUM);
+        if (!uhci->is_stopped) {
+                unsigned delta;
+
+                delta = (inw(uhci->io_addr + USBFRNUM) - uhci->frame_number) &
+                                (UHCI_NUMFRAMES - 1);
+                uhci->frame_number += delta;
+        }
 }
 
 /*
@@ -407,7 +416,7 @@ static void release_uhci(struct uhci_hcd *uhci)
                         uhci->frame, uhci->frame_dma_handle);
 }
 
-static int uhci_reset(struct usb_hcd *hcd)
+static int uhci_init(struct usb_hcd *hcd)
 {
         struct uhci_hcd *uhci = hcd_to_uhci(hcd);
         unsigned io_size = (unsigned) hcd->rsrc_len;
@@ -459,7 +468,7 @@ static void uhci_shutdown(struct pci_dev *pdev)
 {
         struct usb_hcd *hcd = (struct usb_hcd *) pci_get_drvdata(pdev);
 
-        hc_died(hcd_to_uhci(hcd));
+        uhci_hc_died(hcd_to_uhci(hcd));
 }
 
 /*
@@ -487,14 +496,10 @@ static int uhci_start(struct usb_hcd *hcd)
 
         hcd->uses_new_polling = 1;
 
-        uhci->fsbr = 0;
-        uhci->fsbrtimeout = 0;
-
         spin_lock_init(&uhci->lock);
-
-        INIT_LIST_HEAD(&uhci->td_remove_list);
+        setup_timer(&uhci->fsbr_timer, uhci_fsbr_timeout,
+                        (unsigned long) uhci);
         INIT_LIST_HEAD(&uhci->idle_qh_list);
-
         init_waitqueue_head(&uhci->waitqh);
 
         if (DEBUG_CONFIGURED) {
@@ -665,11 +670,12 @@ static void uhci_stop(struct usb_hcd *hcd)
         struct uhci_hcd *uhci = hcd_to_uhci(hcd);
 
         spin_lock_irq(&uhci->lock);
-        if (!uhci->hc_inaccessible)
-                hc_died(uhci);
+        if (test_bit(HCD_FLAG_HW_ACCESSIBLE, &hcd->flags) && !uhci->dead)
+                uhci_hc_died(uhci);
         uhci_scan_schedule(uhci, NULL);
         spin_unlock_irq(&uhci->lock);
 
+        del_timer_sync(&uhci->fsbr_timer);
         release_uhci(uhci);
 }
 
@@ -677,12 +683,15 @@ static void uhci_stop(struct usb_hcd *hcd)
 static int uhci_rh_suspend(struct usb_hcd *hcd)
 {
         struct uhci_hcd *uhci = hcd_to_uhci(hcd);
+        int rc = 0;
 
         spin_lock_irq(&uhci->lock);
-        if (!uhci->hc_inaccessible)             /* Not dead */
+        if (!test_bit(HCD_FLAG_HW_ACCESSIBLE, &hcd->flags))
+                rc = -ESHUTDOWN;
+        else if (!uhci->dead)
                 suspend_rh(uhci, UHCI_RH_SUSPENDED);
         spin_unlock_irq(&uhci->lock);
-        return 0;
+        return rc;
 }
 
 static int uhci_rh_resume(struct usb_hcd *hcd)
@@ -691,13 +700,10 @@ static int uhci_rh_resume(struct usb_hcd *hcd)
         int rc = 0;
 
         spin_lock_irq(&uhci->lock);
-        if (uhci->hc_inaccessible) {
-                if (uhci->rh_state == UHCI_RH_SUSPENDED) {
-                        dev_warn(uhci_dev(uhci), "HC isn't running!\n");
-                        rc = -ENODEV;
-                }
-                /* Otherwise the HC is dead */
-        } else
+        if (!test_bit(HCD_FLAG_HW_ACCESSIBLE, &hcd->flags)) {
+                dev_warn(&hcd->self.root_hub->dev, "HC isn't running!\n");
+                rc = -ESHUTDOWN;
+        } else if (!uhci->dead)
                 wakeup_rh(uhci);
         spin_unlock_irq(&uhci->lock);
         return rc;
@@ -711,8 +717,8 @@ static int uhci_suspend(struct usb_hcd *hcd, pm_message_t message)
         dev_dbg(uhci_dev(uhci), "%s\n", __FUNCTION__);
 
         spin_lock_irq(&uhci->lock);
-        if (uhci->hc_inaccessible)      /* Dead or already suspended */
-                goto done;
+        if (!test_bit(HCD_FLAG_HW_ACCESSIBLE, &hcd->flags) || uhci->dead)
+                goto done_okay;         /* Already suspended or dead */
 
         if (uhci->rh_state > UHCI_RH_SUSPENDED) {
                 dev_warn(uhci_dev(uhci), "Root hub isn't suspended!\n");
@@ -725,12 +731,12 @@ static int uhci_suspend(struct usb_hcd *hcd, pm_message_t message)
          */
         pci_write_config_word(to_pci_dev(uhci_dev(uhci)), USBLEGSUP, 0);
         mb();
-        clear_bit(HCD_FLAG_HW_ACCESSIBLE, &hcd->flags);
-        uhci->hc_inaccessible = 1;
         hcd->poll_rh = 0;
 
         /* FIXME: Enable non-PME# remote wakeup? */
 
+done_okay:
+        clear_bit(HCD_FLAG_HW_ACCESSIBLE, &hcd->flags);
 done:
         spin_unlock_irq(&uhci->lock);
         return rc;
@@ -743,24 +749,22 @@ static int uhci_resume(struct usb_hcd *hcd)
         dev_dbg(uhci_dev(uhci), "%s\n", __FUNCTION__);
 
         /* Since we aren't in D3 any more, it's safe to set this flag
-         * even if the controller was dead.  It might not even be dead
-         * any more, if the firmware or quirks code has reset it.
+         * even if the controller was dead.
          */
         set_bit(HCD_FLAG_HW_ACCESSIBLE, &hcd->flags);
         mb();
 
-        if (uhci->rh_state == UHCI_RH_RESET)    /* Dead */
-                return 0;
         spin_lock_irq(&uhci->lock);
 
         /* FIXME: Disable non-PME# remote wakeup? */
 
-        uhci->hc_inaccessible = 0;
-
-        /* The BIOS may have changed the controller settings during a
-         * system wakeup.  Check it and reconfigure to avoid problems.
+        /* The firmware or a boot kernel may have changed the controller
+         * settings during a system wakeup.  Check it and reconfigure
+         * to avoid problems.
          */
         check_and_reset_hc(uhci);
+
+        /* If the controller was dead before, it's back alive now */
         configure_hc(uhci);
 
         if (uhci->rh_state == UHCI_RH_RESET) {
@@ -810,18 +814,15 @@ done:
 static int uhci_hcd_get_frame_number(struct usb_hcd *hcd)
 {
         struct uhci_hcd *uhci = hcd_to_uhci(hcd);
-        unsigned long flags;
-        int is_stopped;
-        int frame_number;
+        unsigned frame_number;
+        unsigned delta;
 
         /* Minimize latency by avoiding the spinlock */
-        local_irq_save(flags);
-        is_stopped = uhci->is_stopped;
-        smp_rmb();
-        frame_number = (is_stopped ? uhci->frame_number :
-                        inw(uhci->io_addr + USBFRNUM));
-        local_irq_restore(flags);
-        return frame_number;
+        frame_number = uhci->frame_number;
+        barrier();
+        delta = (inw(uhci->io_addr + USBFRNUM) - frame_number) &
+                        (UHCI_NUMFRAMES - 1);
+        return frame_number + delta;
 }
 
 static const char hcd_name[] = "uhci_hcd";
@@ -836,7 +837,7 @@ static const struct hc_driver uhci_driver = {
         .flags =                HCD_USB11,
 
         /* Basic lifecycle operations */
-        .reset =                uhci_reset,
+        .reset =                uhci_init,
         .start =                uhci_start,
 #ifdef CONFIG_PM
         .suspend =              uhci_suspend,
diff --git a/drivers/usb/host/uhci-hcd.h b/drivers/usb/host/uhci-hcd.h
index d5c8f4d92823..108e3de2dc26 100644
--- a/drivers/usb/host/uhci-hcd.h
+++ b/drivers/usb/host/uhci-hcd.h
@@ -84,6 +84,13 @@
 #define CAN_SCHEDULE_FRAMES     1000    /* how far in the future frames
                                          * can be scheduled */
 
+/* When no queues need Full-Speed Bandwidth Reclamation,
+ * delay this long before turning FSBR off */
+#define FSBR_OFF_DELAY          msecs_to_jiffies(10)
+
+/* If a queue hasn't advanced after this much time, assume it is stuck */
+#define QH_WAIT_TIMEOUT         msecs_to_jiffies(200)
+
 
 /*
  *      Queue Headers
@@ -121,21 +128,31 @@ struct uhci_qh {
         __le32 element;                 /* Queue element (TD) pointer */
 
         /* Software fields */
-        dma_addr_t dma_handle;
-
         struct list_head node;          /* Node in the list of QHs */
         struct usb_host_endpoint *hep;  /* Endpoint information */
         struct usb_device *udev;
         struct list_head queue;         /* Queue of urbps for this QH */
         struct uhci_qh *skel;           /* Skeleton for this QH */
         struct uhci_td *dummy_td;       /* Dummy TD to end the queue */
+        struct uhci_td *post_td;        /* Last TD completed */
 
+        struct usb_iso_packet_descriptor *iso_packet_desc;
+                                        /* Next urb->iso_frame_desc entry */
+        unsigned long advance_jiffies;  /* Time of last queue advance */
         unsigned int unlink_frame;      /* When the QH was unlinked */
+        unsigned int period;            /* For Interrupt and Isochronous QHs */
+        unsigned int iso_frame;         /* Frame # for iso_packet_desc */
+        int iso_status;                 /* Status for Isochronous URBs */
+
         int state;                      /* QH_STATE_xxx; see above */
+        int type;                       /* Queue type (control, bulk, etc) */
+
+        dma_addr_t dma_handle;
 
         unsigned int initial_toggle:1;  /* Endpoint's current toggle value */
         unsigned int needs_fixup:1;     /* Must fix the TD toggle values */
-        unsigned int is_stopped:1;      /* Queue was stopped by an error */
+        unsigned int is_stopped:1;      /* Queue was stopped by error/unlink */
+        unsigned int wait_expired:1;    /* QH_WAIT_TIMEOUT has expired */
 } __attribute__((aligned(16)));
 
 /*
@@ -226,7 +243,6 @@ struct uhci_td {
         dma_addr_t dma_handle;
 
         struct list_head list;
-        struct list_head remove_list;
 
         int frame;                      /* for iso: what frame? */
         struct list_head fl_list;
@@ -305,38 +321,8 @@ static inline u32 td_status(struct uhci_td *td) {
 #define skel_bulk_qh            skelqh[12]
 #define skel_term_qh            skelqh[13]
 
-/*
- * Search tree for determining where <interval> fits in the skelqh[]
- * skeleton.
- *
- * An interrupt request should be placed into the slowest skelqh[]
- * which meets the interval/period/frequency requirement.
- * An interrupt request is allowed to be faster than <interval> but not slower.
- *
- * For a given <interval>, this function returns the appropriate/matching
- * skelqh[] index value.
- */
-static inline int __interval_to_skel(int interval)
-{
-        if (interval < 16) {
-                if (interval < 4) {
-                        if (interval < 2)
-                                return 9;       /* int1 for 0-1 ms */
-                        return 8;               /* int2 for 2-3 ms */
-                }
-                if (interval < 8)
-                        return 7;               /* int4 for 4-7 ms */
-                return 6;                       /* int8 for 8-15 ms */
-        }
-        if (interval < 64) {
-                if (interval < 32)
-                        return 5;               /* int16 for 16-31 ms */
-                return 4;                       /* int32 for 32-63 ms */
-        }
-        if (interval < 128)
-                return 3;                       /* int64 for 64-127 ms */
-        return 2;                               /* int128 for 128-255 ms (Max.) */
-}
+/* Find the skelqh entry corresponding to an interval exponent */
+#define UHCI_SKEL_INDEX(exponent)       (9 - exponent)
 
 
 /*
@@ -396,32 +382,32 @@ struct uhci_hcd {
         __le32 *frame;
         void **frame_cpu;               /* CPU's frame list */
 
-        int fsbr;                       /* Full-speed bandwidth reclamation */
-        unsigned long fsbrtimeout;      /* FSBR delay */
-
         enum uhci_rh_state rh_state;
         unsigned long auto_stop_time;           /* When to AUTO_STOP */
 
         unsigned int frame_number;              /* As of last check */
         unsigned int is_stopped;
 #define UHCI_IS_STOPPED         9999            /* Larger than a frame # */
+        unsigned int last_iso_frame;            /* Frame of last scan */
+        unsigned int cur_iso_frame;             /* Frame for current scan */
 
         unsigned int scan_in_progress:1;        /* Schedule scan is running */
         unsigned int need_rescan:1;             /* Redo the schedule scan */
-        unsigned int hc_inaccessible:1;         /* HC is suspended or dead */
+        unsigned int dead:1;                    /* Controller has died */
         unsigned int working_RD:1;              /* Suspended root hub doesn't
                                                    need to be polled */
         unsigned int is_initialized:1;          /* Data structure is usable */
+        unsigned int fsbr_is_on:1;              /* FSBR is turned on */
+        unsigned int fsbr_is_wanted:1;          /* Does any URB want FSBR? */
+        unsigned int fsbr_expiring:1;           /* FSBR is timing out */
+
+        struct timer_list fsbr_timer;           /* For turning off FBSR */
 
         /* Support for port suspend/resume/reset */
         unsigned long port_c_suspend;           /* Bit-arrays of ports */
         unsigned long resuming_ports;
         unsigned long ports_timeout;            /* Time to stop signalling */
 
-        /* List of TDs that are done, but waiting to be freed (race) */
-        struct list_head td_remove_list;
-        unsigned int td_remove_age;             /* Age in frames */
-
         struct list_head idle_qh_list;          /* Where the idle QHs live */
 
         int rh_numports;                        /* Number of root-hub ports */
@@ -442,6 +428,9 @@ static inline struct usb_hcd *uhci_to_hcd(struct uhci_hcd *uhci)
 
 #define uhci_dev(u)     (uhci_to_hcd(u)->self.controller)
 
+/* Utility macro for comparing frame numbers */
+#define uhci_frame_before_eq(f1, f2)    (0 <= (int) ((f2) - (f1)))
+
 
 /*
  *      Private per-URB data
@@ -454,9 +443,7 @@ struct urb_priv {
         struct uhci_qh *qh;             /* QH for this URB */
         struct list_head td_list;
 
-        unsigned fsbr : 1;              /* URB turned on FSBR */
-        unsigned short_transfer : 1;    /* URB got a short transfer, no
-                                         * need to rescan */
+        unsigned fsbr:1;                /* URB wants FSBR */
 };
 
 
diff --git a/drivers/usb/host/uhci-hub.c b/drivers/usb/host/uhci-hub.c
index c8451d9578f1..c545ef92fe29 100644
--- a/drivers/usb/host/uhci-hub.c
+++ b/drivers/usb/host/uhci-hub.c
@@ -171,9 +171,8 @@ static int uhci_hub_status_data(struct usb_hcd *hcd, char *buf)
         spin_lock_irqsave(&uhci->lock, flags);
 
         uhci_scan_schedule(uhci, NULL);
-        if (uhci->hc_inaccessible)
+        if (!test_bit(HCD_FLAG_HW_ACCESSIBLE, &hcd->flags) || uhci->dead)
                 goto done;
-        check_fsbr(uhci);
         uhci_check_ports(uhci);
 
         status = get_hub_status_data(uhci, buf);
@@ -228,7 +227,7 @@ static int uhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
         u16 wPortChange, wPortStatus;
         unsigned long flags;
 
-        if (uhci->hc_inaccessible)
+        if (!test_bit(HCD_FLAG_HW_ACCESSIBLE, &hcd->flags) || uhci->dead)
                 return -ETIMEDOUT;
 
         spin_lock_irqsave(&uhci->lock, flags);
diff --git a/drivers/usb/host/uhci-q.c b/drivers/usb/host/uhci-q.c
index a06d84c19e13..c9d72ac0a1d7 100644
--- a/drivers/usb/host/uhci-q.c
+++ b/drivers/usb/host/uhci-q.c
@@ -13,10 +13,9 @@
  * (C) Copyright 2000 Yggdrasil Computing, Inc. (port of new PCI interface
  *               support from usb-ohci.c by Adam Richter, adam@yggdrasil.com).
  * (C) Copyright 1999 Gregory P. Smith (from usb-ohci.c)
- * (C) Copyright 2004-2005 Alan Stern, stern@rowland.harvard.edu
+ * (C) Copyright 2004-2006 Alan Stern, stern@rowland.harvard.edu
  */
 
-static void uhci_free_pending_tds(struct uhci_hcd *uhci);
 
 /*
  * Technically, updating td->status here is a race, but it's not really a
@@ -38,6 +37,60 @@ static inline void uhci_clear_next_interrupt(struct uhci_hcd *uhci)
         uhci->term_td->status &= ~cpu_to_le32(TD_CTRL_IOC);
 }
 
+
+/*
+ * Full-Speed Bandwidth Reclamation (FSBR).
+ * We turn on FSBR whenever a queue that wants it is advancing,
+ * and leave it on for a short time thereafter.
+ */
+static void uhci_fsbr_on(struct uhci_hcd *uhci)
+{
+        uhci->fsbr_is_on = 1;
+        uhci->skel_term_qh->link = cpu_to_le32(
+                        uhci->skel_fs_control_qh->dma_handle) | UHCI_PTR_QH;
+}
+
+static void uhci_fsbr_off(struct uhci_hcd *uhci)
+{
+        uhci->fsbr_is_on = 0;
+        uhci->skel_term_qh->link = UHCI_PTR_TERM;
+}
+
+static void uhci_add_fsbr(struct uhci_hcd *uhci, struct urb *urb)
+{
+        struct urb_priv *urbp = urb->hcpriv;
+
+        if (!(urb->transfer_flags & URB_NO_FSBR))
+                urbp->fsbr = 1;
+}
+
+static void uhci_urbp_wants_fsbr(struct uhci_hcd *uhci, struct urb_priv *urbp)
+{
+        if (urbp->fsbr) {
+                uhci->fsbr_is_wanted = 1;
+                if (!uhci->fsbr_is_on)
+                        uhci_fsbr_on(uhci);
+                else if (uhci->fsbr_expiring) {
+                        uhci->fsbr_expiring = 0;
+                        del_timer(&uhci->fsbr_timer);
+                }
+        }
+}
+
+static void uhci_fsbr_timeout(unsigned long _uhci)
+{
+        struct uhci_hcd *uhci = (struct uhci_hcd *) _uhci;
+        unsigned long flags;
+
+        spin_lock_irqsave(&uhci->lock, flags);
+        if (uhci->fsbr_expiring) {
+                uhci->fsbr_expiring = 0;
+                uhci_fsbr_off(uhci);
+        }
+        spin_unlock_irqrestore(&uhci->lock, flags);
+}
+
+
 static struct uhci_td *uhci_alloc_td(struct uhci_hcd *uhci)
 {
         dma_addr_t dma_handle;
@@ -51,7 +104,6 @@ static struct uhci_td *uhci_alloc_td(struct uhci_hcd *uhci)
         td->frame = -1;
 
         INIT_LIST_HEAD(&td->list);
-        INIT_LIST_HEAD(&td->remove_list);
         INIT_LIST_HEAD(&td->fl_list);
 
         return td;
@@ -61,8 +113,6 @@ static void uhci_free_td(struct uhci_hcd *uhci, struct uhci_td *td)
 {
         if (!list_empty(&td->list))
                 dev_warn(uhci_dev(uhci), "td %p still in list!\n", td);
-        if (!list_empty(&td->remove_list))
-                dev_warn(uhci_dev(uhci), "td %p still in remove_list!\n", td);
         if (!list_empty(&td->fl_list))
                 dev_warn(uhci_dev(uhci), "td %p still in fl_list!\n", td);
 
@@ -77,6 +127,16 @@ static inline void uhci_fill_td(struct uhci_td *td, u32 status,
         td->buffer = cpu_to_le32(buffer);
 }
 
+static void uhci_add_td_to_urbp(struct uhci_td *td, struct urb_priv *urbp)
+{
+        list_add_tail(&td->list, &urbp->td_list);
+}
+
+static void uhci_remove_td_from_urbp(struct uhci_td *td)
+{
+        list_del_init(&td->list);
+}
+
 /*
  * We insert Isochronous URBs directly into the frame list at the beginning
  */
@@ -138,6 +198,24 @@ static inline void uhci_remove_td_from_frame_list(struct uhci_hcd *uhci,
         td->frame = -1;
 }
 
+static inline void uhci_remove_tds_from_frame(struct uhci_hcd *uhci,
+                unsigned int framenum)
+{
+        struct uhci_td *ftd, *ltd;
+
+        framenum &= (UHCI_NUMFRAMES - 1);
+
+        ftd = uhci->frame_cpu[framenum];
+        if (ftd) {
+                ltd = list_entry(ftd->fl_list.prev, struct uhci_td, fl_list);
+                uhci->frame[framenum] = ltd->link;
+                uhci->frame_cpu[framenum] = NULL;
+
+                while (!list_empty(&ftd->fl_list))
+                        list_del_init(ftd->fl_list.prev);
+        }
+}
+
 /*
  * Remove all the TDs for an Isochronous URB from the frame list
  */
@@ -148,7 +226,6 @@ static void uhci_unlink_isochronous_tds(struct uhci_hcd *uhci, struct urb *urb)
 
         list_for_each_entry(td, &urbp->td_list, list)
                 uhci_remove_td_from_frame_list(uhci, td);
-        wmb();
 }
 
 static struct uhci_qh *uhci_alloc_qh(struct uhci_hcd *uhci,
@@ -161,6 +238,7 @@ static struct uhci_qh *uhci_alloc_qh(struct uhci_hcd *uhci,
         if (!qh)
                 return NULL;
 
+        memset(qh, 0, sizeof(*qh));
         qh->dma_handle = dma_handle;
 
         qh->element = UHCI_PTR_TERM;
@@ -179,10 +257,11 @@ static struct uhci_qh *uhci_alloc_qh(struct uhci_hcd *uhci,
                 qh->hep = hep;
                 qh->udev = udev;
                 hep->hcpriv = qh;
+                qh->type = hep->desc.bmAttributes & USB_ENDPOINT_XFERTYPE_MASK;
 
         } else {                /* Skeleton QH */
                 qh->state = QH_STATE_ACTIVE;
-                qh->udev = NULL;
+                qh->type = -1;
         }
         return qh;
 }
@@ -202,35 +281,64 @@ static void uhci_free_qh(struct uhci_hcd *uhci, struct uhci_qh *qh)
 }
 
 /*
- * When the currently executing URB is dequeued, save its current toggle value
+ * When a queue is stopped and a dequeued URB is given back, adjust
+ * the previous TD link (if the URB isn't first on the queue) or
+ * save its toggle value (if it is first and is currently executing).
+ *
+ * Returns 0 if the URB should not yet be given back, 1 otherwise.
  */
-static void uhci_save_toggle(struct uhci_qh *qh, struct urb *urb)
+static int uhci_cleanup_queue(struct uhci_hcd *uhci, struct uhci_qh *qh,
+                struct urb *urb)
 {
-        struct urb_priv *urbp = (struct urb_priv *) urb->hcpriv;
+        struct urb_priv *urbp = urb->hcpriv;
         struct uhci_td *td;
+        int ret = 1;
+
+        /* Isochronous pipes don't use toggles and their TD link pointers
+         * get adjusted during uhci_urb_dequeue().  But since their queues
+         * cannot truly be stopped, we have to watch out for dequeues
+         * occurring after the nominal unlink frame. */
+        if (qh->type == USB_ENDPOINT_XFER_ISOC) {
+                ret = (uhci->frame_number + uhci->is_stopped !=
+                                qh->unlink_frame);
+                goto done;
+        }
+
+        /* If the URB isn't first on its queue, adjust the link pointer
+         * of the last TD in the previous URB.  The toggle doesn't need
+         * to be saved since this URB can't be executing yet. */
+        if (qh->queue.next != &urbp->node) {
+                struct urb_priv *purbp;
+                struct uhci_td *ptd;
+
+                purbp = list_entry(urbp->node.prev, struct urb_priv, node);
+                WARN_ON(list_empty(&purbp->td_list));
+                ptd = list_entry(purbp->td_list.prev, struct uhci_td,
+                                list);
+                td = list_entry(urbp->td_list.prev, struct uhci_td,
+                                list);
+                ptd->link = td->link;
+                goto done;
+        }
 
         /* If the QH element pointer is UHCI_PTR_TERM then then currently
          * executing URB has already been unlinked, so this one isn't it. */
-        if (qh_element(qh) == UHCI_PTR_TERM ||
-                                qh->queue.next != &urbp->node)
-                return;
+        if (qh_element(qh) == UHCI_PTR_TERM)
+                goto done;
         qh->element = UHCI_PTR_TERM;
 
-        /* Only bulk and interrupt pipes have to worry about toggles */
-        if (!(usb_pipetype(urb->pipe) == PIPE_BULK ||
-                        usb_pipetype(urb->pipe) == PIPE_INTERRUPT))
-                return;
+        /* Control pipes have to worry about toggles */
+        if (qh->type == USB_ENDPOINT_XFER_CONTROL)
+                goto done;
 
-        /* Find the first active TD; that's the device's toggle state */
-        list_for_each_entry(td, &urbp->td_list, list) {
-                if (td_status(td) & TD_CTRL_ACTIVE) {
-                        qh->needs_fixup = 1;
-                        qh->initial_toggle = uhci_toggle(td_token(td));
-                        return;
-                }
-        }
+        /* Save the next toggle value */
+        WARN_ON(list_empty(&urbp->td_list));
+        td = list_entry(urbp->td_list.next, struct uhci_td, list);
+        qh->needs_fixup = 1;
+        qh->initial_toggle = uhci_toggle(td_token(td));
 
-        WARN_ON(1);
+done:
+        return ret;
 }
 
 /*
@@ -305,6 +413,10 @@ static void uhci_activate_qh(struct uhci_hcd *uhci, struct uhci_qh *qh)
                 qh->element = cpu_to_le32(td->dma_handle);
         }
 
+        /* Treat the queue as if it has just advanced */
+        qh->wait_expired = 0;
+        qh->advance_jiffies = jiffies;
+
         if (qh->state == QH_STATE_ACTIVE)
                 return;
         qh->state = QH_STATE_ACTIVE;
@@ -370,6 +482,12 @@ static void uhci_make_qh_idle(struct uhci_hcd *uhci, struct uhci_qh *qh)
         list_move(&qh->node, &uhci->idle_qh_list);
         qh->state = QH_STATE_IDLE;
 
+        /* Now that the QH is idle, its post_td isn't being used */
+        if (qh->post_td) {
+                uhci_free_td(uhci, qh->post_td);
+                qh->post_td = NULL;
+        }
+
         /* If anyone is waiting for a QH to become idle, wake them up */
         if (uhci->num_waiting)
                 wake_up_all(&uhci->waitqh);
@@ -395,21 +513,6 @@ static inline struct urb_priv *uhci_alloc_urb_priv(struct uhci_hcd *uhci,
         return urbp;
 }
 
-static void uhci_add_td_to_urb(struct urb *urb, struct uhci_td *td)
-{
-        struct urb_priv *urbp = (struct urb_priv *)urb->hcpriv;
-
-        list_add_tail(&td->list, &urbp->td_list);
-}
-
-static void uhci_remove_td_from_urb(struct uhci_td *td)
-{
-        if (list_empty(&td->list))
-                return;
-
-        list_del_init(&td->list);
-}
-
 static void uhci_free_urb_priv(struct uhci_hcd *uhci,
                 struct urb_priv *urbp)
 {
@@ -419,48 +522,15 @@ static void uhci_free_urb_priv(struct uhci_hcd *uhci,
                 dev_warn(uhci_dev(uhci), "urb %p still on QH's list!\n",
                                 urbp->urb);
 
-        uhci_get_current_frame_number(uhci);
-        if (uhci->frame_number + uhci->is_stopped != uhci->td_remove_age) {
-                uhci_free_pending_tds(uhci);
-                uhci->td_remove_age = uhci->frame_number;
-        }
-
-        /* Check to see if the remove list is empty. Set the IOC bit */
-        /* to force an interrupt so we can remove the TDs. */
-        if (list_empty(&uhci->td_remove_list))
-                uhci_set_next_interrupt(uhci);
-
         list_for_each_entry_safe(td, tmp, &urbp->td_list, list) {
-                uhci_remove_td_from_urb(td);
-                list_add(&td->remove_list, &uhci->td_remove_list);
+                uhci_remove_td_from_urbp(td);
+                uhci_free_td(uhci, td);
         }
 
         urbp->urb->hcpriv = NULL;
         kmem_cache_free(uhci_up_cachep, urbp);
 }
 
-static void uhci_inc_fsbr(struct uhci_hcd *uhci, struct urb *urb)
-{
-        struct urb_priv *urbp = (struct urb_priv *)urb->hcpriv;
-
-        if ((!(urb->transfer_flags & URB_NO_FSBR)) && !urbp->fsbr) {
-                urbp->fsbr = 1;
-                if (!uhci->fsbr++ && !uhci->fsbrtimeout)
-                        uhci->skel_term_qh->link = cpu_to_le32(uhci->skel_fs_control_qh->dma_handle) | UHCI_PTR_QH;
-        }
-}
-
-static void uhci_dec_fsbr(struct uhci_hcd *uhci, struct urb *urb)
-{
-        struct urb_priv *urbp = (struct urb_priv *)urb->hcpriv;
-
-        if ((!(urb->transfer_flags & URB_NO_FSBR)) && urbp->fsbr) {
-                urbp->fsbr = 0;
-                if (!--uhci->fsbr)
-                        uhci->fsbrtimeout = jiffies + FSBR_DELAY;
-        }
-}
-
 /*
  * Map status to standard result codes
  *
@@ -487,7 +557,6 @@ static int uhci_map_status(int status, int dir_out)
                 return -ENOSR;
         if (status & TD_CTRL_STALLED)                   /* Stalled */
                 return -EPIPE;
-        WARN_ON(status & TD_CTRL_ACTIVE);               /* Active */
         return 0;
 }
 
@@ -503,6 +572,7 @@ static int uhci_submit_control(struct uhci_hcd *uhci, struct urb *urb,
         int len = urb->transfer_buffer_length;
         dma_addr_t data = urb->transfer_dma;
         __le32 *plink;
+        struct urb_priv *urbp = urb->hcpriv;
 
         /* The "pipe" thing contains the destination in bits 8--18 */
         destination = (urb->pipe & PIPE_DEVEP_MASK) | USB_PID_SETUP;
@@ -516,7 +586,7 @@ static int uhci_submit_control(struct uhci_hcd *uhci, struct urb *urb,
          * Build the TD for the control request setup packet
          */
         td = qh->dummy_td;
-        uhci_add_td_to_urb(urb, td);
+        uhci_add_td_to_urbp(td, urbp);
         uhci_fill_td(td, status, destination | uhci_explen(8),
                         urb->setup_dma);
         plink = &td->link;
@@ -548,7 +618,7 @@ static int uhci_submit_control(struct uhci_hcd *uhci, struct urb *urb,
                 /* Alternate Data0/1 (start with Data1) */
                 destination ^= TD_TOKEN_TOGGLE;
         
-                uhci_add_td_to_urb(urb, td);
+                uhci_add_td_to_urbp(td, urbp);
                 uhci_fill_td(td, status, destination | uhci_explen(pktsze),
                                 data);
                 plink = &td->link;
@@ -579,7 +649,7 @@ static int uhci_submit_control(struct uhci_hcd *uhci, struct urb *urb,
 
         status &= ~TD_CTRL_SPD;
 
-        uhci_add_td_to_urb(urb, td);
+        uhci_add_td_to_urbp(td, urbp);
         uhci_fill_td(td, status | TD_CTRL_IOC,
                         destination | uhci_explen(0), 0);
         plink = &td->link;
@@ -606,145 +676,19 @@ static int uhci_submit_control(struct uhci_hcd *uhci, struct urb *urb,
                 qh->skel = uhci->skel_ls_control_qh;
         else {
                 qh->skel = uhci->skel_fs_control_qh;
-                uhci_inc_fsbr(uhci, urb);
+                uhci_add_fsbr(uhci, urb);
         }
+
+        urb->actual_length = -8;        /* Account for the SETUP packet */
         return 0;
 
 nomem:
         /* Remove the dummy TD from the td_list so it doesn't get freed */
-        uhci_remove_td_from_urb(qh->dummy_td);
+        uhci_remove_td_from_urbp(qh->dummy_td);
         return -ENOMEM;
 }
 
 /*
- * If control-IN transfer was short, the status packet wasn't sent.
- * This routine changes the element pointer in the QH to point at the
- * status TD.  It's safe to do this even while the QH is live, because
- * the hardware only updates the element pointer following a successful
- * transfer.  The inactive TD for the short packet won't cause an update,
- * so the pointer won't get overwritten.  The next time the controller
- * sees this QH, it will send the status packet.
- */
-static int usb_control_retrigger_status(struct uhci_hcd *uhci, struct urb *urb)
-{
-        struct urb_priv *urbp = (struct urb_priv *)urb->hcpriv;
-        struct uhci_td *td;
-
-        urbp->short_transfer = 1;
-
-        td = list_entry(urbp->td_list.prev, struct uhci_td, list);
-        urbp->qh->element = cpu_to_le32(td->dma_handle);
-
-        return -EINPROGRESS;
-}
-
-
-static int uhci_result_control(struct uhci_hcd *uhci, struct urb *urb)
-{
-        struct list_head *tmp, *head;
-        struct urb_priv *urbp = urb->hcpriv;
-        struct uhci_td *td;
-        unsigned int status;
-        int ret = 0;
-
-        head = &urbp->td_list;
-        if (urbp->short_transfer) {
-                tmp = head->prev;
-                goto status_stage;
-        }
-
-        urb->actual_length = 0;
-
-        tmp = head->next;
-        td = list_entry(tmp, struct uhci_td, list);
-
-        /* The first TD is the SETUP stage, check the status, but skip */
-        /*  the count */
-        status = uhci_status_bits(td_status(td));
-        if (status & TD_CTRL_ACTIVE)
-                return -EINPROGRESS;
-
-        if (status)
-                goto td_error;
-
-        /* The rest of the TDs (but the last) are data */
-        tmp = tmp->next;
-        while (tmp != head && tmp->next != head) {
-                unsigned int ctrlstat;
-
-                td = list_entry(tmp, struct uhci_td, list);
-                tmp = tmp->next;
-
-                ctrlstat = td_status(td);
-                status = uhci_status_bits(ctrlstat);
-                if (status & TD_CTRL_ACTIVE)
-                        return -EINPROGRESS;
-
-                urb->actual_length += uhci_actual_length(ctrlstat);
-
-                if (status)
-                        goto td_error;
-
-                /* Check to see if we received a short packet */
-                if (uhci_actual_length(ctrlstat) <
-                                uhci_expected_length(td_token(td))) {
-                        if (urb->transfer_flags & URB_SHORT_NOT_OK) {
-                                ret = -EREMOTEIO;
-                                goto err;
-                        }
-
-                        return usb_control_retrigger_status(uhci, urb);
-                }
-        }
-
-status_stage:
-        td = list_entry(tmp, struct uhci_td, list);
-
-        /* Control status stage */
-        status = td_status(td);
-
-#ifdef I_HAVE_BUGGY_APC_BACKUPS
-        /* APC BackUPS Pro kludge */
-        /* It tries to send all of the descriptor instead of the amount */
-        /*  we requested */
-        if (status & TD_CTRL_IOC &&     /* IOC is masked out by uhci_status_bits */
-            status & TD_CTRL_ACTIVE &&
-            status & TD_CTRL_NAK)
-                return 0;
-#endif
-
-        status = uhci_status_bits(status);
-        if (status & TD_CTRL_ACTIVE)
-                return -EINPROGRESS;
-
-        if (status)
-                goto td_error;
-
-        return 0;
-
-td_error:
-        ret = uhci_map_status(status, uhci_packetout(td_token(td)));
-
-err:
-        if ((debug == 1 && ret != -EPIPE) || debug > 1) {
-                /* Some debugging code */
-                dev_dbg(uhci_dev(uhci), "%s: failed with status %x\n",
-                                __FUNCTION__, status);
-
-                if (errbuf) {
-                        /* Print the chain for debugging purposes */
-                        uhci_show_qh(urbp->qh, errbuf, ERRBUF_LEN, 0);
-                        lprintk(errbuf);
-                }
-        }
-
-        /* Note that the queue has stopped */
-        urbp->qh->element = UHCI_PTR_TERM;
-        urbp->qh->is_stopped = 1;
-        return ret;
-}
-
-/*
  * Common submit for bulk and interrupt
  */
 static int uhci_submit_common(struct uhci_hcd *uhci, struct urb *urb,
@@ -756,6 +700,7 @@ static int uhci_submit_common(struct uhci_hcd *uhci, struct urb *urb,
         int len = urb->transfer_buffer_length;
         dma_addr_t data = urb->transfer_dma;
         __le32 *plink;
+        struct urb_priv *urbp = urb->hcpriv;
         unsigned int toggle;
 
         if (len < 0)
@@ -793,7 +738,7 @@ static int uhci_submit_common(struct uhci_hcd *uhci, struct urb *urb,
                                 goto nomem;
                         *plink = cpu_to_le32(td->dma_handle);
                 }
-                uhci_add_td_to_urb(urb, td);
+                uhci_add_td_to_urbp(td, urbp);
                 uhci_fill_td(td, status,
                                 destination | uhci_explen(pktsze) |
                                         (toggle << TD_TOKEN_TOGGLE_SHIFT),
@@ -821,7 +766,7 @@ static int uhci_submit_common(struct uhci_hcd *uhci, struct urb *urb,
                         goto nomem;
                 *plink = cpu_to_le32(td->dma_handle);
 
-                uhci_add_td_to_urb(urb, td);
+                uhci_add_td_to_urbp(td, urbp);
                 uhci_fill_td(td, status,
                                 destination | uhci_explen(0) |
                                         (toggle << TD_TOKEN_TOGGLE_SHIFT),
@@ -851,6 +796,7 @@ static int uhci_submit_common(struct uhci_hcd *uhci, struct urb *urb,
         wmb();
         qh->dummy_td->status |= __constant_cpu_to_le32(TD_CTRL_ACTIVE);
         qh->dummy_td = td;
+        qh->period = urb->interval;
 
         usb_settoggle(urb->dev, usb_pipeendpoint(urb->pipe),
                         usb_pipeout(urb->pipe), toggle);
@@ -858,90 +804,10 @@ static int uhci_submit_common(struct uhci_hcd *uhci, struct urb *urb,
 
 nomem:
         /* Remove the dummy TD from the td_list so it doesn't get freed */
-        uhci_remove_td_from_urb(qh->dummy_td);
+        uhci_remove_td_from_urbp(qh->dummy_td);
         return -ENOMEM;
 }
 
-/*
- * Common result for bulk and interrupt
- */
-static int uhci_result_common(struct uhci_hcd *uhci, struct urb *urb)
-{
-        struct urb_priv *urbp = urb->hcpriv;
-        struct uhci_td *td;
-        unsigned int status = 0;
-        int ret = 0;
-
-        urb->actual_length = 0;
-
-        list_for_each_entry(td, &urbp->td_list, list) {
-                unsigned int ctrlstat = td_status(td);
-
-                status = uhci_status_bits(ctrlstat);
-                if (status & TD_CTRL_ACTIVE)
-                        return -EINPROGRESS;
-
-                urb->actual_length += uhci_actual_length(ctrlstat);
-
-                if (status)
-                        goto td_error;
-
-                if (uhci_actual_length(ctrlstat) <
-                                uhci_expected_length(td_token(td))) {
-                        if (urb->transfer_flags & URB_SHORT_NOT_OK) {
-                                ret = -EREMOTEIO;
-                                goto err;
-                        }
-
-                        /*
-                         * This URB stopped short of its end.  We have to
-                         * fix up the toggles of the following URBs on the
-                         * queue and restart the queue.
-                         *
-                         * Do this only the first time we encounter the
-                         * short URB.
-                         */
-                        if (!urbp->short_transfer) {
-                                urbp->short_transfer = 1;
-                                urbp->qh->initial_toggle =
-                                                uhci_toggle(td_token(td)) ^ 1;
-                                uhci_fixup_toggles(urbp->qh, 1);
-
-                                td = list_entry(urbp->td_list.prev,
-                                                struct uhci_td, list);
-                                urbp->qh->element = td->link;
-                        }
-                        break;
-                }
-        }
-
-        return 0;
-
-td_error:
-        ret = uhci_map_status(status, uhci_packetout(td_token(td)));
-
-        if ((debug == 1 && ret != -EPIPE) || debug > 1) {
-                /* Some debugging code */
-                dev_dbg(uhci_dev(uhci), "%s: failed with status %x\n",
-                                __FUNCTION__, status);
-
-                if (debug > 1 && errbuf) {
-                        /* Print the chain for debugging purposes */
-                        uhci_show_qh(urbp->qh, errbuf, ERRBUF_LEN, 0);
-                        lprintk(errbuf);
-                }
-        }
-err:
-
-        /* Note that the queue has stopped and save the next toggle value */
-        urbp->qh->element = UHCI_PTR_TERM;
-        urbp->qh->is_stopped = 1;
-        urbp->qh->needs_fixup = 1;
-        urbp->qh->initial_toggle = uhci_toggle(td_token(td)) ^
-                        (ret == -EREMOTEIO);
-        return ret;
-}
-
 static inline int uhci_submit_bulk(struct uhci_hcd *uhci, struct urb *urb,
                 struct uhci_qh *qh)
 {
@@ -954,22 +820,163 @@ static inline int uhci_submit_bulk(struct uhci_hcd *uhci, struct urb *urb,
         qh->skel = uhci->skel_bulk_qh;
         ret = uhci_submit_common(uhci, urb, qh);
         if (ret == 0)
-                uhci_inc_fsbr(uhci, urb);
+                uhci_add_fsbr(uhci, urb);
         return ret;
 }
 
-static inline int uhci_submit_interrupt(struct uhci_hcd *uhci, struct urb *urb,
+static int uhci_submit_interrupt(struct uhci_hcd *uhci, struct urb *urb,
                 struct uhci_qh *qh)
 {
+        int exponent;
+
         /* USB 1.1 interrupt transfers only involve one packet per interval.
          * Drivers can submit URBs of any length, but longer ones will need
          * multiple intervals to complete.
          */
-        qh->skel = uhci->skelqh[__interval_to_skel(urb->interval)];
+
+        /* Figure out which power-of-two queue to use */
+        for (exponent = 7; exponent >= 0; --exponent) {
+                if ((1 << exponent) <= urb->interval)
+                        break;
+        }
+        if (exponent < 0)
+                return -EINVAL;
+        urb->interval = 1 << exponent;
+
+        if (qh->period == 0)
+                qh->skel = uhci->skelqh[UHCI_SKEL_INDEX(exponent)];
+        else if (qh->period != urb->interval)
+                return -EINVAL;         /* Can't change the period */
+
         return uhci_submit_common(uhci, urb, qh);
 }
 
 /*
+ * Fix up the data structures following a short transfer
+ */
+static int uhci_fixup_short_transfer(struct uhci_hcd *uhci,
+                struct uhci_qh *qh, struct urb_priv *urbp)
+{
+        struct uhci_td *td;
+        struct list_head *tmp;
+        int ret;
+
+        td = list_entry(urbp->td_list.prev, struct uhci_td, list);
+        if (qh->type == USB_ENDPOINT_XFER_CONTROL) {
+
+                /* When a control transfer is short, we have to restart
+                 * the queue at the status stage transaction, which is
+                 * the last TD. */
+                WARN_ON(list_empty(&urbp->td_list));
+                qh->element = cpu_to_le32(td->dma_handle);
+                tmp = td->list.prev;
+                ret = -EINPROGRESS;
+
+        } else {
+
+                /* When a bulk/interrupt transfer is short, we have to
+                 * fix up the toggles of the following URBs on the queue
+                 * before restarting the queue at the next URB. */
+                qh->initial_toggle = uhci_toggle(td_token(qh->post_td)) ^ 1;
+                uhci_fixup_toggles(qh, 1);
+
+                if (list_empty(&urbp->td_list))
+                        td = qh->post_td;
+                qh->element = td->link;
+                tmp = urbp->td_list.prev;
+                ret = 0;
+        }
+
+        /* Remove all the TDs we skipped over, from tmp back to the start */
+        while (tmp != &urbp->td_list) {
+                td = list_entry(tmp, struct uhci_td, list);
+                tmp = tmp->prev;
+
+                uhci_remove_td_from_urbp(td);
+                uhci_free_td(uhci, td);
+        }
+        return ret;
+}
+
+/*
+ * Common result for control, bulk, and interrupt
+ */
+static int uhci_result_common(struct uhci_hcd *uhci, struct urb *urb)
+{
+        struct urb_priv *urbp = urb->hcpriv;
+        struct uhci_qh *qh = urbp->qh;
+        struct uhci_td *td, *tmp;
+        unsigned status;
+        int ret = 0;
+
+        list_for_each_entry_safe(td, tmp, &urbp->td_list, list) {
+                unsigned int ctrlstat;
+                int len;
+
+                ctrlstat = td_status(td);
+                status = uhci_status_bits(ctrlstat);
+                if (status & TD_CTRL_ACTIVE)
+                        return -EINPROGRESS;
+
+                len = uhci_actual_length(ctrlstat);
+                urb->actual_length += len;
+
+                if (status) {
+                        ret = uhci_map_status(status,
+                                        uhci_packetout(td_token(td)));
+                        if ((debug == 1 && ret != -EPIPE) || debug > 1) {
+                                /* Some debugging code */
+                                dev_dbg(&urb->dev->dev,
+                                                "%s: failed with status %x\n",
+                                                __FUNCTION__, status);
+
+                                if (debug > 1 && errbuf) {
+                                        /* Print the chain for debugging */
+                                        uhci_show_qh(urbp->qh, errbuf,
+                                                        ERRBUF_LEN, 0);
+                                        lprintk(errbuf);
+                                }
+                        }
+
+                } else if (len < uhci_expected_length(td_token(td))) {
+
+                        /* We received a short packet */
+                        if (urb->transfer_flags & URB_SHORT_NOT_OK)
+                                ret = -EREMOTEIO;
+                        else if (ctrlstat & TD_CTRL_SPD)
+                                ret = 1;
+                }
+
+                uhci_remove_td_from_urbp(td);
+                if (qh->post_td)
+                        uhci_free_td(uhci, qh->post_td);
+                qh->post_td = td;
+
+                if (ret != 0)
+                        goto err;
+        }
+        return ret;
+
+err:
+        if (ret < 0) {
+                /* In case a control transfer gets an error
+                 * during the setup stage */
+                urb->actual_length = max(urb->actual_length, 0);
+
+                /* Note that the queue has stopped and save
+                 * the next toggle value */
+                qh->element = UHCI_PTR_TERM;
+                qh->is_stopped = 1;
+                qh->needs_fixup = (qh->type != USB_ENDPOINT_XFER_CONTROL);
+                qh->initial_toggle = uhci_toggle(td_token(td)) ^
+                                (ret == -EREMOTEIO);
+
+        } else          /* Short packet received */
+                ret = uhci_fixup_short_transfer(uhci, qh, urbp);
+        return ret;
+}
+
+/*
  * Isochronous transfers
  */
 static int uhci_submit_isochronous(struct uhci_hcd *uhci, struct urb *urb,
@@ -980,38 +987,57 @@ static int uhci_submit_isochronous(struct uhci_hcd *uhci, struct urb *urb,
         unsigned long destination, status;
         struct urb_priv *urbp = (struct urb_priv *) urb->hcpriv;
 
-        if (urb->number_of_packets > 900)       /* 900? Why? */
+        /* Values must not be too big (could overflow below) */
+        if (urb->interval >= UHCI_NUMFRAMES ||
+                        urb->number_of_packets >= UHCI_NUMFRAMES)
                 return -EFBIG;
 
-        status = TD_CTRL_ACTIVE | TD_CTRL_IOS;
-        destination = (urb->pipe & PIPE_DEVEP_MASK) | usb_packetid(urb->pipe);
-
-        /* Figure out the starting frame number */
-        if (urb->transfer_flags & URB_ISO_ASAP) {
-                if (list_empty(&qh->queue)) {
+        /* Check the period and figure out the starting frame number */
+        if (qh->period == 0) {
+                if (urb->transfer_flags & URB_ISO_ASAP) {
                         uhci_get_current_frame_number(uhci);
-                        urb->start_frame = (uhci->frame_number + 10);
+                        urb->start_frame = uhci->frame_number + 10;
+                } else {
+                        i = urb->start_frame - uhci->last_iso_frame;
+                        if (i <= 0 || i >= UHCI_NUMFRAMES)
+                                return -EINVAL;
+                }
+        } else if (qh->period != urb->interval) {
+                return -EINVAL;         /* Can't change the period */
 
-                } else {                /* Go right after the last one */
-                        struct urb *last_urb;
+        } else {        /* Pick up where the last URB leaves off */
+                if (list_empty(&qh->queue)) {
+                        frame = qh->iso_frame;
+                } else {
+                        struct urb *lurb;
 
-                        last_urb = list_entry(qh->queue.prev,
+                        lurb = list_entry(qh->queue.prev,
                                         struct urb_priv, node)->urb;
-                        urb->start_frame = (last_urb->start_frame +
-                                        last_urb->number_of_packets *
-                                        last_urb->interval);
+                        frame = lurb->start_frame +
+                                        lurb->number_of_packets *
+                                        lurb->interval;
                 }
-        } else {
-                /* FIXME: Sanity check */
+                if (urb->transfer_flags & URB_ISO_ASAP)
+                        urb->start_frame = frame;
+                else if (urb->start_frame != frame)
+                        return -EINVAL;
         }
-        urb->start_frame &= (UHCI_NUMFRAMES - 1);
+
+        /* Make sure we won't have to go too far into the future */
+        if (uhci_frame_before_eq(uhci->last_iso_frame + UHCI_NUMFRAMES,
+                        urb->start_frame + urb->number_of_packets *
+                                urb->interval))
+                return -EFBIG;
+
+        status = TD_CTRL_ACTIVE | TD_CTRL_IOS;
+        destination = (urb->pipe & PIPE_DEVEP_MASK) | usb_packetid(urb->pipe);
 
         for (i = 0; i < urb->number_of_packets; i++) {
                 td = uhci_alloc_td(uhci);
                 if (!td)
                         return -ENOMEM;
 
-                uhci_add_td_to_urb(urb, td);
+                uhci_add_td_to_urbp(td, urbp);
                 uhci_fill_td(td, status, destination |
                                 uhci_explen(urb->iso_frame_desc[i].length),
                                 urb->transfer_dma +
@@ -1022,12 +1048,19 @@ static int uhci_submit_isochronous(struct uhci_hcd *uhci, struct urb *urb,
         td->status |= __constant_cpu_to_le32(TD_CTRL_IOC);
 
         qh->skel = uhci->skel_iso_qh;
+        qh->period = urb->interval;
 
         /* Add the TDs to the frame list */
         frame = urb->start_frame;
         list_for_each_entry(td, &urbp->td_list, list) {
                 uhci_insert_td_in_frame_list(uhci, td, frame);
-                frame += urb->interval;
+                frame += qh->period;
+        }
+
+        if (list_empty(&qh->queue)) {
+                qh->iso_packet_desc = &urb->iso_frame_desc[0];
+                qh->iso_frame = urb->start_frame;
+                qh->iso_status = 0;
         }
 
         return 0;
@@ -1035,37 +1068,44 @@ static int uhci_submit_isochronous(struct uhci_hcd *uhci, struct urb *urb,
 
 static int uhci_result_isochronous(struct uhci_hcd *uhci, struct urb *urb)
 {
-        struct uhci_td *td;
-        struct urb_priv *urbp = (struct urb_priv *)urb->hcpriv;
-        int status;
-        int i, ret = 0;
-
-        urb->actual_length = urb->error_count = 0;
+        struct uhci_td *td, *tmp;
+        struct urb_priv *urbp = urb->hcpriv;
+        struct uhci_qh *qh = urbp->qh;
 
-        i = 0;
-        list_for_each_entry(td, &urbp->td_list, list) {
+        list_for_each_entry_safe(td, tmp, &urbp->td_list, list) {
+                unsigned int ctrlstat;
+                int status;
                 int actlength;
-                unsigned int ctrlstat = td_status(td);
 
-                if (ctrlstat & TD_CTRL_ACTIVE)
+                if (uhci_frame_before_eq(uhci->cur_iso_frame, qh->iso_frame))
                         return -EINPROGRESS;
 
-                actlength = uhci_actual_length(ctrlstat);
-                urb->iso_frame_desc[i].actual_length = actlength;
-                urb->actual_length += actlength;
+                uhci_remove_tds_from_frame(uhci, qh->iso_frame);
+
+                ctrlstat = td_status(td);
+                if (ctrlstat & TD_CTRL_ACTIVE) {
+                        status = -EXDEV;        /* TD was added too late? */
+                } else {
+                        status = uhci_map_status(uhci_status_bits(ctrlstat),
+                                        usb_pipeout(urb->pipe));
+                        actlength = uhci_actual_length(ctrlstat);
+
+                        urb->actual_length += actlength;
+                        qh->iso_packet_desc->actual_length = actlength;
+                        qh->iso_packet_desc->status = status;
+                }
 
-                status = uhci_map_status(uhci_status_bits(ctrlstat),
-                                usb_pipeout(urb->pipe));
-                urb->iso_frame_desc[i].status = status;
                 if (status) {
                         urb->error_count++;
-                        ret = status;
+                        qh->iso_status = status;
                 }
 
-                i++;
+                uhci_remove_td_from_urbp(td);
+                uhci_free_td(uhci, td);
+                qh->iso_frame += qh->period;
+                ++qh->iso_packet_desc;
         }
-
-        return ret;
+        return qh->iso_status;
 }
 
 static int uhci_urb_enqueue(struct usb_hcd *hcd,
@@ -1099,14 +1139,14 @@ static int uhci_urb_enqueue(struct usb_hcd *hcd,
         }
         urbp->qh = qh;
 
-        switch (usb_pipetype(urb->pipe)) {
-        case PIPE_CONTROL:
+        switch (qh->type) {
+        case USB_ENDPOINT_XFER_CONTROL:
                 ret = uhci_submit_control(uhci, urb, qh);
                 break;
-        case PIPE_BULK:
+        case USB_ENDPOINT_XFER_BULK:
                 ret = uhci_submit_bulk(uhci, urb, qh);
                 break;
-        case PIPE_INTERRUPT:
+        case USB_ENDPOINT_XFER_INT:
                 if (list_empty(&qh->queue)) {
                         bustime = usb_check_bandwidth(urb->dev, urb);
                         if (bustime < 0)
@@ -1125,7 +1165,8 @@ static int uhci_urb_enqueue(struct usb_hcd *hcd,
                         ret = uhci_submit_interrupt(uhci, urb, qh);
                 }
                 break;
-        case PIPE_ISOCHRONOUS:
+        case USB_ENDPOINT_XFER_ISOC:
+                urb->error_count = 0;
                 bustime = usb_check_bandwidth(urb->dev, urb);
                 if (bustime < 0) {
                         ret = bustime;
@@ -1146,9 +1187,12 @@ static int uhci_urb_enqueue(struct usb_hcd *hcd,
 
         /* If the new URB is the first and only one on this QH then either
          * the QH is new and idle or else it's unlinked and waiting to
-         * become idle, so we can activate it right away. */
-        if (qh->queue.next == &urbp->node)
+         * become idle, so we can activate it right away.  But only if the
+         * queue isn't stopped. */
+        if (qh->queue.next == &urbp->node && !qh->is_stopped) {
                 uhci_activate_qh(uhci, qh);
+                uhci_urbp_wants_fsbr(uhci, urbp);
+        }
         goto done;
 
 err_submit_failed:
@@ -1168,16 +1212,26 @@ static int uhci_urb_dequeue(struct usb_hcd *hcd, struct urb *urb)
         struct uhci_hcd *uhci = hcd_to_uhci(hcd);
         unsigned long flags;
         struct urb_priv *urbp;
+        struct uhci_qh *qh;
 
         spin_lock_irqsave(&uhci->lock, flags);
         urbp = urb->hcpriv;
         if (!urbp)                      /* URB was never linked! */
                 goto done;
+        qh = urbp->qh;
 
         /* Remove Isochronous TDs from the frame list ASAP */
-        if (usb_pipetype(urb->pipe) == PIPE_ISOCHRONOUS)
+        if (qh->type == USB_ENDPOINT_XFER_ISOC) {
                 uhci_unlink_isochronous_tds(uhci, urb);
-        uhci_unlink_qh(uhci, urbp->qh);
+                mb();
+
+                /* If the URB has already started, update the QH unlink time */
+                uhci_get_current_frame_number(uhci);
+                if (uhci_frame_before_eq(urb->start_frame, uhci->frame_number))
+                        qh->unlink_frame = uhci->frame_number;
+        }
+
+        uhci_unlink_qh(uhci, qh);
 
 done:
         spin_unlock_irqrestore(&uhci->lock, flags);
@@ -1194,22 +1248,17 @@ __acquires(uhci->lock)
 {
         struct urb_priv *urbp = (struct urb_priv *) urb->hcpriv;
 
-        /* Isochronous TDs get unlinked directly from the frame list */
-        if (usb_pipetype(urb->pipe) == PIPE_ISOCHRONOUS)
-                uhci_unlink_isochronous_tds(uhci, urb);
-
-        /* If the URB isn't first on its queue, adjust the link pointer
-         * of the last TD in the previous URB. */
-        else if (qh->queue.next != &urbp->node) {
-                struct urb_priv *purbp;
-                struct uhci_td *ptd, *ltd;
-
-                purbp = list_entry(urbp->node.prev, struct urb_priv, node);
-                ptd = list_entry(purbp->td_list.prev, struct uhci_td,
-                                list);
-                ltd = list_entry(urbp->td_list.prev, struct uhci_td,
-                                list);
-                ptd->link = ltd->link;
+        /* When giving back the first URB in an Isochronous queue,
+         * reinitialize the QH's iso-related members for the next URB. */
+        if (qh->type == USB_ENDPOINT_XFER_ISOC &&
+                        urbp->node.prev == &qh->queue &&
+                        urbp->node.next != &qh->queue) {
+                struct urb *nurb = list_entry(urbp->node.next,
+                                struct urb_priv, node)->urb;
+
+                qh->iso_packet_desc = &nurb->iso_frame_desc[0];
+                qh->iso_frame = nurb->start_frame;
+                qh->iso_status = 0;
         }
 
         /* Take the URB off the QH's queue.  If the queue is now empty,
@@ -1221,16 +1270,15 @@ __acquires(uhci->lock)
                 qh->needs_fixup = 0;
         }
 
-        uhci_dec_fsbr(uhci, urb);       /* Safe since it checks */
         uhci_free_urb_priv(uhci, urbp);
 
-        switch (usb_pipetype(urb->pipe)) {
-        case PIPE_ISOCHRONOUS:
+        switch (qh->type) {
+        case USB_ENDPOINT_XFER_ISOC:
                 /* Release bandwidth for Interrupt or Isoc. transfers */
                 if (urb->bandwidth)
                         usb_release_bandwidth(urb->dev, urb, 1);
                 break;
-        case PIPE_INTERRUPT:
+        case USB_ENDPOINT_XFER_INT:
                 /* Release bandwidth for Interrupt or Isoc. transfers */
                 /* Make sure we don't release if we have a queued URB */
                 if (list_empty(&qh->queue) && urb->bandwidth)
@@ -1252,6 +1300,7 @@ __acquires(uhci->lock)
                 uhci_unlink_qh(uhci, qh);
 
                 /* Bandwidth stuff not yet implemented */
+                qh->period = 0;
         }
 }
 
@@ -1273,17 +1322,10 @@ static void uhci_scan_qh(struct uhci_hcd *uhci, struct uhci_qh *qh,
                 urbp = list_entry(qh->queue.next, struct urb_priv, node);
                 urb = urbp->urb;
 
-                switch (usb_pipetype(urb->pipe)) {
-                case PIPE_CONTROL:
-                        status = uhci_result_control(uhci, urb);
-                        break;
-                case PIPE_ISOCHRONOUS:
+                if (qh->type == USB_ENDPOINT_XFER_ISOC)
                         status = uhci_result_isochronous(uhci, urb);
-                        break;
-                default:        /* PIPE_BULK or PIPE_INTERRUPT */
+                else
                         status = uhci_result_common(uhci, urb);
-                        break;
-                }
                 if (status == -EINPROGRESS)
                         break;
 
@@ -1291,31 +1333,43 @@ static void uhci_scan_qh(struct uhci_hcd *uhci, struct uhci_qh *qh,
                 if (urb->status == -EINPROGRESS)        /* Not dequeued */
                         urb->status = status;
                 else
-                        status = -ECONNRESET;
+                        status = ECONNRESET;            /* Not -ECONNRESET */
                 spin_unlock(&urb->lock);
 
                 /* Dequeued but completed URBs can't be given back unless
                  * the QH is stopped or has finished unlinking. */
-                if (status == -ECONNRESET &&
-                                !(qh->is_stopped || QH_FINISHED_UNLINKING(qh)))
-                        return;
+                if (status == ECONNRESET) {
+                        if (QH_FINISHED_UNLINKING(qh))
+                                qh->is_stopped = 1;
+                        else if (!qh->is_stopped)
+                                return;
+                }
 
                 uhci_giveback_urb(uhci, qh, urb, regs);
-                if (qh->is_stopped)
+                if (status < 0)
                         break;
         }
 
         /* If the QH is neither stopped nor finished unlinking (normal case),
          * our work here is done. */
- restart:
-        if (!(qh->is_stopped || QH_FINISHED_UNLINKING(qh)))
+        if (QH_FINISHED_UNLINKING(qh))
+                qh->is_stopped = 1;
+        else if (!qh->is_stopped)
                 return;
 
         /* Otherwise give back each of the dequeued URBs */
+restart:
         list_for_each_entry(urbp, &qh->queue, node) {
                 urb = urbp->urb;
                 if (urb->status != -EINPROGRESS) {
-                        uhci_save_toggle(qh, urb);
+
+                        /* Fix up the TD links and save the toggles for
+                         * non-Isochronous queues.  For Isochronous queues,
+                         * test for too-recent dequeues. */
+                        if (!uhci_cleanup_queue(uhci, qh, urb)) {
+                                qh->is_stopped = 0;
+                                return;
+                        }
                         uhci_giveback_urb(uhci, qh, urb, regs);
                         goto restart;
                 }
@@ -1327,6 +1381,18 @@ static void uhci_scan_qh(struct uhci_hcd *uhci, struct uhci_qh *qh,
         if (!list_empty(&qh->queue)) {
                 if (qh->needs_fixup)
                         uhci_fixup_toggles(qh, 0);
+
+                /* If the first URB on the queue wants FSBR but its time
+                 * limit has expired, set the next TD to interrupt on
+                 * completion before reactivating the QH. */
+                urbp = list_entry(qh->queue.next, struct urb_priv, node);
+                if (urbp->fsbr && qh->wait_expired) {
+                        struct uhci_td *td = list_entry(urbp->td_list.next,
+                                        struct uhci_td, list);
+
+                        td->status |= __cpu_to_le32(TD_CTRL_IOC);
+                }
+
                 uhci_activate_qh(uhci, qh);
         }
 
@@ -1336,15 +1402,84 @@ static void uhci_scan_qh(struct uhci_hcd *uhci, struct uhci_qh *qh,
                 uhci_make_qh_idle(uhci, qh);
 }
 
-static void uhci_free_pending_tds(struct uhci_hcd *uhci)
+/*
+ * Check for queues that have made some forward progress.
+ * Returns 0 if the queue is not Isochronous, is ACTIVE, and
+ * has not advanced since last examined; 1 otherwise.
+ *
+ * Early Intel controllers have a bug which causes qh->element sometimes
+ * not to advance when a TD completes successfully.  The queue remains
+ * stuck on the inactive completed TD.  We detect such cases and advance
+ * the element pointer by hand.
+ */
+static int uhci_advance_check(struct uhci_hcd *uhci, struct uhci_qh *qh)
 {
-        struct uhci_td *td, *tmp;
+        struct urb_priv *urbp = NULL;
+        struct uhci_td *td;
+        int ret = 1;
+        unsigned status;
 
-        list_for_each_entry_safe(td, tmp, &uhci->td_remove_list, remove_list) {
-                list_del_init(&td->remove_list);
+        if (qh->type == USB_ENDPOINT_XFER_ISOC)
+                goto done;
 
-                uhci_free_td(uhci, td);
+        /* Treat an UNLINKING queue as though it hasn't advanced.
+         * This is okay because reactivation will treat it as though
+         * it has advanced, and if it is going to become IDLE then
+         * this doesn't matter anyway.  Furthermore it's possible
+         * for an UNLINKING queue not to have any URBs at all, or
+         * for its first URB not to have any TDs (if it was dequeued
+         * just as it completed).  So it's not easy in any case to
+         * test whether such queues have advanced. */
+        if (qh->state != QH_STATE_ACTIVE) {
+                urbp = NULL;
+                status = 0;
+
+        } else {
+                urbp = list_entry(qh->queue.next, struct urb_priv, node);
+                td = list_entry(urbp->td_list.next, struct uhci_td, list);
+                status = td_status(td);
+                if (!(status & TD_CTRL_ACTIVE)) {
+
+                        /* We're okay, the queue has advanced */
+                        qh->wait_expired = 0;
+                        qh->advance_jiffies = jiffies;
+                        goto done;
+                }
+                ret = 0;
+        }
+
+        /* The queue hasn't advanced; check for timeout */
+        if (qh->wait_expired)
+                goto done;
+
+        if (time_after(jiffies, qh->advance_jiffies + QH_WAIT_TIMEOUT)) {
+
+                /* Detect the Intel bug and work around it */
+                if (qh->post_td && qh_element(qh) ==
+                                cpu_to_le32(qh->post_td->dma_handle)) {
+                        qh->element = qh->post_td->link;
+                        qh->advance_jiffies = jiffies;
+                        ret = 1;
+                        goto done;
+                }
+
+                qh->wait_expired = 1;
+
+                /* If the current URB wants FSBR, unlink it temporarily
+                 * so that we can safely set the next TD to interrupt on
+                 * completion.  That way we'll know as soon as the queue
+                 * starts moving again. */
+                if (urbp && urbp->fsbr && !(status & TD_CTRL_IOC))
+                        uhci_unlink_qh(uhci, qh);
+
+        } else {
+                /* Unmoving but not-yet-expired queues keep FSBR alive */
+                if (urbp)
+                        uhci_urbp_wants_fsbr(uhci, urbp);
         }
+
+done:
+        return ret;
 }
 
 /*
@@ -1361,14 +1496,13 @@ static void uhci_scan_schedule(struct uhci_hcd *uhci, struct pt_regs *regs)
                 return;
         }
         uhci->scan_in_progress = 1;
- rescan:
+rescan:
         uhci->need_rescan = 0;
+        uhci->fsbr_is_wanted = 0;
 
         uhci_clear_next_interrupt(uhci);
         uhci_get_current_frame_number(uhci);
-
-        if (uhci->frame_number + uhci->is_stopped != uhci->td_remove_age)
-                uhci_free_pending_tds(uhci);
+        uhci->cur_iso_frame = uhci->frame_number;
 
         /* Go through all the QH queues and process the URBs in each one */
         for (i = 0; i < UHCI_NUM_SKELQH - 1; ++i) {
@@ -1377,33 +1511,30 @@ static void uhci_scan_schedule(struct uhci_hcd *uhci, struct pt_regs *regs)
                 while ((qh = uhci->next_qh) != uhci->skelqh[i]) {
                         uhci->next_qh = list_entry(qh->node.next,
                                         struct uhci_qh, node);
-                        uhci_scan_qh(uhci, qh, regs);
+
+                        if (uhci_advance_check(uhci, qh)) {
+                                uhci_scan_qh(uhci, qh, regs);
+                                if (qh->state == QH_STATE_ACTIVE) {
+                                        uhci_urbp_wants_fsbr(uhci,
+        list_entry(qh->queue.next, struct urb_priv, node));
+                                }
+                        }
                 }
         }
 
+        uhci->last_iso_frame = uhci->cur_iso_frame;
         if (uhci->need_rescan)
                 goto rescan;
         uhci->scan_in_progress = 0;
 
-        /* If the controller is stopped, we can finish these off right now */
-        if (uhci->is_stopped)
-                uhci_free_pending_tds(uhci);
+        if (uhci->fsbr_is_on && !uhci->fsbr_is_wanted &&
+                        !uhci->fsbr_expiring) {
+                uhci->fsbr_expiring = 1;
+                mod_timer(&uhci->fsbr_timer, jiffies + FSBR_OFF_DELAY);
+        }
 
-        if (list_empty(&uhci->td_remove_list) &&
-                        list_empty(&uhci->skel_unlink_qh->node))
+        if (list_empty(&uhci->skel_unlink_qh->node))
                 uhci_clear_next_interrupt(uhci);
         else
                 uhci_set_next_interrupt(uhci);
 }
-
-static void check_fsbr(struct uhci_hcd *uhci)
-{
-        /* For now, don't scan URBs for FSBR timeouts.
-         * Add it back in later... */
-
-        /* Really disable FSBR */
-        if (!uhci->fsbr && uhci->fsbrtimeout && time_after_eq(jiffies, uhci->fsbrtimeout)) {
-                uhci->fsbrtimeout = 0;
-                uhci->skel_term_qh->link = UHCI_PTR_TERM;
-        }
-}
diff --git a/drivers/usb/image/microtek.c b/drivers/usb/image/microtek.c
index 2a0e18a48748..b2bafc37c414 100644
--- a/drivers/usb/image/microtek.c
+++ b/drivers/usb/image/microtek.c
@@ -513,7 +513,7 @@ static void mts_do_sg (struct urb* transfer, struct pt_regs *regs)
                 mts_transfer_cleanup(transfer);
         }
 
-        sg = context->srb->buffer;
+        sg = context->srb->request_buffer;
         context->fragment++;
         mts_int_submit_urb(transfer,
                            context->data_pipe,
@@ -549,19 +549,19 @@ mts_build_transfer_context( Scsi_Cmnd *srb, struct mts_desc* desc )
         desc->context.fragment = 0;
 
         if (!srb->use_sg) {
-                if ( !srb->bufflen ){
+                if ( !srb->request_bufflen ){
                         desc->context.data = NULL;
                         desc->context.data_length = 0;
                         return;
                 } else {
-                        desc->context.data = srb->buffer;
-                        desc->context.data_length = srb->bufflen;
+                        desc->context.data = srb->request_buffer;
+                        desc->context.data_length = srb->request_bufflen;
                         MTS_DEBUG("length = %d or %d\n",
                                   srb->request_bufflen, srb->bufflen);
                 }
         } else {
                 MTS_DEBUG("Using scatter/gather\n");
-                sg = srb->buffer;
+                sg = srb->request_buffer;
                 desc->context.data = page_address(sg[0].page) + sg[0].offset;
                 desc->context.data_length = sg[0].length;
         }
diff --git a/drivers/usb/input/acecad.c b/drivers/usb/input/acecad.c
index df29b8078b54..18c10e150ef3 100644
--- a/drivers/usb/input/acecad.c
+++ b/drivers/usb/input/acecad.c
@@ -27,11 +27,9 @@
 
 #include <linux/kernel.h>
 #include <linux/slab.h>
-#include <linux/input.h>
 #include <linux/module.h>
 #include <linux/init.h>
-#include <linux/usb.h>
-#include <linux/usb_input.h>
+#include <linux/usb/input.h>
 
 /*
  * Version Information
diff --git a/drivers/usb/input/aiptek.c b/drivers/usb/input/aiptek.c
index a6693b0d1c4c..b138dae2b055 100644
--- a/drivers/usb/input/aiptek.c
+++ b/drivers/usb/input/aiptek.c
@@ -73,11 +73,9 @@
 #include <linux/jiffies.h>
 #include <linux/kernel.h>
 #include <linux/slab.h>
-#include <linux/input.h>
 #include <linux/module.h>
 #include <linux/init.h>
-#include <linux/usb.h>
-#include <linux/usb_input.h>
+#include <linux/usb/input.h>
 #include <linux/sched.h>
 #include <asm/uaccess.h>
 #include <asm/unaligned.h>
diff --git a/drivers/usb/input/appletouch.c b/drivers/usb/input/appletouch.c
index c222ed13deab..36855062eacc 100644
--- a/drivers/usb/input/appletouch.c
+++ b/drivers/usb/input/appletouch.c
@@ -1,5 +1,5 @@
 /*
- * Apple USB Touchpad (for post-February 2005 PowerBooks) driver
+ * Apple USB Touchpad (for post-February 2005 PowerBooks and MacBooks) driver
  *
  * Copyright (C) 2001-2004 Greg Kroah-Hartman (greg@kroah.com)
  * Copyright (C) 2005      Johannes Berg (johannes@sipsolutions.net)
@@ -7,6 +7,7 @@
  * Copyright (C) 2005      Frank Arnold (frank@scirocco-5v-turbo.de)
  * Copyright (C) 2005      Peter Osterlund (petero2@telia.com)
  * Copyright (C) 2005      Michael Hanselmann (linux-kernel@hansmi.ch)
+ * Copyright (C) 2006      Nicolas Boichat (nicolas@boichat.ch)
  *
  * Thanks to Alex Harper <basilisk@foobox.net> for his inputs.
  *
@@ -32,9 +33,7 @@
 #include <linux/init.h>
 #include <linux/slab.h>
 #include <linux/module.h>
-#include <linux/usb.h>
-#include <linux/input.h>
-#include <linux/usb_input.h>
+#include <linux/usb/input.h>
 
 /* Apple has powerbooks which have the keyboard with different Product IDs */
 #define APPLE_VENDOR_ID         0x05AC
@@ -44,6 +43,11 @@
 #define GEYSER_ISO_PRODUCT_ID   0x0215
 #define GEYSER_JIS_PRODUCT_ID   0x0216
 
+/* MacBook devices */
+#define GEYSER3_ANSI_PRODUCT_ID 0x0217
+#define GEYSER3_ISO_PRODUCT_ID  0x0218
+#define GEYSER3_JIS_PRODUCT_ID  0x0219
+
 #define ATP_DEVICE(prod)                                        \
         .match_flags = USB_DEVICE_ID_MATCH_DEVICE |             \
                        USB_DEVICE_ID_MATCH_INT_CLASS |          \
@@ -65,6 +69,10 @@ static struct usb_device_id atp_table [] = {
         { ATP_DEVICE(GEYSER_ISO_PRODUCT_ID) },
         { ATP_DEVICE(GEYSER_JIS_PRODUCT_ID) },
 
+        { ATP_DEVICE(GEYSER3_ANSI_PRODUCT_ID) },
+        { ATP_DEVICE(GEYSER3_ISO_PRODUCT_ID) },
+        { ATP_DEVICE(GEYSER3_JIS_PRODUCT_ID) },
+
         /* Terminating entry */
         { }
 };
@@ -101,6 +109,13 @@ MODULE_DEVICE_TABLE (usb, atp_table);
  */
 #define ATP_THRESHOLD    5
 
+/* MacBook Pro (Geyser 3) initialization constants */
+#define ATP_GEYSER3_MODE_READ_REQUEST_ID 1
+#define ATP_GEYSER3_MODE_WRITE_REQUEST_ID 9
+#define ATP_GEYSER3_MODE_REQUEST_VALUE 0x300
+#define ATP_GEYSER3_MODE_REQUEST_INDEX 0
+#define ATP_GEYSER3_MODE_VENDOR_VALUE 0x04
+
 /* Structure to hold all of our device specific stuff */
 struct atp {
         char                    phys[64];
@@ -147,13 +162,22 @@ MODULE_PARM_DESC(debug, "Activate debugging output");
 /* Checks if the device a Geyser 2 (ANSI, ISO, JIS) */
 static inline int atp_is_geyser_2(struct atp *dev)
 {
-        int16_t productId = le16_to_cpu(dev->udev->descriptor.idProduct);
+        u16 productId = le16_to_cpu(dev->udev->descriptor.idProduct);
 
         return (productId == GEYSER_ANSI_PRODUCT_ID) ||
                 (productId == GEYSER_ISO_PRODUCT_ID) ||
                 (productId == GEYSER_JIS_PRODUCT_ID);
 }
 
+static inline int atp_is_geyser_3(struct atp *dev)
+{
+        u16 productId = le16_to_cpu(dev->udev->descriptor.idProduct);
+
+        return (productId == GEYSER3_ANSI_PRODUCT_ID) ||
+                (productId == GEYSER3_ISO_PRODUCT_ID) ||
+                (productId == GEYSER3_JIS_PRODUCT_ID);
+}
+
 static int atp_calculate_abs(int *xy_sensors, int nb_sensors, int fact,
                              int *z, int *fingers)
 {
@@ -219,12 +243,33 @@ static void atp_complete(struct urb* urb, struct pt_regs* regs)
 
         /* drop incomplete datasets */
         if (dev->urb->actual_length != dev->datalen) {
-                dprintk("appletouch: incomplete data package.\n");
+                dprintk("appletouch: incomplete data package"
+                        " (first byte: %d, length: %d).\n",
+                        dev->data[0], dev->urb->actual_length);
                 goto exit;
         }
 
         /* reorder the sensors values */
-        if (atp_is_geyser_2(dev)) {
+        if (atp_is_geyser_3(dev)) {
+                memset(dev->xy_cur, 0, sizeof(dev->xy_cur));
+
+                /*
+                 * The values are laid out like this:
+                 * -, Y1, Y2, -, Y3, Y4, -, ..., -, X1, X2, -, X3, X4, ...
+                 * '-' is an unused value.
+                 */
+
+                /* read X values */
+                for (i = 0, j = 19; i < 20; i += 2, j += 3) {
+                        dev->xy_cur[i] = dev->data[j + 1];
+                        dev->xy_cur[i + 1] = dev->data[j + 2];
+                }
+                /* read Y values */
+                for (i = 0, j = 1; i < 9; i += 2, j += 3) {
+                        dev->xy_cur[ATP_XSENSORS + i] = dev->data[j + 1];
+                        dev->xy_cur[ATP_XSENSORS + i + 1] = dev->data[j + 2];
+                }
+        } else if (atp_is_geyser_2(dev)) {
                 memset(dev->xy_cur, 0, sizeof(dev->xy_cur));
 
                 /*
@@ -267,6 +312,9 @@ static void atp_complete(struct urb* urb, struct pt_regs* regs)
                 dev->x_old = dev->y_old = -1;
                 memcpy(dev->xy_old, dev->xy_cur, sizeof(dev->xy_old));
 
+                if (atp_is_geyser_3(dev)) /* No 17" Macbooks (yet) */
+                        goto exit;
+
                 /* 17" Powerbooks have extra X sensors */
                 for (i = (atp_is_geyser_2(dev)?15:16); i < ATP_XSENSORS; i++) {
                         if (!dev->xy_cur[i]) continue;
@@ -414,7 +462,50 @@ static int atp_probe(struct usb_interface *iface, const struct usb_device_id *id
         dev->udev = udev;
         dev->input = input_dev;
         dev->overflowwarn = 0;
-        dev->datalen = (atp_is_geyser_2(dev)?64:81);
+        if (atp_is_geyser_3(dev))
+                dev->datalen = 64;
+        else if (atp_is_geyser_2(dev))
+                dev->datalen = 64;
+        else
+                dev->datalen = 81;
+
+        if (atp_is_geyser_3(dev)) {
+                /*
+                 * By default Geyser 3 device sends standard USB HID mouse
+                 * packets (Report ID 2). This code changes device mode, so it
+                 * sends raw sensor reports (Report ID 5).
+                 */
+                char data[8];
+                int size;
+
+                size = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0),
+                        ATP_GEYSER3_MODE_READ_REQUEST_ID,
+                        USB_DIR_IN | USB_TYPE_CLASS | USB_RECIP_INTERFACE,
+                        ATP_GEYSER3_MODE_REQUEST_VALUE,
+                        ATP_GEYSER3_MODE_REQUEST_INDEX, &data, 8, 5000);
+
+                if (size != 8) {
+                        err("Could not do mode read request from device"
+                                                        " (Geyser 3 mode)");
+                        goto err_free_devs;
+                }
+
+                /* Apply the mode switch */
+                data[0] = ATP_GEYSER3_MODE_VENDOR_VALUE;
+
+                size = usb_control_msg(udev, usb_sndctrlpipe(udev, 0),
+                        ATP_GEYSER3_MODE_WRITE_REQUEST_ID,
+                        USB_DIR_OUT | USB_TYPE_CLASS | USB_RECIP_INTERFACE,
+                        ATP_GEYSER3_MODE_REQUEST_VALUE,
+                        ATP_GEYSER3_MODE_REQUEST_INDEX, &data, 8, 5000);
+
+                if (size != 8) {
+                        err("Could not do mode write request to device"
+                                                        " (Geyser 3 mode)");
+                        goto err_free_devs;
+                }
+                printk("appletouch Geyser 3 inited.\n");
+        }
 
         dev->urb = usb_alloc_urb(0, GFP_KERNEL);
         if (!dev->urb) {
@@ -447,7 +538,15 @@ static int atp_probe(struct usb_interface *iface, const struct usb_device_id *id
 
         set_bit(EV_ABS, input_dev->evbit);
 
-        if (atp_is_geyser_2(dev)) {
+        if (atp_is_geyser_3(dev)) {
+                /*
+                 * MacBook have 20 X sensors, 10 Y sensors
+                 */
+                input_set_abs_params(input_dev, ABS_X, 0,
+                                     ((20 - 1) * ATP_XFACT) - 1, ATP_FUZZ, 0);
+                input_set_abs_params(input_dev, ABS_Y, 0,
+                                     ((10 - 1) * ATP_YFACT) - 1, ATP_FUZZ, 0);
+        } else if (atp_is_geyser_2(dev)) {
                 /*
                  * Oct 2005 15" PowerBooks have 15 X sensors, 17" are detected
                  * later.
diff --git a/drivers/usb/input/ati_remote.c b/drivers/usb/input/ati_remote.c
index 99f986cb6e95..07c8c0e665dd 100644
--- a/drivers/usb/input/ati_remote.c
+++ b/drivers/usb/input/ati_remote.c
@@ -92,9 +92,7 @@
 #include <linux/slab.h>
 #include <linux/module.h>
 #include <linux/moduleparam.h>
-#include <linux/input.h>
-#include <linux/usb.h>
-#include <linux/usb_input.h>
+#include <linux/usb/input.h>
 #include <linux/wait.h>
 #include <linux/jiffies.h>
 
diff --git a/drivers/usb/input/ati_remote2.c b/drivers/usb/input/ati_remote2.c
index ab1a1ae24be9..ea71de81ca6b 100644
--- a/drivers/usb/input/ati_remote2.c
+++ b/drivers/usb/input/ati_remote2.c
@@ -8,7 +8,7 @@
  * as published by the Free Software Foundation.
  */
 
-#include <linux/usb_input.h>
+#include <linux/usb/input.h>
 
 #define DRIVER_DESC    "ATI/Philips USB RF remote driver"
 #define DRIVER_VERSION "0.1"
diff --git a/drivers/usb/input/hid-core.c b/drivers/usb/input/hid-core.c
index 435273e7c85c..b9fb9687f926 100644
--- a/drivers/usb/input/hid-core.c
+++ b/drivers/usb/input/hid-core.c
@@ -944,21 +944,28 @@ static void hid_reset(void *_hid)
         dev_dbg(&hid->intf->dev, "resetting device\n");
         rc = rc_lock = usb_lock_device_for_reset(hid->dev, hid->intf);
         if (rc_lock >= 0) {
-                rc = usb_reset_device(hid->dev);
+                rc = usb_reset_composite_device(hid->dev, hid->intf);
                 if (rc_lock)
                         usb_unlock_device(hid->dev);
         }
         clear_bit(HID_RESET_PENDING, &hid->iofl);
 
-        if (rc == 0) {
-                hid->retry_delay = 0;
-                if (hid_start_in(hid))
+        switch (rc) {
+        case 0:
+                if (!test_bit(HID_IN_RUNNING, &hid->iofl))
                         hid_io_error(hid);
-        } else if (!(rc == -ENODEV || rc == -EHOSTUNREACH || rc == -EINTR))
+                break;
+        default:
                 err("can't reset device, %s-%s/input%d, status %d",
                                 hid->dev->bus->bus_name,
                                 hid->dev->devpath,
                                 hid->ifnum, rc);
+                /* FALLTHROUGH */
+        case -EHOSTUNREACH:
+        case -ENODEV:
+        case -EINTR:
+                break;
+        }
 }
 
 /* Main I/O error handler */
@@ -1374,9 +1381,6 @@ void hid_close(struct hid_device *hid)
 
 #define USB_VENDOR_ID_PANJIT            0x134c
 
-#define USB_VENDOR_ID_SILVERCREST       0x062a
-#define USB_DEVICE_ID_SILVERCREST_KB    0x0201
-
 /*
  * Initialize all reports
  */
@@ -1461,9 +1465,6 @@ void hid_init_reports(struct hid_device *hid)
 #define USB_VENDOR_ID_ONTRAK            0x0a07
 #define USB_DEVICE_ID_ONTRAK_ADU100     0x0064
 
-#define USB_VENDOR_ID_TANGTOP           0x0d3d
-#define USB_DEVICE_ID_TANGTOP_USBPS2    0x0001
-
 #define USB_VENDOR_ID_ESSENTIAL_REALITY 0x0d7f
 #define USB_DEVICE_ID_ESSENTIAL_REALITY_P5 0x0100
 
@@ -1520,12 +1521,6 @@ void hid_init_reports(struct hid_device *hid)
 #define USB_DEVICE_ID_MCC_PMD1024LS     0x0076
 #define USB_DEVICE_ID_MCC_PMD1208LS     0x007a
 
-#define USB_VENDOR_ID_CHICONY           0x04f2
-#define USB_DEVICE_ID_CHICONY_USBHUB_KB 0x0100
-
-#define USB_VENDOR_ID_BTC               0x046e
-#define USB_DEVICE_ID_BTC_KEYBOARD      0x5303
-
 #define USB_VENDOR_ID_VERNIER           0x08f7
 #define USB_DEVICE_ID_VERNIER_LABPRO    0x0001
 #define USB_DEVICE_ID_VERNIER_GOTEMP    0x0002
@@ -1549,20 +1544,13 @@ void hid_init_reports(struct hid_device *hid)
 #define USB_DEVICE_ID_LD_MACHINETEST    0x2040
 
 #define USB_VENDOR_ID_APPLE             0x05ac
-#define USB_DEVICE_ID_APPLE_POWERMOUSE  0x0304
+#define USB_DEVICE_ID_APPLE_MIGHTYMOUSE 0x0304
 
 #define USB_VENDOR_ID_CHERRY            0x046a
 #define USB_DEVICE_ID_CHERRY_CYMOTION   0x0023
 
-#define USB_VENDOR_ID_HP                0x03f0
-#define USB_DEVICE_ID_HP_USBHUB_KB      0x020c
-
-#define USB_VENDOR_ID_IBM               0x04b3
-#define USB_DEVICE_ID_IBM_USBHUB_KB     0x3005
-
-#define USB_VENDOR_ID_CREATIVELABS      0x062a
-#define USB_DEVICE_ID_CREATIVELABS_SILVERCREST  0x0201
-
+#define USB_VENDOR_ID_YEALINK           0x6993
+#define USB_DEVICE_ID_YEALINK_P1K_P4K_B2K       0xb001
 /*
  * Alphabetically sorted blacklist by quirk type.
  */
@@ -1671,6 +1659,7 @@ static const struct hid_blacklist {
         { USB_VENDOR_ID_WACOM, USB_DEVICE_ID_WACOM_DTF + 3, HID_QUIRK_IGNORE },
         { USB_VENDOR_ID_WISEGROUP, USB_DEVICE_ID_4_PHIDGETSERVO_20, HID_QUIRK_IGNORE },
         { USB_VENDOR_ID_WISEGROUP, USB_DEVICE_ID_1_PHIDGETSERVO_20, HID_QUIRK_IGNORE },
+        { USB_VENDOR_ID_YEALINK, USB_DEVICE_ID_YEALINK_P1K_P4K_B2K, HID_QUIRK_IGNORE },
 
         { USB_VENDOR_ID_ACECAD, USB_DEVICE_ID_ACECAD_FLAIR, HID_QUIRK_IGNORE },
         { USB_VENDOR_ID_ACECAD, USB_DEVICE_ID_ACECAD_302, HID_QUIRK_IGNORE },
@@ -1680,16 +1669,9 @@ static const struct hid_blacklist {
         { USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_2PORTKVM, HID_QUIRK_NOGET },
         { USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_4PORTKVM, HID_QUIRK_NOGET },
         { USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_4PORTKVMC, HID_QUIRK_NOGET },
-        { USB_VENDOR_ID_BTC, USB_DEVICE_ID_BTC_KEYBOARD, HID_QUIRK_NOGET},
-        { USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_USBHUB_KB, HID_QUIRK_NOGET},
-        { USB_VENDOR_ID_CREATIVELABS, USB_DEVICE_ID_CREATIVELABS_SILVERCREST, HID_QUIRK_NOGET },
-        { USB_VENDOR_ID_HP, USB_DEVICE_ID_HP_USBHUB_KB, HID_QUIRK_NOGET },
-        { USB_VENDOR_ID_IBM, USB_DEVICE_ID_IBM_USBHUB_KB, HID_QUIRK_NOGET },
-        { USB_VENDOR_ID_TANGTOP, USB_DEVICE_ID_TANGTOP_USBPS2, HID_QUIRK_NOGET },
         { USB_VENDOR_ID_WISEGROUP, USB_DEVICE_ID_DUAL_USB_JOYPAD, HID_QUIRK_NOGET | HID_QUIRK_MULTI_INPUT },
-        { USB_VENDOR_ID_SILVERCREST, USB_DEVICE_ID_SILVERCREST_KB, HID_QUIRK_NOGET },
 
-        { USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_POWERMOUSE, HID_QUIRK_2WHEEL_POWERMOUSE },
+        { USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_MIGHTYMOUSE, HID_QUIRK_MIGHTYMOUSE | HID_QUIRK_INVERT_HWHEEL },
         { USB_VENDOR_ID_A4TECH, USB_DEVICE_ID_A4TECH_WCP32PU, HID_QUIRK_2WHEEL_MOUSE_HACK_7 },
         { USB_VENDOR_ID_CYPRESS, USB_DEVICE_ID_CYPRESS_MOUSE, HID_QUIRK_2WHEEL_MOUSE_HACK_5 },
 
@@ -1711,6 +1693,9 @@ static const struct hid_blacklist {
         { USB_VENDOR_ID_APPLE, 0x0214, HID_QUIRK_POWERBOOK_HAS_FN },
         { USB_VENDOR_ID_APPLE, 0x0215, HID_QUIRK_POWERBOOK_HAS_FN },
         { USB_VENDOR_ID_APPLE, 0x0216, HID_QUIRK_POWERBOOK_HAS_FN },
+        { USB_VENDOR_ID_APPLE, 0x0217, HID_QUIRK_POWERBOOK_HAS_FN },
+        { USB_VENDOR_ID_APPLE, 0x0218, HID_QUIRK_POWERBOOK_HAS_FN },
+        { USB_VENDOR_ID_APPLE, 0x0219, HID_QUIRK_POWERBOOK_HAS_FN },
         { USB_VENDOR_ID_APPLE, 0x030A, HID_QUIRK_POWERBOOK_HAS_FN },
         { USB_VENDOR_ID_APPLE, 0x030B, HID_QUIRK_POWERBOOK_HAS_FN },
 
@@ -1794,6 +1779,14 @@ static struct hid_device *usb_hid_configure(struct usb_interface *intf)
                         (hid_blacklist[n].idProduct == le16_to_cpu(dev->descriptor.idProduct)))
                                 quirks = hid_blacklist[n].quirks;
 
+        /* Many keyboards and mice don't like to be polled for reports,
+         * so we will always set the HID_QUIRK_NOGET flag for them. */
+        if (interface->desc.bInterfaceSubClass == USB_INTERFACE_SUBCLASS_BOOT) {
+                if (interface->desc.bInterfaceProtocol == USB_INTERFACE_PROTOCOL_KEYBOARD ||
+                        interface->desc.bInterfaceProtocol == USB_INTERFACE_PROTOCOL_MOUSE)
+                                quirks |= HID_QUIRK_NOGET;
+        }
+
         if (quirks & HID_QUIRK_IGNORE)
                 return NULL;
 
@@ -2080,11 +2073,29 @@ static int hid_resume(struct usb_interface *intf)
         int status;
 
         clear_bit(HID_SUSPENDED, &hid->iofl);
+        hid->retry_delay = 0;
         status = hid_start_in(hid);
         dev_dbg(&intf->dev, "resume status %d\n", status);
         return status;
 }
 
+/* Treat USB reset pretty much the same as suspend/resume */
+static void hid_pre_reset(struct usb_interface *intf)
+{
+        /* FIXME: What if the interface is already suspended? */
+        hid_suspend(intf, PMSG_ON);
+}
+
+static void hid_post_reset(struct usb_interface *intf)
+{
+        struct usb_device *dev = interface_to_usbdev (intf);
+
+        hid_set_idle(dev, intf->cur_altsetting->desc.bInterfaceNumber, 0, 0);
+        /* FIXME: Any more reinitialization needed? */
+
+        hid_resume(intf);
+}
+
 static struct usb_device_id hid_usb_ids [] = {
         { .match_flags = USB_DEVICE_ID_MATCH_INT_CLASS,
                 .bInterfaceClass = USB_INTERFACE_CLASS_HID },
@@ -2099,6 +2110,8 @@ static struct usb_driver hid_driver = {
         .disconnect =   hid_disconnect,
         .suspend =      hid_suspend,
         .resume =       hid_resume,
+        .pre_reset =    hid_pre_reset,
+        .post_reset =   hid_post_reset,
         .id_table =     hid_usb_ids,
 };
 
diff --git a/drivers/usb/input/hid-input.c b/drivers/usb/input/hid-input.c
index 25bc85f8ce39..028e1ad89f5d 100644
--- a/drivers/usb/input/hid-input.c
+++ b/drivers/usb/input/hid-input.c
@@ -29,9 +29,7 @@
 #include <linux/module.h>
 #include <linux/slab.h>
 #include <linux/kernel.h>
-#include <linux/input.h>
-#include <linux/usb.h>
-#include <linux/usb_input.h>
+#include <linux/usb/input.h>
 
 #undef DEBUG
 
@@ -567,16 +565,14 @@ static void hidinput_configure_usage(struct hid_input *hidinput, struct hid_fiel
                         break;
         }
 
-        set_bit(usage->type, input->evbit);
-
-        while (usage->code <= max && test_and_set_bit(usage->code, bit))
-                usage->code = find_next_zero_bit(bit, max + 1, usage->code);
-
-        if (usage->code > max)
-                goto ignore;
-
-        if (((device->quirks & (HID_QUIRK_2WHEEL_POWERMOUSE)) && (usage->hid == 0x00010032)))
-                map_rel(REL_HWHEEL);
+        if (device->quirks & HID_QUIRK_MIGHTYMOUSE) {
+                if (usage->hid == HID_GD_Z)
+                        map_rel(REL_HWHEEL);
+                else if (usage->code == BTN_1)
+                        map_key(BTN_2);
+                else if (usage->code == BTN_2)
+                        map_key(BTN_1);
+        }
 
         if ((device->quirks & (HID_QUIRK_2WHEEL_MOUSE_HACK_7 | HID_QUIRK_2WHEEL_MOUSE_HACK_5)) &&
                  (usage->type == EV_REL) && (usage->code == REL_WHEEL))
@@ -586,6 +582,15 @@ static void hidinput_configure_usage(struct hid_input *hidinput, struct hid_fiel
                 || ((device->quirks & HID_QUIRK_2WHEEL_MOUSE_HACK_7) && (usage->hid == 0x00090007)))
                 goto ignore;
 
+        set_bit(usage->type, input->evbit);
+
+        while (usage->code <= max && test_and_set_bit(usage->code, bit))
+                usage->code = find_next_zero_bit(bit, max + 1, usage->code);
+
+        if (usage->code > max)
+                goto ignore;
+
+
         if (usage->type == EV_ABS) {
 
                 int a = field->logical_minimum;
@@ -647,6 +652,11 @@ void hidinput_hid_event(struct hid_device *hid, struct hid_field *field, struct
                 return;
         }
 
+        if ((hid->quirks & HID_QUIRK_INVERT_HWHEEL) && (usage->code == REL_HWHEEL)) {
+                input_event(input, usage->type, usage->code, -value);
+                return;
+        }
+
         if ((hid->quirks & HID_QUIRK_2WHEEL_MOUSE_HACK_ON) && (usage->code == REL_WHEEL)) {
                 input_event(input, usage->type, REL_HWHEEL, value);
                 return;
diff --git a/drivers/usb/input/hid.h b/drivers/usb/input/hid.h
index 9c62837b5b89..778e575de352 100644
--- a/drivers/usb/input/hid.h
+++ b/drivers/usb/input/hid.h
@@ -41,6 +41,14 @@
 #define USB_INTERFACE_CLASS_HID         3
 
 /*
+ * USB HID interface subclass and protocol codes
+ */
+
+#define USB_INTERFACE_SUBCLASS_BOOT     1
+#define USB_INTERFACE_PROTOCOL_KEYBOARD 1
+#define USB_INTERFACE_PROTOCOL_MOUSE    2
+
+/*
  * HID class requests
  */
 
@@ -247,10 +255,11 @@ struct hid_item {
 #define HID_QUIRK_2WHEEL_MOUSE_HACK_7           0x00000080
 #define HID_QUIRK_2WHEEL_MOUSE_HACK_5           0x00000100
 #define HID_QUIRK_2WHEEL_MOUSE_HACK_ON          0x00000200
-#define HID_QUIRK_2WHEEL_POWERMOUSE             0x00000400
+#define HID_QUIRK_MIGHTYMOUSE                   0x00000400
 #define HID_QUIRK_CYMOTION                      0x00000800
 #define HID_QUIRK_POWERBOOK_HAS_FN              0x00001000
 #define HID_QUIRK_POWERBOOK_FN_ON               0x00002000
+#define HID_QUIRK_INVERT_HWHEEL                 0x00004000
 
 /*
  * This is the global environment of the parser. This information is
diff --git a/drivers/usb/input/itmtouch.c b/drivers/usb/input/itmtouch.c
index 7618ae5c104f..5c570cc703f3 100644
--- a/drivers/usb/input/itmtouch.c
+++ b/drivers/usb/input/itmtouch.c
@@ -42,11 +42,9 @@
 #include <linux/config.h>
 #include <linux/kernel.h>
 #include <linux/slab.h>
-#include <linux/input.h>
 #include <linux/module.h>
 #include <linux/init.h>
-#include <linux/usb.h>
-#include <linux/usb_input.h>
+#include <linux/usb/input.h>
 
 /* only an 8 byte buffer necessary for a single packet */
 #define ITM_BUFSIZE                     8
diff --git a/drivers/usb/input/kbtab.c b/drivers/usb/input/kbtab.c
index f6d5cead542b..604ade356ead 100644
--- a/drivers/usb/input/kbtab.c
+++ b/drivers/usb/input/kbtab.c
@@ -1,12 +1,9 @@
 #include <linux/kernel.h>
 #include <linux/slab.h>
-#include <linux/input.h>
 #include <linux/module.h>
 #include <linux/init.h>
-#include <linux/usb.h>
-#include <linux/usb_input.h>
+#include <linux/usb/input.h>
 #include <asm/unaligned.h>
-#include <asm/byteorder.h>
 
 /*
  * Version Information
diff --git a/drivers/usb/input/keyspan_remote.c b/drivers/usb/input/keyspan_remote.c
index 3d911976f378..70af985b5db9 100644
--- a/drivers/usb/input/keyspan_remote.c
+++ b/drivers/usb/input/keyspan_remote.c
@@ -18,9 +18,7 @@
 #include <linux/slab.h>
 #include <linux/module.h>
 #include <linux/moduleparam.h>
-#include <linux/input.h>
-#include <linux/usb.h>
-#include <linux/usb_input.h>
+#include <linux/usb/input.h>
 
 #define DRIVER_VERSION  "v0.1"
 #define DRIVER_AUTHOR   "Michael Downey <downey@zymeta.com>"
diff --git a/drivers/usb/input/mtouchusb.c b/drivers/usb/input/mtouchusb.c
index f018953a5485..4fdee4db0729 100644
--- a/drivers/usb/input/mtouchusb.c
+++ b/drivers/usb/input/mtouchusb.c
@@ -42,11 +42,9 @@
 #include <linux/config.h>
 #include <linux/kernel.h>
 #include <linux/slab.h>
-#include <linux/input.h>
 #include <linux/module.h>
 #include <linux/init.h>
-#include <linux/usb.h>
-#include <linux/usb_input.h>
+#include <linux/usb/input.h>
 
 #define MTOUCHUSB_MIN_XC                0x0
 #define MTOUCHUSB_MAX_RAW_XC            0x4000
diff --git a/drivers/usb/input/powermate.c b/drivers/usb/input/powermate.c
index fdf0f788062c..b3c0d0c3eae9 100644
--- a/drivers/usb/input/powermate.c
+++ b/drivers/usb/input/powermate.c
@@ -30,12 +30,10 @@
 
 #include <linux/kernel.h>
 #include <linux/slab.h>
-#include <linux/input.h>
 #include <linux/module.h>
 #include <linux/init.h>
 #include <linux/spinlock.h>
-#include <linux/usb.h>
-#include <linux/usb_input.h>
+#include <linux/usb/input.h>
 
 #define POWERMATE_VENDOR        0x077d  /* Griffin Technology, Inc. */
 #define POWERMATE_PRODUCT_NEW   0x0410  /* Griffin PowerMate */
diff --git a/drivers/usb/input/touchkitusb.c b/drivers/usb/input/touchkitusb.c
index 697c5e573a11..da7b0bf51aff 100644
--- a/drivers/usb/input/touchkitusb.c
+++ b/drivers/usb/input/touchkitusb.c
@@ -27,11 +27,9 @@
 #include <linux/config.h>
 #include <linux/kernel.h>
 #include <linux/slab.h>
-#include <linux/input.h>
 #include <linux/module.h>
 #include <linux/init.h>
-#include <linux/usb.h>
-#include <linux/usb_input.h>
+#include <linux/usb/input.h>
 
 #define TOUCHKIT_MIN_XC                 0x0
 #define TOUCHKIT_MAX_XC                 0x07ff
diff --git a/drivers/usb/input/usbkbd.c b/drivers/usb/input/usbkbd.c
index 2f3edc26cb50..5067a6ae650f 100644
--- a/drivers/usb/input/usbkbd.c
+++ b/drivers/usb/input/usbkbd.c
@@ -29,10 +29,8 @@
 #include <linux/kernel.h>
 #include <linux/slab.h>
 #include <linux/module.h>
-#include <linux/input.h>
 #include <linux/init.h>
-#include <linux/usb.h>
-#include <linux/usb_input.h>
+#include <linux/usb/input.h>
 
 /*
  * Version Information
diff --git a/drivers/usb/input/usbmouse.c b/drivers/usb/input/usbmouse.c
index af526135d210..446935b671d9 100644
--- a/drivers/usb/input/usbmouse.c
+++ b/drivers/usb/input/usbmouse.c
@@ -28,11 +28,9 @@
 
 #include <linux/kernel.h>
 #include <linux/slab.h>
-#include <linux/input.h>
 #include <linux/module.h>
 #include <linux/init.h>
-#include <linux/usb.h>
-#include <linux/usb_input.h>
+#include <linux/usb/input.h>
 
 /*
  * Version Information
diff --git a/drivers/usb/input/usbtouchscreen.c b/drivers/usb/input/usbtouchscreen.c
index e9a07c1e905b..3b175aa482cd 100644
--- a/drivers/usb/input/usbtouchscreen.c
+++ b/drivers/usb/input/usbtouchscreen.c
@@ -39,7 +39,7 @@
 #include <linux/module.h>
 #include <linux/init.h>
 #include <linux/usb.h>
-#include <linux/usb_input.h>
+#include <linux/usb/input.h>
 
 
 #define DRIVER_VERSION          "v0.3"
diff --git a/drivers/usb/input/wacom.c b/drivers/usb/input/wacom.c
index cf84c6096f29..369461a70b72 100644
--- a/drivers/usb/input/wacom.c
+++ b/drivers/usb/input/wacom.c
@@ -69,13 +69,10 @@
 
 #include <linux/kernel.h>
 #include <linux/slab.h>
-#include <linux/input.h>
 #include <linux/module.h>
 #include <linux/init.h>
-#include <linux/usb.h>
-#include <linux/usb_input.h>
+#include <linux/usb/input.h>
 #include <asm/unaligned.h>
-#include <asm/byteorder.h>
 
 /*
  * Version Information
diff --git a/drivers/usb/input/xpad.c b/drivers/usb/input/xpad.c
index e278489a80c6..cfd4a4e04334 100644
--- a/drivers/usb/input/xpad.c
+++ b/drivers/usb/input/xpad.c
@@ -56,13 +56,11 @@
 
 #include <linux/config.h>
 #include <linux/kernel.h>
-#include <linux/input.h>
 #include <linux/init.h>
 #include <linux/slab.h>
 #include <linux/module.h>
 #include <linux/smp_lock.h>
-#include <linux/usb.h>
-#include <linux/usb_input.h>
+#include <linux/usb/input.h>
 
 #define DRIVER_VERSION "v0.0.5"
 #define DRIVER_AUTHOR "Marko Friedemann <mfr@bmx-chemnitz.de>"
diff --git a/drivers/usb/input/yealink.c b/drivers/usb/input/yealink.c
index 37d2f0ba0319..24aedbb20f03 100644
--- a/drivers/usb/input/yealink.c
+++ b/drivers/usb/input/yealink.c
@@ -48,13 +48,11 @@
 
 #include <linux/config.h>
 #include <linux/kernel.h>
-#include <linux/input.h>
 #include <linux/init.h>
 #include <linux/slab.h>
 #include <linux/module.h>
 #include <linux/rwsem.h>
-#include <linux/usb.h>
-#include <linux/usb_input.h>
+#include <linux/usb/input.h>
 
 #include "map_to_7segment.h"
 #include "yealink.h"
diff --git a/drivers/usb/misc/Kconfig b/drivers/usb/misc/Kconfig
index 8ba6a701e9c1..daa486dde8cf 100644
--- a/drivers/usb/misc/Kconfig
+++ b/drivers/usb/misc/Kconfig
@@ -88,6 +88,20 @@ config USB_LED
           To compile this driver as a module, choose M here: the
           module will be called usbled.
 
+config USB_CY7C63
+        tristate "Cypress CY7C63xxx USB driver support"
+        depends on USB
+        help
+          Say Y here if you want to connect a Cypress CY7C63xxx
+          micro controller to your computer's USB port. This driver
+          supports the pre-programmed devices (incl. firmware) by
+          AK Modul-Bus Computer GmbH.
+
+          Please see: http://www.ak-modul-bus.de/stat/mikrocontroller.html
+
+          To compile this driver as a module, choose M here: the
+          module will be called cy7c63.
+
 config USB_CYTHERM
         tristate "Cypress USB thermometer driver support"
         depends on USB
@@ -137,6 +151,15 @@ config USB_IDMOUSE
 
           See also <http://www.fs.tum.de/~echtler/idmouse/>.
 
+config USB_APPLEDISPLAY
+        tristate "Apple Cinema Display support"
+        depends on USB
+        select BACKLIGHT_LCD_SUPPORT
+        select BACKLIGHT_CLASS_DEVICE
+        help
+          Say Y here if you want to control the backlight of Apple Cinema
+          Displays over USB. This driver provides a sysfs interface.
+
 source "drivers/usb/misc/sisusbvga/Kconfig"
 
 config USB_LD
diff --git a/drivers/usb/misc/Makefile b/drivers/usb/misc/Makefile
index 6c693bc68e2e..f25a97227297 100644
--- a/drivers/usb/misc/Makefile
+++ b/drivers/usb/misc/Makefile
@@ -4,6 +4,7 @@
 #
 
 obj-$(CONFIG_USB_AUERSWALD)     += auerswald.o
+obj-$(CONFIG_USB_CY7C63)        += cy7c63.o
 obj-$(CONFIG_USB_CYTHERM)       += cytherm.o
 obj-$(CONFIG_USB_EMI26)         += emi26.o
 obj-$(CONFIG_USB_EMI62)         += emi62.o
@@ -17,6 +18,7 @@ obj-$(CONFIG_USB_PHIDGETSERVO)	+= phidgetservo.o
 obj-$(CONFIG_USB_RIO500)        += rio500.o
 obj-$(CONFIG_USB_TEST)          += usbtest.o
 obj-$(CONFIG_USB_USS720)        += uss720.o
+obj-$(CONFIG_USB_APPLEDISPLAY)  += appledisplay.o
 
 obj-$(CONFIG_USB_SISUSBVGA)     += sisusbvga/
 
diff --git a/drivers/usb/misc/appledisplay.c b/drivers/usb/misc/appledisplay.c
new file mode 100644
index 000000000000..bfde82f5d180
--- /dev/null
+++ b/drivers/usb/misc/appledisplay.c
@@ -0,0 +1,383 @@
+/*
+ * Apple Cinema Display driver
+ *
+ * Copyright (C) 2006  Michael Hanselmann (linux-kernel@hansmi.ch)
+ *
+ * Thanks to Caskey L. Dickson for his work with acdctl.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+ */
+
+#include <linux/config.h>
+#include <linux/kernel.h>
+#include <linux/errno.h>
+#include <linux/init.h>
+#include <linux/module.h>
+#include <linux/usb.h>
+#include <linux/backlight.h>
+#include <linux/timer.h>
+#include <linux/workqueue.h>
+#include <asm/atomic.h>
+#include <asm/semaphore.h>
+
+#define APPLE_VENDOR_ID         0x05AC
+
+#define USB_REQ_GET_REPORT      0x01
+#define USB_REQ_SET_REPORT      0x09
+
+#define ACD_USB_TIMEOUT         250
+
+#define ACD_USB_EDID            0x0302
+#define ACD_USB_BRIGHTNESS      0x0310
+
+#define ACD_BTN_NONE            0
+#define ACD_BTN_BRIGHT_UP       3
+#define ACD_BTN_BRIGHT_DOWN     4
+
+#define ACD_URB_BUFFER_LEN      2
+#define ACD_MSG_BUFFER_LEN      2
+
+#define APPLEDISPLAY_DEVICE(prod)                               \
+        .match_flags = USB_DEVICE_ID_MATCH_DEVICE |             \
+                       USB_DEVICE_ID_MATCH_INT_CLASS |          \
+                       USB_DEVICE_ID_MATCH_INT_PROTOCOL,        \
+        .idVendor = APPLE_VENDOR_ID,                            \
+        .idProduct = (prod),                                    \
+        .bInterfaceClass = USB_CLASS_HID,                       \
+        .bInterfaceProtocol = 0x00
+
+/* table of devices that work with this driver */
+static struct usb_device_id appledisplay_table [] = {
+        { APPLEDISPLAY_DEVICE(0x9218) },
+        { APPLEDISPLAY_DEVICE(0x9219) },
+        { APPLEDISPLAY_DEVICE(0x921d) },
+
+        /* Terminating entry */
+        { }
+};
+MODULE_DEVICE_TABLE(usb, appledisplay_table);
+
+/* Structure to hold all of our device specific stuff */
+struct appledisplay {
+        struct usb_device *udev;        /* usb device */
+        struct urb *urb;                /* usb request block */
+        struct backlight_device *bd;    /* backlight device */
+        char *urbdata;                  /* interrupt URB data buffer */
+        char *msgdata;                  /* control message data buffer */
+
+        struct work_struct work;
+        int button_pressed;
+        spinlock_t lock;
+};
+
+static atomic_t count_displays = ATOMIC_INIT(0);
+static struct workqueue_struct *wq;
+
+static void appledisplay_complete(struct urb *urb, struct pt_regs *regs)
+{
+        struct appledisplay *pdata = urb->context;
+        unsigned long flags;
+        int retval;
+
+        switch (urb->status) {
+        case 0:
+                /* success */
+                break;
+        case -EOVERFLOW:
+                printk(KERN_ERR "appletouch: OVERFLOW with data "
+                        "length %d, actual length is %d\n",
+                        ACD_URB_BUFFER_LEN, pdata->urb->actual_length);
+        case -ECONNRESET:
+        case -ENOENT:
+        case -ESHUTDOWN:
+                /* This urb is terminated, clean up */
+                dbg("%s - urb shutting down with status: %d",
+                        __FUNCTION__, urb->status);
+                return;
+        default:
+                dbg("%s - nonzero urb status received: %d",
+                        __FUNCTION__, urb->status);
+                goto exit;
+        }
+
+        spin_lock_irqsave(&pdata->lock, flags);
+
+        switch(pdata->urbdata[1]) {
+        case ACD_BTN_BRIGHT_UP:
+        case ACD_BTN_BRIGHT_DOWN:
+                pdata->button_pressed = 1;
+                queue_work(wq, &pdata->work);
+                break;
+        case ACD_BTN_NONE:
+        default:
+                pdata->button_pressed = 0;
+                break;
+        }
+
+        spin_unlock_irqrestore(&pdata->lock, flags);
+
+exit:
+        retval = usb_submit_urb(pdata->urb, GFP_ATOMIC);
+        if (retval) {
+                err("%s - usb_submit_urb failed with result %d",
+                        __FUNCTION__, retval);
+        }
+}
+
+static int appledisplay_bl_update_status(struct backlight_device *bd)
+{
+        struct appledisplay *pdata = class_get_devdata(&bd->class_dev);
+        int retval;
+
+        pdata->msgdata[0] = 0x10;
+        pdata->msgdata[1] = bd->props->brightness;
+
+        retval = usb_control_msg(
+                pdata->udev,
+                usb_sndctrlpipe(pdata->udev, 0),
+                USB_REQ_SET_REPORT,
+                USB_DIR_OUT | USB_TYPE_CLASS | USB_RECIP_INTERFACE,
+                ACD_USB_BRIGHTNESS,
+                0,
+                pdata->msgdata, 2,
+                ACD_USB_TIMEOUT);
+
+        return retval;
+}
+
+static int appledisplay_bl_get_brightness(struct backlight_device *bd)
+{
+        struct appledisplay *pdata = class_get_devdata(&bd->class_dev);
+        int retval;
+
+        retval = usb_control_msg(
+                pdata->udev,
+                usb_rcvctrlpipe(pdata->udev, 0),
+                USB_REQ_GET_REPORT,
+                USB_DIR_IN | USB_TYPE_CLASS | USB_RECIP_INTERFACE,
+                ACD_USB_BRIGHTNESS,
+                0,
+                pdata->msgdata, 2,
+                ACD_USB_TIMEOUT);
+
+        if (retval < 0)
+                return retval;
+        else
+                return pdata->msgdata[1];
+}
+
+static struct backlight_properties appledisplay_bl_data = {
+        .owner          = THIS_MODULE,
+        .get_brightness = appledisplay_bl_get_brightness,
+        .update_status  = appledisplay_bl_update_status,
+        .max_brightness = 0xFF
+};
+
+static void appledisplay_work(void *private)
+{
+        struct appledisplay *pdata = private;
+        int retval;
+
+        up(&pdata->bd->sem);
+        retval = appledisplay_bl_get_brightness(pdata->bd);
+        if (retval >= 0)
+                pdata->bd->props->brightness = retval;
+        down(&pdata->bd->sem);
+
+        /* Poll again in about 125ms if there's still a button pressed */
+        if (pdata->button_pressed)
+                schedule_delayed_work(&pdata->work, HZ / 8);
+}
+
+static int appledisplay_probe(struct usb_interface *iface,
+        const struct usb_device_id *id)
+{
+        struct appledisplay *pdata;
+        struct usb_device *udev = interface_to_usbdev(iface);
+        struct usb_host_interface *iface_desc;
+        struct usb_endpoint_descriptor *endpoint;
+        int int_in_endpointAddr = 0;
+        int i, retval = -ENOMEM, brightness;
+        char bl_name[20];
+
+        /* set up the endpoint information */
+        /* use only the first interrupt-in endpoint */
+        iface_desc = iface->cur_altsetting;
+        for (i = 0; i < iface_desc->desc.bNumEndpoints; i++) {
+                endpoint = &iface_desc->endpoint[i].desc;
+                if (!int_in_endpointAddr &&
+                    (endpoint->bEndpointAddress & USB_DIR_IN) &&
+                    ((endpoint->bmAttributes & USB_ENDPOINT_XFERTYPE_MASK) ==
+                     USB_ENDPOINT_XFER_INT)) {
+                        /* we found an interrupt in endpoint */
+                        int_in_endpointAddr = endpoint->bEndpointAddress;
+                        break;
+                }
+        }
+        if (!int_in_endpointAddr) {
+                err("Could not find int-in endpoint");
+                return -EIO;
+        }
+
+        /* allocate memory for our device state and initialize it */
+        pdata = kzalloc(sizeof(struct appledisplay), GFP_KERNEL);
+        if (!pdata) {
+                retval = -ENOMEM;
+                err("Out of memory");
+                goto error;
+        }
+
+        pdata->udev = udev;
+
+        spin_lock_init(&pdata->lock);
+        INIT_WORK(&pdata->work, appledisplay_work, pdata);
+
+        /* Allocate buffer for control messages */
+        pdata->msgdata = kmalloc(ACD_MSG_BUFFER_LEN, GFP_KERNEL);
+        if (!pdata->msgdata) {
+                retval = -ENOMEM;
+                err("appledisplay: Allocating buffer for control messages "
+                        "failed");
+                goto error;
+        }
+
+        /* Allocate interrupt URB */
+        pdata->urb = usb_alloc_urb(0, GFP_KERNEL);
+        if (!pdata->urb) {
+                retval = -ENOMEM;
+                err("appledisplay: Allocating URB failed");
+                goto error;
+        }
+
+        /* Allocate buffer for interrupt data */
+        pdata->urbdata = usb_buffer_alloc(pdata->udev, ACD_URB_BUFFER_LEN,
+                GFP_KERNEL, &pdata->urb->transfer_dma);
+        if (!pdata->urbdata) {
+                retval = -ENOMEM;
+                err("appledisplay: Allocating URB buffer failed");
+                goto error;
+        }
+
+        /* Configure interrupt URB */
+        usb_fill_int_urb(pdata->urb, udev,
+                usb_rcvintpipe(udev, int_in_endpointAddr),
+                pdata->urbdata, ACD_URB_BUFFER_LEN, appledisplay_complete,
+                pdata, 1);
+        if (usb_submit_urb(pdata->urb, GFP_KERNEL)) {
+                retval = -EIO;
+                err("appledisplay: Submitting URB failed");
+                goto error;
+        }
+
+        /* Register backlight device */
+        snprintf(bl_name, sizeof(bl_name), "appledisplay%d",
+                atomic_inc_return(&count_displays) - 1);
+        pdata->bd = backlight_device_register(bl_name, pdata,
+                                                &appledisplay_bl_data);
+        if (IS_ERR(pdata->bd)) {
+                err("appledisplay: Backlight registration failed");
+                goto error;
+        }
+
+        /* Try to get brightness */
+        up(&pdata->bd->sem);
+        brightness = appledisplay_bl_get_brightness(pdata->bd);
+        down(&pdata->bd->sem);
+
+        if (brightness < 0) {
+                retval = brightness;
+                err("appledisplay: Error while getting initial brightness: %d", retval);
+                goto error;
+        }
+
+        /* Set brightness in backlight device */
+        up(&pdata->bd->sem);
+        pdata->bd->props->brightness = brightness;
+        down(&pdata->bd->sem);
+
+        /* save our data pointer in the interface device */
+        usb_set_intfdata(iface, pdata);
+
+        printk(KERN_INFO "appledisplay: Apple Cinema Display connected\n");
+
+        return 0;
+
+error:
+        if (pdata) {
+                if (pdata->urb) {
+                        usb_kill_urb(pdata->urb);
+                        if (pdata->urbdata)
+                                usb_buffer_free(pdata->udev, ACD_URB_BUFFER_LEN,
+                                        pdata->urbdata, pdata->urb->transfer_dma);
+                        usb_free_urb(pdata->urb);
+                }
+                if (pdata->bd)
+                        backlight_device_unregister(pdata->bd);
+                kfree(pdata->msgdata);
+        }
+        usb_set_intfdata(iface, NULL);
+        kfree(pdata);
+        return retval;
+}
+
+static void appledisplay_disconnect(struct usb_interface *iface)
+{
+        struct appledisplay *pdata = usb_get_intfdata(iface);
+
+        if (pdata) {
+                usb_kill_urb(pdata->urb);
+                cancel_delayed_work(&pdata->work);
+                backlight_device_unregister(pdata->bd);
+                usb_buffer_free(pdata->udev, ACD_URB_BUFFER_LEN,
+                        pdata->urbdata, pdata->urb->transfer_dma);
+                usb_free_urb(pdata->urb);
+                kfree(pdata->msgdata);
+                kfree(pdata);
+        }
+
+        printk(KERN_INFO "appledisplay: Apple Cinema Display disconnected\n");
+}
+
+static struct usb_driver appledisplay_driver = {
+        .name           = "appledisplay",
+        .probe          = appledisplay_probe,
+        .disconnect     = appledisplay_disconnect,
+        .id_table       = appledisplay_table,
+};
+
+static int __init appledisplay_init(void)
+{
+        wq = create_singlethread_workqueue("appledisplay");
+        if (!wq) {
+                err("Could not create work queue\n");
+                return -ENOMEM;
+        }
+
+        return usb_register(&appledisplay_driver);
+}
+
+static void __exit appledisplay_exit(void)
+{
+        flush_workqueue(wq);
+        destroy_workqueue(wq);
+        usb_deregister(&appledisplay_driver);
+}
+
+MODULE_AUTHOR("Michael Hanselmann");
+MODULE_DESCRIPTION("Apple Cinema Display driver");
+MODULE_LICENSE("GPL");
+
+module_init(appledisplay_init);
+module_exit(appledisplay_exit);
diff --git a/drivers/usb/misc/cy7c63.c b/drivers/usb/misc/cy7c63.c
new file mode 100644
index 000000000000..8a1c10b89b76
--- /dev/null
+++ b/drivers/usb/misc/cy7c63.c
@@ -0,0 +1,244 @@
+/*
+* cy7c63.c
+*
+* Copyright (c) 2006 Oliver Bock (bock@fh-wolfenbuettel.de)
+*
+*       This driver is based on the Cypress Thermometer USB Driver by
+*       Marcus Maul and the 2.0 version of Greg Kroah-Hartman's
+*       USB Skeleton driver.
+*
+*       Is is a generic driver for the Cypress CY7C63000 family.
+*       For the time being it enables you to toggle the single I/O ports
+*       of the device.
+*
+*       Supported vendors:      AK Modul-Bus Computer GmbH
+*       Supported devices:      CY7C63001A-PC (to be continued...)
+*       Supported functions:    Read/Write Ports (to be continued...)
+*
+*       Chipsets families:      CY7C63000, CY7C63001, CY7C63100, CY7C63101
+*
+*
+*       This program is free software; you can redistribute it and/or
+*       modify it under the terms of the GNU General Public License as
+*       published by the Free Software Foundation, version 2.
+*/
+
+#include <linux/init.h>
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <linux/usb.h>
+
+#define DRIVER_AUTHOR           "Oliver Bock (bock@fh-wolfenbuettel.de)"
+#define DRIVER_DESC             "Cypress CY7C63xxx USB driver"
+
+#define CY7C63_VENDOR_ID        0xa2c
+#define CY7C63_PRODUCT_ID       0x8
+
+#define CY7C63_READ_PORT        0x4
+#define CY7C63_WRITE_PORT       0x5
+#define CY7C63_READ_RAM         0x2
+#define CY7C63_WRITE_RAM        0x3
+#define CY7C63_READ_ROM         0x1
+
+#define CY7C63_READ_PORT_ID0    0
+#define CY7C63_WRITE_PORT_ID0   0
+#define CY7C63_READ_PORT_ID1    0x2
+#define CY7C63_WRITE_PORT_ID1   1
+
+#define CY7C63_MAX_REQSIZE      8
+
+
+/* table of devices that work with this driver */
+static struct usb_device_id cy7c63_table [] = {
+        { USB_DEVICE(CY7C63_VENDOR_ID, CY7C63_PRODUCT_ID) },
+        { }
+};
+MODULE_DEVICE_TABLE(usb, cy7c63_table);
+
+/* structure to hold all of our device specific stuff */
+struct cy7c63 {
+        struct usb_device *     udev;
+        char                    port0;
+        char                    port1;
+};
+
+/* used to send usb control messages to device */
+int vendor_command(struct cy7c63 *dev, unsigned char request,
+                         unsigned char address, unsigned char data) {
+
+        int retval = 0;
+        unsigned int pipe;
+        unsigned char *iobuf;
+
+        /* allocate some memory for the i/o buffer*/
+        iobuf = kzalloc(CY7C63_MAX_REQSIZE, GFP_KERNEL);
+        if (!iobuf) {
+                dev_err(&dev->udev->dev, "Out of memory!\n");
+                retval = -ENOMEM;
+                goto error;
+        }
+
+        dev_dbg(&dev->udev->dev, "Sending usb_control_msg (data: %d)\n", data);
+
+        /* prepare usb control message and send it upstream */
+        pipe = usb_rcvctrlpipe(dev->udev, 0);
+        retval = usb_control_msg(dev->udev, pipe, request,
+                                USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_OTHER,
+                                address, data, iobuf, CY7C63_MAX_REQSIZE,
+                                USB_CTRL_GET_TIMEOUT);
+
+        /* store returned data (more READs to be added!) */
+        switch (request) {
+                case CY7C63_READ_PORT:
+                        if (address == CY7C63_READ_PORT_ID0) {
+                                dev->port0 = iobuf[1];
+                                dev_dbg(&dev->udev->dev,
+                                        "READ_PORT0 returned: %d\n",dev->port0);
+                        }
+                        else if (address == CY7C63_READ_PORT_ID1) {
+                                dev->port1 = iobuf[1];
+                                dev_dbg(&dev->udev->dev,
+                                        "READ_PORT1 returned: %d\n",dev->port1);
+                        }
+                        break;
+        }
+
+        kfree(iobuf);
+error:
+        return retval;
+}
+
+#define get_set_port(num,read_id,write_id) \
+static ssize_t set_port##num(struct device *dev, struct device_attribute *attr, \
+                                        const char *buf, size_t count) {        \
+                                                                                \
+        int value;                                                              \
+        int result = 0;                                                         \
+                                                                                \
+        struct usb_interface *intf = to_usb_interface(dev);                     \
+        struct cy7c63 *cyp = usb_get_intfdata(intf);                            \
+                                                                                \
+        dev_dbg(&cyp->udev->dev, "WRITE_PORT%d called\n", num);                 \
+                                                                                \
+        /* validate input data */                                               \
+        if (sscanf(buf, "%d", &value) < 1) {                                    \
+                result = -EINVAL;                                               \
+                goto error;                                                     \
+        }                                                                       \
+        if (value>255 || value<0) {                                             \
+                result = -EINVAL;                                               \
+                goto error;                                                     \
+        }                                                                       \
+                                                                                \
+        result = vendor_command(cyp, CY7C63_WRITE_PORT, write_id,               \
+                                         (unsigned char)value);                 \
+                                                                                \
+        dev_dbg(&cyp->udev->dev, "Result of vendor_command: %d\n\n",result);    \
+error:                                                                          \
+        return result < 0 ? result : count;                                     \
+}                                                                               \
+                                                                                \
+static ssize_t get_port##num(struct device *dev,                                \
+                                 struct device_attribute *attr, char *buf) {    \
+                                                                                \
+        int result = 0;                                                         \
+                                                                                \
+        struct usb_interface *intf = to_usb_interface(dev);                     \
+        struct cy7c63 *cyp = usb_get_intfdata(intf);                            \
+                                                                                \
+        dev_dbg(&cyp->udev->dev, "READ_PORT%d called\n", num);                  \
+                                                                                \
+        result = vendor_command(cyp, CY7C63_READ_PORT, read_id, 0);             \
+                                                                                \
+        dev_dbg(&cyp->udev->dev, "Result of vendor_command: %d\n\n", result);   \
+                                                                                \
+        return sprintf(buf, "%d", cyp->port##num);                              \
+}                                                                               \
+static DEVICE_ATTR(port##num, S_IWUGO | S_IRUGO, get_port##num, set_port##num);
+
+get_set_port(0, CY7C63_READ_PORT_ID0, CY7C63_WRITE_PORT_ID0);
+get_set_port(1, CY7C63_READ_PORT_ID1, CY7C63_WRITE_PORT_ID1);
+
+static int cy7c63_probe(struct usb_interface *interface,
+                        const struct usb_device_id *id) {
+
+        struct cy7c63 *dev = NULL;
+        int retval = -ENOMEM;
+
+        /* allocate memory for our device state and initialize it */
+        dev = kzalloc(sizeof(*dev), GFP_KERNEL);
+        if (dev == NULL) {
+                dev_err(&dev->udev->dev, "Out of memory!\n");
+                goto error;
+        }
+
+        dev->udev = usb_get_dev(interface_to_usbdev(interface));
+
+        /* save our data pointer in this interface device */
+        usb_set_intfdata(interface, dev);
+
+        /* create device attribute files */
+        device_create_file(&interface->dev, &dev_attr_port0);
+        device_create_file(&interface->dev, &dev_attr_port1);
+
+        /* let the user know what node this device is now attached to */
+        dev_info(&interface->dev,
+                "Cypress CY7C63xxx device now attached\n");
+
+        retval = 0;
+error:
+        return retval;
+}
+
+static void cy7c63_disconnect(struct usb_interface *interface) {
+
+        struct cy7c63 *dev;
+
+        dev = usb_get_intfdata(interface);
+        usb_set_intfdata(interface, NULL);
+
+        /* remove device attribute files */
+        device_remove_file(&interface->dev, &dev_attr_port0);
+        device_remove_file(&interface->dev, &dev_attr_port1);
+
+        usb_put_dev(dev->udev);
+
+        dev_info(&interface->dev,
+                "Cypress CY7C63xxx device now disconnected\n");
+
+        kfree(dev);
+}
+
+static struct usb_driver cy7c63_driver = {
+        .name = "cy7c63",
+        .probe = cy7c63_probe,
+        .disconnect = cy7c63_disconnect,
+        .id_table = cy7c63_table,
+};
+
+static int __init cy7c63_init(void) {
+
+        int result;
+
+        /* register this driver with the USB subsystem */
+        result = usb_register(&cy7c63_driver);
+        if (result) {
+                err("Function usb_register failed! Error number: %d\n", result);
+        }
+
+        return result;
+}
+
+static void __exit cy7c63_exit(void) {
+
+        /* deregister this driver with the USB subsystem */
+        usb_deregister(&cy7c63_driver);
+}
+
+module_init(cy7c63_init);
+module_exit(cy7c63_exit);
+
+MODULE_AUTHOR(DRIVER_AUTHOR);
+MODULE_DESCRIPTION(DRIVER_DESC);
+
+MODULE_LICENSE("GPL");
diff --git a/drivers/usb/misc/phidgetkit.c b/drivers/usb/misc/phidgetkit.c
index 997db5d8e35b..13aeea2026cc 100644
--- a/drivers/usb/misc/phidgetkit.c
+++ b/drivers/usb/misc/phidgetkit.c
@@ -1,7 +1,8 @@
 /*
  * USB PhidgetInterfaceKit driver 1.0
  *
- * Copyright (C) 2004 Sean Young <sean@mess.org>
+ * Copyright (C) 2004, 2006 Sean Young <sean@mess.org>
+ * Copyright (C) 2005 Daniel Saakes <daniel@saakes.net>
  * Copyright (C) 2004 Greg Kroah-Hartman <greg@kroah.com>
  *
  * This program is free software; you can redistribute it and/or modify
@@ -25,6 +26,7 @@
 
 #define USB_VENDOR_ID_GLAB              0x06c2
 #define USB_DEVICE_ID_INTERFACEKIT004   0x0040
+#define USB_DEVICE_ID_INTERFACEKIT01616 0x0044
 #define USB_DEVICE_ID_INTERFACEKIT888   0x0045
 #define USB_DEVICE_ID_INTERFACEKIT047   0x0051
 #define USB_DEVICE_ID_INTERFACEKIT088   0x0053
@@ -32,7 +34,9 @@
 #define USB_VENDOR_ID_WISEGROUP         0x0925
 #define USB_DEVICE_ID_INTERFACEKIT884   0x8201
 
-#define MAX_INTERFACES                  8
+#define MAX_INTERFACES                  16
+
+#define URB_INT_SIZE                    8
 
 struct driver_interfacekit {
         int sensors;
@@ -52,19 +56,24 @@ ifkit(8, 8, 8, 0);
 ifkit(0, 4, 7, 1);
 ifkit(8, 8, 4, 0);
 ifkit(0, 8, 8, 1);
+ifkit(0, 16, 16, 0);
 
-struct phidget_interfacekit {
+struct interfacekit {
         struct usb_device *udev;
         struct usb_interface *intf;
         struct driver_interfacekit *ifkit;
-        int outputs[MAX_INTERFACES];
-        int inputs[MAX_INTERFACES];
-        int sensors[MAX_INTERFACES];
+        unsigned long outputs;
+        u8 inputs[MAX_INTERFACES];
+        u16 sensors[MAX_INTERFACES];
         u8 lcd_files_on;
 
         struct urb *irq;
         unsigned char *data;
         dma_addr_t data_dma;
+
+        struct work_struct do_notify;
+        unsigned long input_events;
+        unsigned long sensor_events;
 };
 
 static struct usb_device_id id_table[] = {
@@ -76,33 +85,33 @@ static struct usb_device_id id_table[] = {
                 .driver_info = (kernel_ulong_t)&ph_047},
         {USB_DEVICE(USB_VENDOR_ID_GLAB, USB_DEVICE_ID_INTERFACEKIT088),
                 .driver_info = (kernel_ulong_t)&ph_088},
+        {USB_DEVICE(USB_VENDOR_ID_GLAB, USB_DEVICE_ID_INTERFACEKIT01616),
+                .driver_info = (kernel_ulong_t)&ph_01616},
         {USB_DEVICE(USB_VENDOR_ID_WISEGROUP, USB_DEVICE_ID_INTERFACEKIT884),
                 .driver_info = (kernel_ulong_t)&ph_884},
         {}
 };
 MODULE_DEVICE_TABLE(usb, id_table);
 
-static int change_outputs(struct phidget_interfacekit *kit, int output_num, int enable)
+static int change_outputs(struct interfacekit *kit, int output_num, int enable)
 {
-        unsigned char *buffer;
+        u8 *buffer;
         int retval;
-        int n;
+
+        if (enable)
+                set_bit(output_num, &kit->outputs);
+        else
+                clear_bit(output_num, &kit->outputs);
 
         buffer = kzalloc(4, GFP_KERNEL);
         if (!buffer) {
-                dev_err(&kit->udev->dev, "%s - out of memory\n",
-                        __FUNCTION__);
+                dev_err(&kit->udev->dev, "%s - out of memory\n", __FUNCTION__);
                 return -ENOMEM;
         }
+        buffer[0] = (u8)kit->outputs;
+        buffer[1] = (u8)(kit->outputs >> 8);
 
-        kit->outputs[output_num] = enable;
-        for (n=0; n<8; n++) {
-                if (kit->outputs[n]) {
-                        buffer[0] |= 1 << n;
-                }
-        }
-
-        dev_dbg(&kit->udev->dev, "sending data: %02x\n", buffer[0]);
+        dev_dbg(&kit->udev->dev, "sending data: 0x%04x\n", (u16)kit->outputs);
 
         retval = usb_control_msg(kit->udev,
                          usb_sndctrlpipe(kit->udev, 0),
@@ -116,10 +125,10 @@ static int change_outputs(struct phidget_interfacekit *kit, int output_num, int
         return retval < 0 ? retval : 0;
 }
 
-static int change_string(struct phidget_interfacekit *kit, const char *display, unsigned char row)
+static int change_string(struct interfacekit *kit, const char *display, unsigned char row)
 {
         unsigned char *buffer;
-        unsigned char *form_buffer;
+        unsigned char *form_buffer;
         int retval = -ENOMEM;
         int i,j, len, buf_ptr;
         
@@ -175,7 +184,7 @@ exit:
 static ssize_t lcd_line_##number(struct device *dev, struct device_attribute *attr, const char *buf, size_t count)      \
 {                                                                                       \
         struct usb_interface *intf = to_usb_interface(dev);                             \
-        struct phidget_interfacekit *kit = usb_get_intfdata(intf);                      \
+        struct interfacekit *kit = usb_get_intfdata(intf);                              \
         change_string(kit, buf, number - 1);                                            \
         return count;                                                                   \
 }                                                                                       \
@@ -186,7 +195,7 @@ set_lcd_line(2);
 static ssize_t set_backlight(struct device *dev, struct device_attribute *attr, const char *buf, size_t count)
 {
         struct usb_interface *intf = to_usb_interface(dev);
-        struct phidget_interfacekit *kit = usb_get_intfdata(intf);
+        struct interfacekit *kit = usb_get_intfdata(intf);
         int enabled;
         unsigned char *buffer;
         int retval = -ENOMEM;
@@ -220,7 +229,7 @@ exit:
 }
 static DEVICE_ATTR(backlight, S_IWUGO, NULL, set_backlight);
 
-static void remove_lcd_files(struct phidget_interfacekit *kit)
+static void remove_lcd_files(struct interfacekit *kit)
 {
         if (kit->lcd_files_on) {
                 dev_dbg(&kit->udev->dev, "Removing lcd files\n");
@@ -233,7 +242,7 @@ static void remove_lcd_files(struct phidget_interfacekit *kit)
 static ssize_t enable_lcd_files(struct device *dev, struct device_attribute *attr, const char *buf, size_t count)
 {
         struct usb_interface *intf = to_usb_interface(dev);
-        struct phidget_interfacekit *kit = usb_get_intfdata(intf);
+        struct interfacekit *kit = usb_get_intfdata(intf);
         int enable;
         
         if (kit->ifkit->has_lcd == 0)
@@ -263,10 +272,10 @@ static DEVICE_ATTR(lcd, S_IWUGO, NULL, enable_lcd_files);
 
 static void interfacekit_irq(struct urb *urb, struct pt_regs *regs)
 {
-        struct phidget_interfacekit *kit = urb->context;
+        struct interfacekit *kit = urb->context;
         unsigned char *buffer = kit->data;
+        int i, level, sensor;
         int status;
-        int n;
 
         switch (urb->status) {
         case 0:                 /* success */
@@ -280,22 +289,63 @@ static void interfacekit_irq(struct urb *urb, struct pt_regs *regs)
                 goto resubmit;
         }
 
-        for (n=0; n<8; n++) {
-                kit->inputs[n] = buffer[1] & (1 << n) ? 1 : 0;
+        /* digital inputs */
+        if (kit->ifkit->inputs == 16) {
+                for (i=0; i < 8; i++) {
+                        level = (buffer[0] >> i) & 1;
+                        if (kit->inputs[i] != level) {
+                                kit->inputs[i] = level;
+                                set_bit(i, &kit->input_events);
+                        }
+                        level = (buffer[1] >> i) & 1;
+                        if (kit->inputs[8 + i] != level) {
+                                kit->inputs[8 + i] = level;
+                                set_bit(8 + i, &kit->input_events);
+                        }
+                }
+        }
+        else if (kit->ifkit->inputs == 8) {
+                for (i=0; i < 8; i++) {
+                        level = (buffer[1] >> i) & 1;
+                        if (kit->inputs[i] != level) {
+                                kit->inputs[i] = level;
+                                set_bit(i, &kit->input_events);
+                        }
+                }
         }
 
-        if (buffer[0] & 1) {
-                kit->sensors[4] = buffer[2] + (buffer[3] & 0x0f) * 256;
-                kit->sensors[5] = buffer[4] + (buffer[3] & 0xf0) * 16;
-                kit->sensors[6] = buffer[5] + (buffer[6] & 0x0f) * 256;
-                kit->sensors[7] = buffer[7] + (buffer[6] & 0xf0) * 16;
-        } else {
-                kit->sensors[0] = buffer[2] + (buffer[3] & 0x0f) * 256;
-                kit->sensors[1] = buffer[4] + (buffer[3] & 0xf0) * 16;
-                kit->sensors[2] = buffer[5] + (buffer[6] & 0x0f) * 256;
-                kit->sensors[3] = buffer[7] + (buffer[6] & 0xf0) * 16;
+        /* analog inputs */
+        if (kit->ifkit->sensors) {
+                sensor = (buffer[0] & 1) ? 4 : 0;
+
+                level = buffer[2] + (buffer[3] & 0x0f) * 256;
+                if (level != kit->sensors[sensor]) {
+                        kit->sensors[sensor] = level;
+                        set_bit(sensor, &kit->sensor_events);
+                }
+                sensor++;
+                level = buffer[4] + (buffer[3] & 0xf0) * 16;
+                if (level != kit->sensors[sensor]) {
+                        kit->sensors[sensor] = level;
+                        set_bit(sensor, &kit->sensor_events);
+                }
+                sensor++;
+                level = buffer[5] + (buffer[6] & 0x0f) * 256;
+                if (level != kit->sensors[sensor]) {
+                        kit->sensors[sensor] = level;
+                        set_bit(sensor, &kit->sensor_events);
+                }
+                sensor++;
+                level = buffer[7] + (buffer[6] & 0xf0) * 16;
+                if (level != kit->sensors[sensor]) {
+                        kit->sensors[sensor] = level;
+                        set_bit(sensor, &kit->sensor_events);
+                }
         }
 
+        if (kit->input_events || kit->sensor_events)
+                schedule_work(&kit->do_notify);
+
 resubmit:
         status = usb_submit_urb(urb, SLAB_ATOMIC);
         if (status)
@@ -304,20 +354,40 @@ resubmit:
                         kit->udev->devpath, status);
 }
 
+static void do_notify(void *data)
+{
+        struct interfacekit *kit = data;
+        int i;
+        char sysfs_file[8];
+
+        for (i=0; i<kit->ifkit->inputs; i++) {
+                if (test_and_clear_bit(i, &kit->input_events)) {
+                        sprintf(sysfs_file, "input%d", i + 1);
+                        sysfs_notify(&kit->intf->dev.kobj, NULL, sysfs_file);
+                }
+        }
+
+        for (i=0; i<kit->ifkit->sensors; i++) {
+                if (test_and_clear_bit(i, &kit->sensor_events)) {
+                        sprintf(sysfs_file, "sensor%d", i + 1);
+                        sysfs_notify(&kit->intf->dev.kobj, NULL, sysfs_file);
+                }
+        }
+}
+
 #define show_set_output(value)          \
-static ssize_t set_output##value(struct device *dev, struct device_attribute *attr, const char *buf,    \
+static ssize_t set_output##value(struct device *dev, struct device_attribute *attr, const char *buf,    \
                                                         size_t count)   \
 {                                                                       \
         struct usb_interface *intf = to_usb_interface(dev);             \
-        struct phidget_interfacekit *kit = usb_get_intfdata(intf);      \
+        struct interfacekit *kit = usb_get_intfdata(intf);              \
         int enabled;                                                    \
         int retval;                                                     \
                                                                         \
-        if (sscanf(buf, "%d", &enabled) < 1) {                          \
+        if (sscanf(buf, "%d", &enabled) < 1)                            \
                 return -EINVAL;                                         \
-        }                                                               \
                                                                         \
-        retval = change_outputs(kit, value - 1, enabled ? 1 : 0);       \
+        retval = change_outputs(kit, value - 1, enabled);               \
                                                                         \
         return retval ? retval : count;                                 \
 }                                                                       \
@@ -325,9 +395,9 @@ static ssize_t set_output##value(struct device *dev, struct device_attribute *at
 static ssize_t show_output##value(struct device *dev, struct device_attribute *attr, char *buf) \
 {                                                                       \
         struct usb_interface *intf = to_usb_interface(dev);             \
-        struct phidget_interfacekit *kit = usb_get_intfdata(intf);      \
+        struct interfacekit *kit = usb_get_intfdata(intf);              \
                                                                         \
-        return sprintf(buf, "%d\n", kit->outputs[value - 1]);           \
+        return sprintf(buf, "%d\n", !!test_bit(value - 1, &kit->outputs));\
 }                                                                       \
 static DEVICE_ATTR(output##value, S_IWUGO | S_IRUGO,                    \
                 show_output##value, set_output##value);
@@ -338,15 +408,23 @@ show_set_output(4);
 show_set_output(5);
 show_set_output(6);
 show_set_output(7);
-show_set_output(8);     /* should be MAX_INTERFACES - 1 */
+show_set_output(8);
+show_set_output(9);
+show_set_output(10);
+show_set_output(11);
+show_set_output(12);
+show_set_output(13);
+show_set_output(14);
+show_set_output(15);
+show_set_output(16);
 
 #define show_input(value)       \
 static ssize_t show_input##value(struct device *dev, struct device_attribute *attr, char *buf)  \
 {                                                                       \
         struct usb_interface *intf = to_usb_interface(dev);             \
-        struct phidget_interfacekit *kit = usb_get_intfdata(intf);      \
+        struct interfacekit *kit = usb_get_intfdata(intf);              \
                                                                         \
-        return sprintf(buf, "%d\n", kit->inputs[value - 1]);            \
+        return sprintf(buf, "%d\n", (int)kit->inputs[value - 1]);       \
 }                                                                       \
 static DEVICE_ATTR(input##value, S_IRUGO, show_input##value, NULL);
 
@@ -357,15 +435,23 @@ show_input(4);
 show_input(5);
 show_input(6);
 show_input(7);
-show_input(8);          /* should be MAX_INTERFACES - 1 */
+show_input(8);
+show_input(9);
+show_input(10);
+show_input(11);
+show_input(12);
+show_input(13);
+show_input(14);
+show_input(15);
+show_input(16);
 
 #define show_sensor(value)      \
 static ssize_t show_sensor##value(struct device *dev, struct device_attribute *attr, char *buf) \
 {                                                                       \
         struct usb_interface *intf = to_usb_interface(dev);             \
-        struct phidget_interfacekit *kit = usb_get_intfdata(intf);      \
+        struct interfacekit *kit = usb_get_intfdata(intf);              \
                                                                         \
-        return sprintf(buf, "%d\n", kit->sensors[value - 1]);           \
+        return sprintf(buf, "%d\n", (int)kit->sensors[value - 1]);      \
 }                                                                       \
 static DEVICE_ATTR(sensor##value, S_IRUGO, show_sensor##value, NULL);
 
@@ -376,16 +462,16 @@ show_sensor(4);
 show_sensor(5);
 show_sensor(6);
 show_sensor(7);
-show_sensor(8);         /* should be MAX_INTERFACES - 1 */
+show_sensor(8);
 
 static int interfacekit_probe(struct usb_interface *intf, const struct usb_device_id *id)
 {
         struct usb_device *dev = interface_to_usbdev(intf);
         struct usb_host_interface *interface;
         struct usb_endpoint_descriptor *endpoint;
-        struct phidget_interfacekit *kit;
+        struct interfacekit *kit;
         struct driver_interfacekit *ifkit;
-        int pipe, maxp;
+        int pipe, maxp, rc = -ENOMEM;
 
         ifkit = (struct driver_interfacekit *)id->driver_info;
         if (!ifkit)
@@ -405,29 +491,23 @@ static int interfacekit_probe(struct usb_interface *intf, const struct usb_devic
         maxp = usb_maxpacket(dev, pipe, usb_pipeout(pipe));
         
         kit = kzalloc(sizeof(*kit), GFP_KERNEL);
-        if (kit  == NULL) {
-                dev_err(&intf->dev, "%s - out of memory\n", __FUNCTION__);
-                return -ENOMEM;
-        }
-        kit->ifkit = ifkit;
+        if (!kit)
+                goto out;
 
-        kit->data = usb_buffer_alloc(dev, 8, SLAB_ATOMIC, &kit->data_dma);
-        if (!kit->data) {
-                kfree(kit);
-                return -ENOMEM;
-        }
+        kit->ifkit = ifkit;
+        kit->data = usb_buffer_alloc(dev, URB_INT_SIZE, SLAB_ATOMIC, &kit->data_dma);
+        if (!kit->data)
+                goto out;
 
         kit->irq = usb_alloc_urb(0, GFP_KERNEL);
-        if (!kit->irq) {
-                usb_buffer_free(dev, 8, kit->data, kit->data_dma);
-                kfree(kit);
-                return -ENOMEM;
-        }
+        if (!kit->irq)
+                goto out;
 
         kit->udev = usb_get_dev(dev);
         kit->intf = intf;
+        INIT_WORK(&kit->do_notify, do_notify, kit);
         usb_fill_int_urb(kit->irq, kit->udev, pipe, kit->data,
-                        (maxp > 8 ? 8 : maxp),
+                        maxp > URB_INT_SIZE ? URB_INT_SIZE : maxp,
                         interfacekit_irq, kit, endpoint->bInterval);
         kit->irq->transfer_dma = kit->data_dma;
         kit->irq->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
@@ -435,7 +515,8 @@ static int interfacekit_probe(struct usb_interface *intf, const struct usb_devic
         usb_set_intfdata(intf, kit);
 
         if (usb_submit_urb(kit->irq, GFP_KERNEL)) {
-                return -EIO;
+                rc = -EIO;
+                goto out;
         }
 
         if (ifkit->outputs >= 4) {
@@ -444,12 +525,22 @@ static int interfacekit_probe(struct usb_interface *intf, const struct usb_devic
                 device_create_file(&intf->dev, &dev_attr_output3);
                 device_create_file(&intf->dev, &dev_attr_output4);
         }
-        if (ifkit->outputs == 8) {
+        if (ifkit->outputs >= 8) {
                 device_create_file(&intf->dev, &dev_attr_output5);
                 device_create_file(&intf->dev, &dev_attr_output6);
                 device_create_file(&intf->dev, &dev_attr_output7);
                 device_create_file(&intf->dev, &dev_attr_output8);
         } 
+        if (ifkit->outputs == 16) {
+                device_create_file(&intf->dev, &dev_attr_output9);
+                device_create_file(&intf->dev, &dev_attr_output10);
+                device_create_file(&intf->dev, &dev_attr_output11);
+                device_create_file(&intf->dev, &dev_attr_output12);
+                device_create_file(&intf->dev, &dev_attr_output13);
+                device_create_file(&intf->dev, &dev_attr_output14);
+                device_create_file(&intf->dev, &dev_attr_output15);
+                device_create_file(&intf->dev, &dev_attr_output16);
+        }
 
         if (ifkit->inputs >= 4) {
                 device_create_file(&intf->dev, &dev_attr_input1);
@@ -457,12 +548,22 @@ static int interfacekit_probe(struct usb_interface *intf, const struct usb_devic
                 device_create_file(&intf->dev, &dev_attr_input3);
                 device_create_file(&intf->dev, &dev_attr_input4);
         }
-        if (ifkit->inputs == 8) {
+        if (ifkit->inputs >= 8) {
                 device_create_file(&intf->dev, &dev_attr_input5);
                 device_create_file(&intf->dev, &dev_attr_input6);
                 device_create_file(&intf->dev, &dev_attr_input7);
                 device_create_file(&intf->dev, &dev_attr_input8);
         }
+        if (ifkit->inputs == 16) {
+                device_create_file(&intf->dev, &dev_attr_input9);
+                device_create_file(&intf->dev, &dev_attr_input10);
+                device_create_file(&intf->dev, &dev_attr_input11);
+                device_create_file(&intf->dev, &dev_attr_input12);
+                device_create_file(&intf->dev, &dev_attr_input13);
+                device_create_file(&intf->dev, &dev_attr_input14);
+                device_create_file(&intf->dev, &dev_attr_input15);
+                device_create_file(&intf->dev, &dev_attr_input16);
+        }
 
         if (ifkit->sensors >= 4) {
                 device_create_file(&intf->dev, &dev_attr_sensor1);
@@ -475,9 +576,8 @@ static int interfacekit_probe(struct usb_interface *intf, const struct usb_devic
                 device_create_file(&intf->dev, &dev_attr_sensor6);
                 device_create_file(&intf->dev, &dev_attr_sensor7);
         }
-        if (ifkit->sensors == 8) {
+        if (ifkit->sensors == 8)
                 device_create_file(&intf->dev, &dev_attr_sensor8);
-        }
 
         if (ifkit->has_lcd)
                 device_create_file(&intf->dev, &dev_attr_lcd);
@@ -486,29 +586,56 @@ static int interfacekit_probe(struct usb_interface *intf, const struct usb_devic
                         ifkit->sensors, ifkit->inputs, ifkit->outputs);
 
         return 0;
+
+out:
+        if (kit) {
+                if (kit->irq)
+                        usb_free_urb(kit->irq);
+                if (kit->data)
+                        usb_buffer_free(dev, URB_INT_SIZE, kit->data, kit->data_dma);
+                kfree(kit);
+        }
+
+        return rc;
 }
 
 static void interfacekit_disconnect(struct usb_interface *interface)
 {
-        struct phidget_interfacekit *kit;
+        struct interfacekit *kit;
 
         kit = usb_get_intfdata(interface);
         usb_set_intfdata(interface, NULL);
         if (!kit)
                 return;
 
+        usb_kill_urb(kit->irq);
+        usb_free_urb(kit->irq);
+        usb_buffer_free(kit->udev, URB_INT_SIZE, kit->data, kit->data_dma);
+
+        cancel_delayed_work(&kit->do_notify);
+
         if (kit->ifkit->outputs >= 4) {
                 device_remove_file(&interface->dev, &dev_attr_output1);
                 device_remove_file(&interface->dev, &dev_attr_output2);
                 device_remove_file(&interface->dev, &dev_attr_output3);
                 device_remove_file(&interface->dev, &dev_attr_output4);
         }
-        if (kit->ifkit->outputs == 8) {
+        if (kit->ifkit->outputs >= 8) {
                 device_remove_file(&interface->dev, &dev_attr_output5);
                 device_remove_file(&interface->dev, &dev_attr_output6);
                 device_remove_file(&interface->dev, &dev_attr_output7);
                 device_remove_file(&interface->dev, &dev_attr_output8);
         }
+        if (kit->ifkit->outputs == 16) {
+                device_remove_file(&interface->dev, &dev_attr_output9);
+                device_remove_file(&interface->dev, &dev_attr_output10);
+                device_remove_file(&interface->dev, &dev_attr_output11);
+                device_remove_file(&interface->dev, &dev_attr_output12);
+                device_remove_file(&interface->dev, &dev_attr_output13);
+                device_remove_file(&interface->dev, &dev_attr_output14);
+                device_remove_file(&interface->dev, &dev_attr_output15);
+                device_remove_file(&interface->dev, &dev_attr_output16);
+        }
 
         if (kit->ifkit->inputs >= 4) {
                 device_remove_file(&interface->dev, &dev_attr_input1);
@@ -516,12 +643,22 @@ static void interfacekit_disconnect(struct usb_interface *interface)
                 device_remove_file(&interface->dev, &dev_attr_input3);
                 device_remove_file(&interface->dev, &dev_attr_input4);
         }
-        if (kit->ifkit->inputs == 8) {
+        if (kit->ifkit->inputs >= 8) {
                 device_remove_file(&interface->dev, &dev_attr_input5);
                 device_remove_file(&interface->dev, &dev_attr_input6);
                 device_remove_file(&interface->dev, &dev_attr_input7);
                 device_remove_file(&interface->dev, &dev_attr_input8);
         }
+        if (kit->ifkit->inputs == 16) {
+                device_remove_file(&interface->dev, &dev_attr_input9);
+                device_remove_file(&interface->dev, &dev_attr_input10);
+                device_remove_file(&interface->dev, &dev_attr_input11);
+                device_remove_file(&interface->dev, &dev_attr_input12);
+                device_remove_file(&interface->dev, &dev_attr_input13);
+                device_remove_file(&interface->dev, &dev_attr_input14);
+                device_remove_file(&interface->dev, &dev_attr_input15);
+                device_remove_file(&interface->dev, &dev_attr_input16);
+        }
 
         if (kit->ifkit->sensors >= 4) {
                 device_remove_file(&interface->dev, &dev_attr_sensor1);
@@ -534,19 +671,15 @@ static void interfacekit_disconnect(struct usb_interface *interface)
                 device_remove_file(&interface->dev, &dev_attr_sensor6);
                 device_remove_file(&interface->dev, &dev_attr_sensor7);
         }
-        if (kit->ifkit->sensors == 8) {
+        if (kit->ifkit->sensors == 8)
                 device_remove_file(&interface->dev, &dev_attr_sensor8);
-        }
+
         if (kit->ifkit->has_lcd)
                 device_remove_file(&interface->dev, &dev_attr_lcd);
 
         dev_info(&interface->dev, "USB PhidgetInterfaceKit %d/%d/%d detached\n",
                 kit->ifkit->sensors, kit->ifkit->inputs, kit->ifkit->outputs);
 
-        usb_kill_urb(kit->irq);
-        usb_free_urb(kit->irq);
-        usb_buffer_free(kit->udev, 8, kit->data, kit->data_dma);
-
         usb_put_dev(kit->udev);
         kfree(kit);
 }
diff --git a/drivers/usb/misc/sisusbvga/sisusb.c b/drivers/usb/misc/sisusbvga/sisusb.c
index 196c8794a73c..738bd7c7451f 100644
--- a/drivers/usb/misc/sisusbvga/sisusb.c
+++ b/drivers/usb/misc/sisusbvga/sisusb.c
@@ -37,6 +37,7 @@
  */
 
 #include <linux/config.h>
+#include <linux/mutex.h>
 #include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/signal.h>
@@ -52,6 +53,7 @@
 #include <linux/vmalloc.h>
 
 #include "sisusb.h"
+#include "sisusb_init.h"
 
 #ifdef INCL_SISUSB_CON
 #include <linux/font.h>
@@ -62,36 +64,6 @@
 /* Forward declarations / clean-up routines */
 
 #ifdef INCL_SISUSB_CON
-int     sisusb_setreg(struct sisusb_usb_data *sisusb, int port, u8 data);
-int     sisusb_getreg(struct sisusb_usb_data *sisusb, int port, u8 *data);
-int     sisusb_setidxreg(struct sisusb_usb_data *sisusb, int port, u8 index, u8 data);
-int     sisusb_getidxreg(struct sisusb_usb_data *sisusb, int port, u8 index, u8 *data);
-int     sisusb_setidxregandor(struct sisusb_usb_data *sisusb, int port, u8 idx, u8 myand, u8 myor);
-int     sisusb_setidxregor(struct sisusb_usb_data *sisusb, int port, u8 index, u8 myor);
-int     sisusb_setidxregand(struct sisusb_usb_data *sisusb, int port, u8 idx, u8 myand);
-
-int     sisusb_writeb(struct sisusb_usb_data *sisusb, u32 adr, u8 data);
-int     sisusb_readb(struct sisusb_usb_data *sisusb, u32 adr, u8 *data);
-int     sisusb_writew(struct sisusb_usb_data *sisusb, u32 adr, u16 data);
-int     sisusb_readw(struct sisusb_usb_data *sisusb, u32 adr, u16 *data);
-int     sisusb_copy_memory(struct sisusb_usb_data *sisusb, char *src,
-                        u32 dest, int length, size_t *bytes_written);
-
-int     sisusb_reset_text_mode(struct sisusb_usb_data *sisusb, int init);
-
-extern int  SiSUSBSetMode(struct SiS_Private *SiS_Pr, unsigned short ModeNo);
-extern int  SiSUSBSetVESAMode(struct SiS_Private *SiS_Pr, unsigned short VModeNo);
-
-extern void sisusb_init_concode(void);
-extern int  sisusb_console_init(struct sisusb_usb_data *sisusb, int first, int last);
-extern void sisusb_console_exit(struct sisusb_usb_data *sisusb);
-
-extern void sisusb_set_cursor(struct sisusb_usb_data *sisusb, unsigned int location);
-
-extern int  sisusbcon_do_font_op(struct sisusb_usb_data *sisusb, int set, int slot,
-                u8 *arg, int cmapsz, int ch512, int dorecalc,
-                struct vc_data *c, int fh, int uplock);
-
 static int sisusb_first_vc = 0;
 static int sisusb_last_vc = 0;
 module_param_named(first, sisusb_first_vc, int, 0);
@@ -102,7 +74,7 @@ MODULE_PARM_DESC(last, "Number of last console to take over (1 - MAX_NR_CONSOLES
 
 static struct usb_driver sisusb_driver;
 
-DECLARE_MUTEX(disconnect_sem);
+DEFINE_MUTEX(disconnect_mutex);
 
 static void
 sisusb_free_buffers(struct sisusb_usb_data *sisusb)
@@ -1359,9 +1331,6 @@ sisusb_getreg(struct sisusb_usb_data *sisusb, int port, u8 *data)
 }
 #endif
 
-#ifndef INCL_SISUSB_CON
-static
-#endif
 int
 sisusb_setidxreg(struct sisusb_usb_data *sisusb, int port, u8 index, u8 data)
 {
@@ -1371,9 +1340,6 @@ sisusb_setidxreg(struct sisusb_usb_data *sisusb, int port, u8 index, u8 data)
         return ret;
 }
 
-#ifndef INCL_SISUSB_CON
-static
-#endif
 int
 sisusb_getidxreg(struct sisusb_usb_data *sisusb, int port, u8 index, u8 *data)
 {
@@ -1383,9 +1349,6 @@ sisusb_getidxreg(struct sisusb_usb_data *sisusb, int port, u8 index, u8 *data)
         return ret;
 }
 
-#ifndef INCL_SISUSB_CON
-static
-#endif
 int
 sisusb_setidxregandor(struct sisusb_usb_data *sisusb, int port, u8 idx,
                                                         u8 myand, u8 myor)
@@ -1415,18 +1378,12 @@ sisusb_setidxregmask(struct sisusb_usb_data *sisusb, int port, u8 idx,
         return ret;
 }
 
-#ifndef INCL_SISUSB_CON
-static
-#endif
 int
 sisusb_setidxregor(struct sisusb_usb_data *sisusb, int port, u8 index, u8 myor)
 {
         return(sisusb_setidxregandor(sisusb, port, index, 0xff, myor));
 }
 
-#ifndef INCL_SISUSB_CON
-static
-#endif
 int
 sisusb_setidxregand(struct sisusb_usb_data *sisusb, int port, u8 idx, u8 myand)
 {
@@ -1448,6 +1405,8 @@ sisusb_readb(struct sisusb_usb_data *sisusb, u32 adr, u8 *data)
         return(sisusb_read_memio_byte(sisusb, SISUSB_TYPE_MEM, adr, data));
 }
 
+#if 0
+
 int
 sisusb_writew(struct sisusb_usb_data *sisusb, u32 adr, u16 data)
 {
@@ -1460,6 +1419,8 @@ sisusb_readw(struct sisusb_usb_data *sisusb, u32 adr, u16 *data)
         return(sisusb_read_memio_word(sisusb, SISUSB_TYPE_MEM, adr, data));
 }
 
+#endif  /*  0  */
+
 int
 sisusb_copy_memory(struct sisusb_usb_data *sisusb, char *src,
                         u32 dest, int length, size_t *bytes_written)
@@ -2552,39 +2513,39 @@ sisusb_open(struct inode *inode, struct file *file)
         struct usb_interface *interface;
         int subminor = iminor(inode);
 
-        down(&disconnect_sem);
+        mutex_lock(&disconnect_mutex);
 
         if (!(interface = usb_find_interface(&sisusb_driver, subminor))) {
                 printk(KERN_ERR "sisusb[%d]: Failed to find interface\n",
                                 subminor);
-                up(&disconnect_sem);
+                mutex_unlock(&disconnect_mutex);
                 return -ENODEV;
         }
 
         if (!(sisusb = usb_get_intfdata(interface))) {
-                up(&disconnect_sem);
+                mutex_unlock(&disconnect_mutex);
                 return -ENODEV;
         }
 
-        down(&sisusb->lock);
+        mutex_lock(&sisusb->lock);
 
         if (!sisusb->present || !sisusb->ready) {
-                up(&sisusb->lock);
-                up(&disconnect_sem);
+                mutex_unlock(&sisusb->lock);
+                mutex_unlock(&disconnect_mutex);
                 return -ENODEV;
         }
 
         if (sisusb->isopen) {
-                up(&sisusb->lock);
-                up(&disconnect_sem);
+                mutex_unlock(&sisusb->lock);
+                mutex_unlock(&disconnect_mutex);
                 return -EBUSY;
         }
 
         if (!sisusb->devinit) {
                 if (sisusb->sisusb_dev->speed == USB_SPEED_HIGH) {
                         if (sisusb_init_gfxdevice(sisusb, 0)) {
-                                up(&sisusb->lock);
-                                up(&disconnect_sem);
+                                mutex_unlock(&sisusb->lock);
+                                mutex_unlock(&disconnect_mutex);
                                 printk(KERN_ERR
                                         "sisusbvga[%d]: Failed to initialize "
                                         "device\n",
@@ -2592,8 +2553,8 @@ sisusb_open(struct inode *inode, struct file *file)
                                 return -EIO;
                         }
                 } else {
-                        up(&sisusb->lock);
-                        up(&disconnect_sem);
+                        mutex_unlock(&sisusb->lock);
+                        mutex_unlock(&disconnect_mutex);
                         printk(KERN_ERR
                                 "sisusbvga[%d]: Device not attached to "
                                 "USB 2.0 hub\n",
@@ -2609,9 +2570,9 @@ sisusb_open(struct inode *inode, struct file *file)
 
         file->private_data = sisusb;
 
-        up(&sisusb->lock);
+        mutex_unlock(&sisusb->lock);
 
-        up(&disconnect_sem);
+        mutex_unlock(&disconnect_mutex);
 
         return 0;
 }
@@ -2642,14 +2603,14 @@ sisusb_release(struct inode *inode, struct file *file)
         struct sisusb_usb_data *sisusb;
         int myminor;
 
-        down(&disconnect_sem);
+        mutex_lock(&disconnect_mutex);
 
         if (!(sisusb = (struct sisusb_usb_data *)file->private_data)) {
-                up(&disconnect_sem);
+                mutex_unlock(&disconnect_mutex);
                 return -ENODEV;
         }
 
-        down(&sisusb->lock);
+        mutex_lock(&sisusb->lock);
 
         if (sisusb->present) {
                 /* Wait for all URBs to finish if device still present */
@@ -2662,12 +2623,12 @@ sisusb_release(struct inode *inode, struct file *file)
         sisusb->isopen = 0;
         file->private_data = NULL;
 
-        up(&sisusb->lock);
+        mutex_unlock(&sisusb->lock);
 
         /* decrement the usage count on our device */
         kref_put(&sisusb->kref, sisusb_delete);
 
-        up(&disconnect_sem);
+        mutex_unlock(&disconnect_mutex);
 
         return 0;
 }
@@ -2685,11 +2646,11 @@ sisusb_read(struct file *file, char __user *buffer, size_t count, loff_t *ppos)
         if (!(sisusb = (struct sisusb_usb_data *)file->private_data))
                 return -ENODEV;
 
-        down(&sisusb->lock);
+        mutex_lock(&sisusb->lock);
 
         /* Sanity check */
         if (!sisusb->present || !sisusb->ready || !sisusb->sisusb_dev) {
-                up(&sisusb->lock);
+                mutex_unlock(&sisusb->lock);
                 return -ENODEV;
         }
 
@@ -2784,7 +2745,7 @@ sisusb_read(struct file *file, char __user *buffer, size_t count, loff_t *ppos)
                     (*ppos) <= SISUSB_PCI_PSEUDO_PCIBASE + 0x5c) {
 
                 if (count != 4) {
-                        up(&sisusb->lock);
+                        mutex_unlock(&sisusb->lock);
                         return -EINVAL;
                 }
 
@@ -2808,7 +2769,7 @@ sisusb_read(struct file *file, char __user *buffer, size_t count, loff_t *ppos)
 
         (*ppos) += bytes_read;
 
-        up(&sisusb->lock);
+        mutex_unlock(&sisusb->lock);
 
         return errno ? errno : bytes_read;
 }
@@ -2827,11 +2788,11 @@ sisusb_write(struct file *file, const char __user *buffer, size_t count,
         if (!(sisusb = (struct sisusb_usb_data *)file->private_data))
                 return -ENODEV;
 
-        down(&sisusb->lock);
+        mutex_lock(&sisusb->lock);
 
         /* Sanity check */
         if (!sisusb->present || !sisusb->ready || !sisusb->sisusb_dev) {
-                up(&sisusb->lock);
+                mutex_unlock(&sisusb->lock);
                 return -ENODEV;
         }
 
@@ -2930,7 +2891,7 @@ sisusb_write(struct file *file, const char __user *buffer, size_t count,
                     (*ppos) <= SISUSB_PCI_PSEUDO_PCIBASE + SISUSB_PCI_PCONFSIZE) {
 
                 if (count != 4) {
-                        up(&sisusb->lock);
+                        mutex_unlock(&sisusb->lock);
                         return -EINVAL;
                 }
 
@@ -2956,7 +2917,7 @@ sisusb_write(struct file *file, const char __user *buffer, size_t count,
 
         (*ppos) += bytes_written;
 
-        up(&sisusb->lock);
+        mutex_unlock(&sisusb->lock);
 
         return errno ? errno : bytes_written;
 }
@@ -2970,11 +2931,11 @@ sisusb_lseek(struct file *file, loff_t offset, int orig)
         if (!(sisusb = (struct sisusb_usb_data *)file->private_data))
                 return -ENODEV;
 
-        down(&sisusb->lock);
+        mutex_lock(&sisusb->lock);
 
         /* Sanity check */
         if (!sisusb->present || !sisusb->ready || !sisusb->sisusb_dev) {
-                up(&sisusb->lock);
+                mutex_unlock(&sisusb->lock);
                 return -ENODEV;
         }
 
@@ -2994,7 +2955,7 @@ sisusb_lseek(struct file *file, loff_t offset, int orig)
                         ret = -EINVAL;
         }
 
-        up(&sisusb->lock);
+        mutex_unlock(&sisusb->lock);
         return ret;
 }
 
@@ -3136,7 +3097,7 @@ sisusb_ioctl(struct inode *inode, struct file *file, unsigned int cmd,
         if (!(sisusb = (struct sisusb_usb_data *)file->private_data))
                 return -ENODEV;
 
-        down(&sisusb->lock);
+        mutex_lock(&sisusb->lock);
 
         /* Sanity check */
         if (!sisusb->present || !sisusb->ready || !sisusb->sisusb_dev) {
@@ -3193,7 +3154,7 @@ sisusb_ioctl(struct inode *inode, struct file *file, unsigned int cmd,
         }
 
 err_out:
-        up(&sisusb->lock);
+        mutex_unlock(&sisusb->lock);
         return retval;
 }
 
@@ -3258,7 +3219,7 @@ static int sisusb_probe(struct usb_interface *intf,
         }
         kref_init(&sisusb->kref);
 
-        init_MUTEX(&(sisusb->lock));
+        mutex_init(&(sisusb->lock));
 
         /* Register device */
         if ((retval = usb_register_dev(intf, &usb_sisusb_class))) {
@@ -3429,9 +3390,9 @@ static void sisusb_disconnect(struct usb_interface *intf)
          * protect all other routines from the disconnect
          * case, not the other way round.
          */
-        down(&disconnect_sem);
+        mutex_lock(&disconnect_mutex);
 
-        down(&sisusb->lock);
+        mutex_lock(&sisusb->lock);
 
         /* Wait for all URBs to complete and kill them in case (MUST do) */
         if (!sisusb_wait_all_out_complete(sisusb))
@@ -3462,12 +3423,12 @@ static void sisusb_disconnect(struct usb_interface *intf)
         sisusb->present = 0;
         sisusb->ready = 0;
 
-        up(&sisusb->lock);
+        mutex_unlock(&sisusb->lock);
 
         /* decrement our usage count */
         kref_put(&sisusb->kref, sisusb_delete);
 
-        up(&disconnect_sem);
+        mutex_unlock(&disconnect_mutex);
 
         printk(KERN_INFO "sisusbvga[%d]: Disconnected\n", minor);
 }
diff --git a/drivers/usb/misc/sisusbvga/sisusb.h b/drivers/usb/misc/sisusbvga/sisusb.h
index a716825d1f9b..8e1120a64806 100644
--- a/drivers/usb/misc/sisusbvga/sisusb.h
+++ b/drivers/usb/misc/sisusbvga/sisusb.h
@@ -41,6 +41,8 @@
 #define SISUSB_NEW_CONFIG_COMPAT
 #endif
 
+#include <linux/mutex.h>
+
 /* For older kernels, support for text consoles is by default
  * off. To ensable text console support, change the following:
  */
@@ -60,11 +62,9 @@
 #define INCL_SISUSB_CON         1
 #endif
 
-#ifdef INCL_SISUSB_CON
 #include <linux/console.h>
 #include <linux/vt_kern.h>
 #include "sisusb_struct.h"
-#endif
 
 /* USB related */
 
@@ -116,7 +116,7 @@ struct sisusb_usb_data {
         struct usb_interface *interface;
         struct kref kref;
         wait_queue_head_t wait_q;       /* for syncind and timeouts */
-        struct semaphore lock;          /* general race avoidance */
+        struct mutex lock;              /* general race avoidance */
         unsigned int ifnum;             /* interface number of the USB device */
         int minor;                      /* minor (for logging clarity) */
         int isopen;                     /* !=0 if open */
diff --git a/drivers/usb/misc/sisusbvga/sisusb_con.c b/drivers/usb/misc/sisusbvga/sisusb_con.c
index be5c1a25ae21..fb48feca8353 100644
--- a/drivers/usb/misc/sisusbvga/sisusb_con.c
+++ b/drivers/usb/misc/sisusbvga/sisusb_con.c
@@ -48,6 +48,7 @@
  */
 
 #include <linux/config.h>
+#include <linux/mutex.h>
 #include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/signal.h>
@@ -69,27 +70,9 @@
 #include <linux/vmalloc.h>
 
 #include "sisusb.h"
+#include "sisusb_init.h"
 
 #ifdef INCL_SISUSB_CON
-extern int sisusb_setreg(struct sisusb_usb_data *, int, u8);
-extern int sisusb_getreg(struct sisusb_usb_data *, int, u8 *);
-extern int sisusb_setidxreg(struct sisusb_usb_data *, int, u8, u8);
-extern int sisusb_getidxreg(struct sisusb_usb_data *, int, u8, u8 *);
-extern int sisusb_setidxregor(struct sisusb_usb_data *, int, u8, u8);
-extern int sisusb_setidxregand(struct sisusb_usb_data *, int, u8, u8);
-extern int sisusb_setidxregandor(struct sisusb_usb_data *, int, u8, u8, u8);
-
-extern int sisusb_writeb(struct sisusb_usb_data *sisusb, u32 adr, u8 data);
-extern int sisusb_readb(struct sisusb_usb_data *sisusb, u32 adr, u8 *data);
-extern int sisusb_writew(struct sisusb_usb_data *sisusb, u32 adr, u16 data);
-extern int sisusb_readw(struct sisusb_usb_data *sisusb, u32 adr, u16 *data);
-extern int sisusb_copy_memory(struct sisusb_usb_data *sisusb, char *src,
-                        u32 dest, int length, size_t *bytes_written);
-
-extern void sisusb_delete(struct kref *kref);
-extern int sisusb_reset_text_mode(struct sisusb_usb_data *sisusb, int init);
-
-extern int SiSUSBSetMode(struct SiS_Private *SiS_Pr, unsigned short ModeNo);
 
 #define sisusbcon_writew(val, addr)     (*(addr) = (val))
 #define sisusbcon_readw(addr)           (*(addr))
@@ -102,8 +85,6 @@ static struct sisusb_usb_data *mysisusbs[MAX_NR_CONSOLES];
 /* Forward declaration */
 static const struct consw sisusb_con;
 
-extern struct semaphore disconnect_sem;
-
 static inline void
 sisusbcon_memsetw(u16 *s, u16 c, unsigned int count)
 {
@@ -194,11 +175,11 @@ sisusb_get_sisusb_lock_and_check(unsigned short console)
         if (!(sisusb = sisusb_get_sisusb(console)))
                 return NULL;
 
-        down(&sisusb->lock);
+        mutex_lock(&sisusb->lock);
 
         if (!sisusb_sisusb_valid(sisusb) ||
             !sisusb->havethisconsole[console]) {
-                up(&sisusb->lock);
+                mutex_unlock(&sisusb->lock);
                 return NULL;
         }
 
@@ -236,18 +217,18 @@ sisusbcon_init(struct vc_data *c, int init)
          * are set up/restored.
          */
 
-        down(&disconnect_sem);
+        mutex_lock(&disconnect_mutex);
 
         if (!(sisusb = sisusb_get_sisusb(c->vc_num))) {
-                up(&disconnect_sem);
+                mutex_unlock(&disconnect_mutex);
                 return;
         }
 
-        down(&sisusb->lock);
+        mutex_lock(&sisusb->lock);
 
         if (!sisusb_sisusb_valid(sisusb)) {
-                up(&sisusb->lock);
-                up(&disconnect_sem);
+                mutex_unlock(&sisusb->lock);
+                mutex_unlock(&disconnect_mutex);
                 return;
         }
 
@@ -284,9 +265,9 @@ sisusbcon_init(struct vc_data *c, int init)
         if (!*c->vc_uni_pagedir_loc)
                 con_set_default_unimap(c);
 
-        up(&sisusb->lock);
+        mutex_unlock(&sisusb->lock);
 
-        up(&disconnect_sem);
+        mutex_unlock(&disconnect_mutex);
 
         if (init) {
                 c->vc_cols = cols;
@@ -306,14 +287,14 @@ sisusbcon_deinit(struct vc_data *c)
          * and others, ie not under our control.
          */
 
-        down(&disconnect_sem);
+        mutex_lock(&disconnect_mutex);
 
         if (!(sisusb = sisusb_get_sisusb(c->vc_num))) {
-                up(&disconnect_sem);
+                mutex_unlock(&disconnect_mutex);
                 return;
         }
 
-        down(&sisusb->lock);
+        mutex_lock(&sisusb->lock);
 
         /* Clear ourselves in mysisusbs */
         mysisusbs[c->vc_num] = NULL;
@@ -332,12 +313,12 @@ sisusbcon_deinit(struct vc_data *c)
                 }
         }
 
-        up(&sisusb->lock);
+        mutex_unlock(&sisusb->lock);
 
         /* decrement the usage count on our sisusb */
         kref_put(&sisusb->kref, sisusb_delete);
 
-        up(&disconnect_sem);
+        mutex_unlock(&disconnect_mutex);
 }
 
 /* interface routine */
@@ -417,7 +398,7 @@ sisusbcon_putc(struct vc_data *c, int ch, int y, int x)
 #endif
 
         if (sisusb_is_inactive(c, sisusb)) {
-                up(&sisusb->lock);
+                mutex_unlock(&sisusb->lock);
                 return;
         }
 
@@ -425,7 +406,7 @@ sisusbcon_putc(struct vc_data *c, int ch, int y, int x)
         sisusb_copy_memory(sisusb, (char *)SISUSB_VADDR(x, y),
                                 (u32)SISUSB_HADDR(x, y), 2, &written);
 
-        up(&sisusb->lock);
+        mutex_unlock(&sisusb->lock);
 }
 
 /* Interface routine */
@@ -453,14 +434,14 @@ sisusbcon_putcs(struct vc_data *c, const unsigned short *s,
                 sisusbcon_writew(sisusbcon_readw(s++), dest++);
 
         if (sisusb_is_inactive(c, sisusb)) {
-                up(&sisusb->lock);
+                mutex_unlock(&sisusb->lock);
                 return;
         }
 
         sisusb_copy_memory(sisusb, (char *)SISUSB_VADDR(x, y),
                                 (u32)SISUSB_HADDR(x, y), count * 2, &written);
 
-        up(&sisusb->lock);
+        mutex_unlock(&sisusb->lock);
 }
 
 /* Interface routine */
@@ -504,7 +485,7 @@ sisusbcon_clear(struct vc_data *c, int y, int x, int height, int width)
         }
 
         if (sisusb_is_inactive(c, sisusb)) {
-                up(&sisusb->lock);
+                mutex_unlock(&sisusb->lock);
                 return;
         }
 
@@ -514,7 +495,7 @@ sisusbcon_clear(struct vc_data *c, int y, int x, int height, int width)
         sisusb_copy_memory(sisusb, (unsigned char *)SISUSB_VADDR(x, y),
                                 (u32)SISUSB_HADDR(x, y), length, &written);
 
-        up(&sisusb->lock);
+        mutex_unlock(&sisusb->lock);
 }
 
 /* Interface routine */
@@ -576,7 +557,7 @@ sisusbcon_bmove(struct vc_data *c, int sy, int sx,
 #endif
 
         if (sisusb_is_inactive(c, sisusb)) {
-                up(&sisusb->lock);
+                mutex_unlock(&sisusb->lock);
                 return;
         }
 
@@ -586,7 +567,7 @@ sisusbcon_bmove(struct vc_data *c, int sy, int sx,
         sisusb_copy_memory(sisusb, (unsigned char *)SISUSB_VADDR(dx, dy),
                                 (u32)SISUSB_HADDR(dx, dy), length, &written);
 
-        up(&sisusb->lock);
+        mutex_unlock(&sisusb->lock);
 }
 
 /* interface routine */
@@ -609,7 +590,7 @@ sisusbcon_switch(struct vc_data *c)
 
         /* Don't write to screen if in gfx mode */
         if (sisusb_is_inactive(c, sisusb)) {
-                up(&sisusb->lock);
+                mutex_unlock(&sisusb->lock);
                 return 0;
         }
 
@@ -618,7 +599,7 @@ sisusbcon_switch(struct vc_data *c)
          * as origin.
          */
         if (c->vc_origin == (unsigned long)c->vc_screenbuf) {
-                up(&sisusb->lock);
+                mutex_unlock(&sisusb->lock);
                 printk(KERN_DEBUG "sisusb: ASSERT ORIGIN != SCREENBUF!\n");
                 return 0;
         }
@@ -635,7 +616,7 @@ sisusbcon_switch(struct vc_data *c)
                                 (u32)SISUSB_HADDR(0, 0),
                                 length, &written);
 
-        up(&sisusb->lock);
+        mutex_unlock(&sisusb->lock);
 
         return 0;
 }
@@ -657,7 +638,7 @@ sisusbcon_save_screen(struct vc_data *c)
         /* sisusb->lock is down */
 
         if (sisusb_is_inactive(c, sisusb)) {
-                up(&sisusb->lock);
+                mutex_unlock(&sisusb->lock);
                 return;
         }
 
@@ -669,7 +650,7 @@ sisusbcon_save_screen(struct vc_data *c)
         sisusbcon_memcpyw((u16 *)c->vc_screenbuf, (u16 *)c->vc_origin,
                                                                 length);
 
-        up(&sisusb->lock);
+        mutex_unlock(&sisusb->lock);
 }
 
 /* interface routine */
@@ -690,7 +671,7 @@ sisusbcon_set_palette(struct vc_data *c, unsigned char *table)
         /* sisusb->lock is down */
 
         if (sisusb_is_inactive(c, sisusb)) {
-                up(&sisusb->lock);
+                mutex_unlock(&sisusb->lock);
                 return -EINVAL;
         }
 
@@ -705,7 +686,7 @@ sisusbcon_set_palette(struct vc_data *c, unsigned char *table)
                         break;
         }
 
-        up(&sisusb->lock);
+        mutex_unlock(&sisusb->lock);
 
         return 0;
 }
@@ -728,7 +709,7 @@ sisusbcon_blank(struct vc_data *c, int blank, int mode_switch)
                 sisusb->is_gfx = blank ? 1 : 0;
 
         if (sisusb_is_inactive(c, sisusb)) {
-                up(&sisusb->lock);
+                mutex_unlock(&sisusb->lock);
                 return 0;
         }
 
@@ -777,7 +758,7 @@ sisusbcon_blank(struct vc_data *c, int blank, int mode_switch)
                         cr63  = 0x40;
                         break;
                 default:
-                        up(&sisusb->lock);
+                        mutex_unlock(&sisusb->lock);
                         return -EINVAL;
                 }
 
@@ -788,7 +769,7 @@ sisusbcon_blank(struct vc_data *c, int blank, int mode_switch)
 
         }
 
-        up(&sisusb->lock);
+        mutex_unlock(&sisusb->lock);
 
         return ret;
 }
@@ -809,7 +790,7 @@ sisusbcon_scrolldelta(struct vc_data *c, int lines)
         /* sisusb->lock is down */
 
         if (sisusb_is_inactive(c, sisusb)) {
-                up(&sisusb->lock);
+                mutex_unlock(&sisusb->lock);
                 return 0;
         }
 
@@ -849,7 +830,7 @@ sisusbcon_scrolldelta(struct vc_data *c, int lines)
 
         sisusbcon_set_start_address(sisusb, c);
 
-        up(&sisusb->lock);
+        mutex_unlock(&sisusb->lock);
 
         return 1;
 }
@@ -867,7 +848,7 @@ sisusbcon_cursor(struct vc_data *c, int mode)
         /* sisusb->lock is down */
 
         if (sisusb_is_inactive(c, sisusb)) {
-                up(&sisusb->lock);
+                mutex_unlock(&sisusb->lock);
                 return;
         }
 
@@ -879,7 +860,7 @@ sisusbcon_cursor(struct vc_data *c, int mode)
         if (mode == CM_ERASE) {
                 sisusb_setidxregor(sisusb, SISCR, 0x0a, 0x20);
                 sisusb->sisusb_cursor_size_to = -1;
-                up(&sisusb->lock);
+                mutex_unlock(&sisusb->lock);
                 return;
         }
 
@@ -919,7 +900,7 @@ sisusbcon_cursor(struct vc_data *c, int mode)
                 sisusb->sisusb_cursor_size_to   = to;
         }
 
-        up(&sisusb->lock);
+        mutex_unlock(&sisusb->lock);
 }
 
 static int
@@ -961,7 +942,7 @@ sisusbcon_scroll_area(struct vc_data *c, struct sisusb_usb_data *sisusb,
         sisusb_copy_memory(sisusb, (char *)SISUSB_VADDR(0, t),
                                 (u32)SISUSB_HADDR(0, t), length, &written);
 
-        up(&sisusb->lock);
+        mutex_unlock(&sisusb->lock);
 
         return 1;
 }
@@ -994,7 +975,7 @@ sisusbcon_scroll(struct vc_data *c, int t, int b, int dir, int lines)
         /* sisusb->lock is down */
 
         if (sisusb_is_inactive(c, sisusb)) {
-                up(&sisusb->lock);
+                mutex_unlock(&sisusb->lock);
                 return 0;
         }
 
@@ -1084,7 +1065,7 @@ sisusbcon_scroll(struct vc_data *c, int t, int b, int dir, int lines)
 
         c->vc_pos = c->vc_pos - oldorigin + c->vc_origin;
 
-        up(&sisusb->lock);
+        mutex_unlock(&sisusb->lock);
 
         return 1;
 }
@@ -1106,7 +1087,7 @@ sisusbcon_set_origin(struct vc_data *c)
         /* sisusb->lock is down */
 
         if (sisusb_is_inactive(c, sisusb) || sisusb->con_blanked) {
-                up(&sisusb->lock);
+                mutex_unlock(&sisusb->lock);
                 return 0;
         }
 
@@ -1116,7 +1097,7 @@ sisusbcon_set_origin(struct vc_data *c)
 
         sisusb->con_rolled_over = 0;
 
-        up(&sisusb->lock);
+        mutex_unlock(&sisusb->lock);
 
         return 1;
 }
@@ -1133,7 +1114,7 @@ sisusbcon_resize(struct vc_data *c, unsigned int newcols, unsigned int newrows)
 
         fh = sisusb->current_font_height;
 
-        up(&sisusb->lock);
+        mutex_unlock(&sisusb->lock);
 
         /* We are quite unflexible as regards resizing. The vt code
          * handles sizes where the line length isn't equal the pitch
@@ -1167,7 +1148,7 @@ sisusbcon_do_font_op(struct sisusb_usb_data *sisusb, int set, int slot,
 
         if ((slot != 0 && slot != 2) || !fh) {
                 if (uplock)
-                        up(&sisusb->lock);
+                        mutex_unlock(&sisusb->lock);
                 return -EINVAL;
         }
 
@@ -1327,7 +1308,7 @@ sisusbcon_do_font_op(struct sisusb_usb_data *sisusb, int set, int slot,
         }
 
         if (uplock)
-                up(&sisusb->lock);
+                mutex_unlock(&sisusb->lock);
 
         if (dorecalc && c) {
                 int i, rows = c->vc_scan_lines / fh;
@@ -1351,7 +1332,7 @@ sisusbcon_do_font_op(struct sisusb_usb_data *sisusb, int set, int slot,
 
 font_op_error:
         if (uplock)
-                up(&sisusb->lock);
+                mutex_unlock(&sisusb->lock);
 
         return -EIO;
 }
@@ -1417,19 +1398,19 @@ sisusbcon_font_get(struct vc_data *c, struct console_font *font)
         font->charcount = 256;
 
         if (!font->data) {
-                up(&sisusb->lock);
+                mutex_unlock(&sisusb->lock);
                 return 0;
         }
 
         if (!sisusb->font_backup) {
-                up(&sisusb->lock);
+                mutex_unlock(&sisusb->lock);
                 return -ENODEV;
         }
 
         /* Copy 256 chars only, like vgacon */
         memcpy(font->data, sisusb->font_backup, 256 * 32);
 
-        up(&sisusb->lock);
+        mutex_unlock(&sisusb->lock);
 
         return 0;
 }
@@ -1486,7 +1467,7 @@ static int sisusbdummycon_dummy(void)
 
 #define SISUSBCONDUMMY  (void *)sisusbdummycon_dummy
 
-const struct consw sisusb_dummy_con = {
+static const struct consw sisusb_dummy_con = {
         .owner =                THIS_MODULE,
         .con_startup =          sisusbdummycon_startup,
         .con_init =             sisusbdummycon_init,
@@ -1512,14 +1493,14 @@ sisusb_console_init(struct sisusb_usb_data *sisusb, int first, int last)
 {
         int i, ret, minor = sisusb->minor;
 
-        down(&disconnect_sem);
+        mutex_lock(&disconnect_mutex);
 
-        down(&sisusb->lock);
+        mutex_lock(&sisusb->lock);
 
         /* Erm.. that should not happen */
         if (sisusb->haveconsole || !sisusb->SiS_Pr) {
-                up(&sisusb->lock);
-                up(&disconnect_sem);
+                mutex_unlock(&sisusb->lock);
+                mutex_unlock(&disconnect_mutex);
                 return 1;
         }
 
@@ -1529,15 +1510,15 @@ sisusb_console_init(struct sisusb_usb_data *sisusb, int first, int last)
         if (first > last ||
             first > MAX_NR_CONSOLES ||
             last > MAX_NR_CONSOLES) {
-                up(&sisusb->lock);
-                up(&disconnect_sem);
+                mutex_unlock(&sisusb->lock);
+                mutex_unlock(&disconnect_mutex);
                 return 1;
         }
 
         /* If gfxcore not initialized or no consoles given, quit graciously */
         if (!sisusb->gfxinit || first < 1 || last < 1) {
-                up(&sisusb->lock);
-                up(&disconnect_sem);
+                mutex_unlock(&sisusb->lock);
+                mutex_unlock(&disconnect_mutex);
                 return 0;
         }
 
@@ -1547,8 +1528,8 @@ sisusb_console_init(struct sisusb_usb_data *sisusb, int first, int last)
 
         /* Set up text mode (and upload  default font) */
         if (sisusb_reset_text_mode(sisusb, 1)) {
-                up(&sisusb->lock);
-                up(&disconnect_sem);
+                mutex_unlock(&sisusb->lock);
+                mutex_unlock(&disconnect_mutex);
                 printk(KERN_ERR
                         "sisusbvga[%d]: Failed to set up text mode\n",
                         minor);
@@ -1571,16 +1552,16 @@ sisusb_console_init(struct sisusb_usb_data *sisusb, int first, int last)
 
         /* Allocate screen buffer */
         if (!(sisusb->scrbuf = (unsigned long)vmalloc(sisusb->scrbuf_size))) {
-                up(&sisusb->lock);
-                up(&disconnect_sem);
+                mutex_unlock(&sisusb->lock);
+                mutex_unlock(&disconnect_mutex);
                 printk(KERN_ERR
                         "sisusbvga[%d]: Failed to allocate screen buffer\n",
                         minor);
                 return 1;
         }
 
-        up(&sisusb->lock);
-        up(&disconnect_sem);
+        mutex_unlock(&sisusb->lock);
+        mutex_unlock(&disconnect_mutex);
 
         /* Now grab the desired console(s) */
         ret = take_over_console(&sisusb_con, first - 1, last - 1, 0);
diff --git a/drivers/usb/misc/sisusbvga/sisusb_init.c b/drivers/usb/misc/sisusbvga/sisusb_init.c
index 044fa4482f9f..968f0d38cff7 100644
--- a/drivers/usb/misc/sisusbvga/sisusb_init.c
+++ b/drivers/usb/misc/sisusbvga/sisusb_init.c
@@ -74,6 +74,7 @@ SiSUSB_InitPtr(struct SiS_Private *SiS_Pr)
 /*            HELPER: Get ModeID             */
 /*********************************************/
 
+#if 0
 unsigned short
 SiSUSB_GetModeID(int HDisplay, int VDisplay, int Depth)
 {
@@ -157,6 +158,7 @@ SiSUSB_GetModeID(int HDisplay, int VDisplay, int Depth)
 
         return ModeIndex;
 }
+#endif  /*  0  */
 
 /*********************************************/
 /*          HELPER: SetReg, GetReg           */
@@ -233,7 +235,7 @@ SiS_DisplayOn(struct SiS_Private *SiS_Pr)
 /*        HELPER: Init Port Addresses        */
 /*********************************************/
 
-void
+static void
 SiSUSBRegInit(struct SiS_Private *SiS_Pr, unsigned long BaseAddr)
 {
         SiS_Pr->SiS_P3c4 = BaseAddr + 0x14;
diff --git a/drivers/usb/misc/sisusbvga/sisusb_init.h b/drivers/usb/misc/sisusbvga/sisusb_init.h
index 5b11577835c8..f05f83268af4 100644
--- a/drivers/usb/misc/sisusbvga/sisusb_init.h
+++ b/drivers/usb/misc/sisusbvga/sisusb_init.h
@@ -690,7 +690,7 @@ static const struct SiS_CRT1Table SiSUSB_CRT1Table[] =
    0x41}}   /* 0x54 */
 };
 
-static struct SiS_VCLKData SiSUSB_VCLKData[] =
+static const struct SiS_VCLKData SiSUSB_VCLKData[] =
 {
         { 0x1b,0xe1, 25}, /* 0x00 */
         { 0x4e,0xe4, 28}, /* 0x01 */
@@ -808,8 +808,8 @@ static struct SiS_VCLKData SiSUSB_VCLKData[] =
         { 0x2b,0xc2, 35}  /* 0x71 768@576@60 */
 };
 
-void            SiSUSBRegInit(struct SiS_Private *SiS_Pr, unsigned long BaseAddr);
-unsigned short  SiSUSB_GetModeID(int HDisplay, int VDisplay, int Depth);
+extern struct mutex disconnect_mutex;
+
 int             SiSUSBSetMode(struct SiS_Private *SiS_Pr, unsigned short ModeNo);
 int             SiSUSBSetVESAMode(struct SiS_Private *SiS_Pr, unsigned short VModeNo);
 
@@ -826,5 +826,19 @@ extern int	sisusb_setidxregor(struct sisusb_usb_data *sisusb, int port,
 extern int      sisusb_setidxregand(struct sisusb_usb_data *sisusb, int port,
                                         u8 idx, u8 myand);
 
+void sisusb_delete(struct kref *kref);
+int sisusb_writeb(struct sisusb_usb_data *sisusb, u32 adr, u8 data);
+int sisusb_readb(struct sisusb_usb_data *sisusb, u32 adr, u8 *data);
+int sisusb_copy_memory(struct sisusb_usb_data *sisusb, char *src,
+                       u32 dest, int length, size_t *bytes_written);
+int sisusb_reset_text_mode(struct sisusb_usb_data *sisusb, int init);
+int sisusbcon_do_font_op(struct sisusb_usb_data *sisusb, int set, int slot,
+                         u8 *arg, int cmapsz, int ch512, int dorecalc,
+                         struct vc_data *c, int fh, int uplock);
+void sisusb_set_cursor(struct sisusb_usb_data *sisusb, unsigned int location);
+int sisusb_console_init(struct sisusb_usb_data *sisusb, int first, int last);
+void sisusb_console_exit(struct sisusb_usb_data *sisusb);
+void sisusb_init_concode(void);
+
 #endif
 
diff --git a/drivers/usb/misc/sisusbvga/sisusb_struct.h b/drivers/usb/misc/sisusbvga/sisusb_struct.h
index 94edd4726c42..f325ecb29a61 100644
--- a/drivers/usb/misc/sisusbvga/sisusb_struct.h
+++ b/drivers/usb/misc/sisusbvga/sisusb_struct.h
@@ -161,7 +161,7 @@ struct SiS_Private
         const struct SiS_Ext            *SiS_EModeIDTable;
         const struct SiS_Ext2           *SiS_RefIndex;
         const struct SiS_CRT1Table      *SiS_CRT1Table;
-        struct SiS_VCLKData             *SiS_VCLKData;
+        const struct SiS_VCLKData       *SiS_VCLKData;
         const struct SiS_ModeResInfo    *SiS_ModeResInfo;
 };
 
diff --git a/drivers/usb/misc/usbtest.c b/drivers/usb/misc/usbtest.c
index ccc5e8238bd8..81ba14c73dc7 100644
--- a/drivers/usb/misc/usbtest.c
+++ b/drivers/usb/misc/usbtest.c
@@ -802,7 +802,9 @@ error:
 
                                 if (u == urb || !u->dev)
                                         continue;
+                                spin_unlock(&ctx->lock);
                                 status = usb_unlink_urb (u);
+                                spin_lock(&ctx->lock);
                                 switch (status) {
                                 case -EINPROGRESS:
                                 case -EBUSY:
@@ -1335,7 +1337,9 @@ struct iso_context {
         unsigned                pending;
         spinlock_t              lock;
         struct completion       done;
+        int                     submit_error;
         unsigned long           errors;
+        unsigned long           packet_count;
         struct usbtest_dev      *dev;
 };
 
@@ -1346,10 +1350,14 @@ static void iso_callback (struct urb *urb, struct pt_regs *regs)
         spin_lock(&ctx->lock);
         ctx->count--;
 
+        ctx->packet_count += urb->number_of_packets;
         if (urb->error_count > 0)
                 ctx->errors += urb->error_count;
+        else if (urb->status != 0)
+                ctx->errors += urb->number_of_packets;
 
-        if (urb->status == 0 && ctx->count > (ctx->pending - 1)) {
+        if (urb->status == 0 && ctx->count > (ctx->pending - 1)
+                        && !ctx->submit_error) {
                 int status = usb_submit_urb (urb, GFP_ATOMIC);
                 switch (status) {
                 case 0:
@@ -1360,6 +1368,8 @@ static void iso_callback (struct urb *urb, struct pt_regs *regs)
                                         status);
                         /* FALLTHROUGH */
                 case -ENODEV:                   /* disconnected */
+                case -ESHUTDOWN:                /* endpoint disabled */
+                        ctx->submit_error = 1;
                         break;
                 }
         }
@@ -1369,8 +1379,8 @@ static void iso_callback (struct urb *urb, struct pt_regs *regs)
         if (ctx->pending == 0) {
                 if (ctx->errors)
                         dev_dbg (&ctx->dev->intf->dev,
-                                "iso test, %lu errors\n",
-                                ctx->errors);
+                                "iso test, %lu errors out of %lu\n",
+                                ctx->errors, ctx->packet_count);
                 complete (&ctx->done);
         }
 done:
@@ -1431,15 +1441,14 @@ test_iso_queue (struct usbtest_dev *dev, struct usbtest_param *param,
         struct usb_device       *udev;
         unsigned                i;
         unsigned long           packets = 0;
-        int                     status;
+        int                     status = 0;
         struct urb              *urbs[10];      /* FIXME no limit */
 
         if (param->sglen > 10)
                 return -EDOM;
 
+        memset(&context, 0, sizeof context);
         context.count = param->iterations * param->sglen;
-        context.pending = param->sglen;
-        context.errors = 0;
         context.dev = dev;
         init_completion (&context.done);
         spin_lock_init (&context.lock);
@@ -1471,6 +1480,7 @@ test_iso_queue (struct usbtest_dev *dev, struct usbtest_param *param,
 
         spin_lock_irq (&context.lock);
         for (i = 0; i < param->sglen; i++) {
+                ++context.pending;
                 status = usb_submit_urb (urbs [i], SLAB_ATOMIC);
                 if (status < 0) {
                         ERROR (dev, "submit iso[%d], error %d\n", i, status);
@@ -1481,12 +1491,26 @@ test_iso_queue (struct usbtest_dev *dev, struct usbtest_param *param,
 
                         simple_free_urb (urbs [i]);
                         context.pending--;
+                        context.submit_error = 1;
+                        break;
                 }
         }
         spin_unlock_irq (&context.lock);
 
         wait_for_completion (&context.done);
-        return 0;
+
+        /*
+         * Isochronous transfers are expected to fail sometimes.  As an
+         * arbitrary limit, we will report an error if any submissions
+         * fail or if the transfer failure rate is > 10%.
+         */
+        if (status != 0)
+                ;
+        else if (context.submit_error)
+                status = -EACCES;
+        else if (context.errors > context.packet_count / 10)
+                status = -EIO;
+        return status;
 
 fail:
         for (i = 0; i < param->sglen; i++) {
diff --git a/drivers/usb/mon/mon_dma.c b/drivers/usb/mon/mon_dma.c
index 0a1367b760a0..ddcfc01e77a0 100644
--- a/drivers/usb/mon/mon_dma.c
+++ b/drivers/usb/mon/mon_dma.c
@@ -13,7 +13,10 @@
 #include <linux/usb.h>  /* Only needed for declarations in usb_mon.h */
 #include "usb_mon.h"
 
-#ifdef __i386__         /* CONFIG_ARCH_I386 does not exit */
+/*
+ * PC-compatibles, are, fortunately, sufficiently cache-coherent for this.
+ */
+#if defined(__i386__) || defined(__x86_64__) /* CONFIG_ARCH_I386 doesn't exit */
 #define MON_HAS_UNMAP 1
 
 #define phys_to_page(phys)      pfn_to_page((phys) >> PAGE_SHIFT)
diff --git a/drivers/usb/mon/mon_main.c b/drivers/usb/mon/mon_main.c
index 6ecc27302211..275a66f83058 100644
--- a/drivers/usb/mon/mon_main.c
+++ b/drivers/usb/mon/mon_main.c
@@ -97,6 +97,7 @@ static void mon_submit(struct usb_bus *ubus, struct urb *urb)
         if (mbus->nreaders == 0)
                 goto out_locked;
 
+        mbus->cnt_events++;
         list_for_each (pos, &mbus->r_list) {
                 r = list_entry(pos, struct mon_reader, r_link);
                 r->rnf_submit(r->r_data, urb);
@@ -113,20 +114,32 @@ out_unlocked:
 
 /*
  */
-static void mon_submit_error(struct usb_bus *ubus, struct urb *urb, int err)
+static void mon_submit_error(struct usb_bus *ubus, struct urb *urb, int error)
 {
         struct mon_bus *mbus;
+        unsigned long flags;
+        struct list_head *pos;
+        struct mon_reader *r;
 
         mbus = ubus->mon_bus;
         if (mbus == NULL)
                 goto out_unlocked;
 
-        /*
-         * XXX Capture the error code and the 'E' event.
-         */
+        spin_lock_irqsave(&mbus->lock, flags);
+        if (mbus->nreaders == 0)
+                goto out_locked;
 
+        mbus->cnt_events++;
+        list_for_each (pos, &mbus->r_list) {
+                r = list_entry(pos, struct mon_reader, r_link);
+                r->rnf_error(r->r_data, urb, error);
+        }
+
+        spin_unlock_irqrestore(&mbus->lock, flags);
         return;
 
+out_locked:
+        spin_unlock_irqrestore(&mbus->lock, flags);
 out_unlocked:
         return;
 }
@@ -152,6 +165,7 @@ static void mon_complete(struct usb_bus *ubus, struct urb *urb)
         }
 
         spin_lock_irqsave(&mbus->lock, flags);
+        mbus->cnt_events++;
         list_for_each (pos, &mbus->r_list) {
                 r = list_entry(pos, struct mon_reader, r_link);
                 r->rnf_complete(r->r_data, urb);
@@ -163,7 +177,6 @@ static void mon_complete(struct usb_bus *ubus, struct urb *urb)
 
 /*
  * Stop monitoring.
- * Obviously this must be well locked, so no need to play with mb's.
  */
 static void mon_stop(struct mon_bus *mbus)
 {
diff --git a/drivers/usb/mon/mon_stat.c b/drivers/usb/mon/mon_stat.c
index 6e4b165d070a..1fe01d994a79 100644
--- a/drivers/usb/mon/mon_stat.c
+++ b/drivers/usb/mon/mon_stat.c
@@ -31,8 +31,8 @@ static int mon_stat_open(struct inode *inode, struct file *file)
         mbus = inode->u.generic_ip;
 
         sp->slen = snprintf(sp->str, STAT_BUF_SIZE,
-            "nreaders %d text_lost %u\n",
-            mbus->nreaders, mbus->cnt_text_lost);
+            "nreaders %d events %u text_lost %u\n",
+            mbus->nreaders, mbus->cnt_events, mbus->cnt_text_lost);
 
         file->private_data = sp;
         return 0;
diff --git a/drivers/usb/mon/mon_text.c b/drivers/usb/mon/mon_text.c
index ac043ec2b8dc..e02c1a30c4cd 100644
--- a/drivers/usb/mon/mon_text.c
+++ b/drivers/usb/mon/mon_text.c
@@ -26,10 +26,13 @@
 
 /*
  * This limit exists to prevent OOMs when the user process stops reading.
+ * If usbmon were available to unprivileged processes, it might be open
+ * to a local DoS. But we have to keep to root in order to prevent
+ * password sniffing from HID devices.
  */
-#define EVENT_MAX  25
+#define EVENT_MAX  (2*PAGE_SIZE / sizeof(struct mon_event_text))
 
-#define PRINTF_DFL  130
+#define PRINTF_DFL  160
 
 struct mon_event_text {
         struct list_head e_link;
@@ -111,7 +114,7 @@ static inline char mon_text_get_data(struct mon_event_text *ep, struct urb *urb,
          * number of corner cases, but it seems that the following is
          * more or less safe.
          *
-         * We do not even try to look transfer_buffer, because it can
+         * We do not even try to look at transfer_buffer, because it can
          * contain non-NULL garbage in case the upper level promised to
          * set DMA for the HCD.
          */
@@ -179,6 +182,32 @@ static void mon_text_complete(void *data, struct urb *urb)
         mon_text_event(rp, urb, 'C');
 }
 
+static void mon_text_error(void *data, struct urb *urb, int error)
+{
+        struct mon_reader_text *rp = data;
+        struct mon_event_text *ep;
+
+        if (rp->nevents >= EVENT_MAX ||
+            (ep = kmem_cache_alloc(rp->e_slab, SLAB_ATOMIC)) == NULL) {
+                rp->r.m_bus->cnt_text_lost++;
+                return;
+        }
+
+        ep->type = 'E';
+        ep->pipe = urb->pipe;
+        ep->id = (unsigned long) urb;
+        ep->tstamp = 0;
+        ep->length = 0;
+        ep->status = error;
+
+        ep->setup_flag = '-';
+        ep->data_flag = 'E';
+
+        rp->nevents++;
+        list_add_tail(&ep->e_link, &rp->e_list);
+        wake_up(&rp->wait);
+}
+
 /*
  * Fetch next event from the circular buffer.
  */
@@ -232,6 +261,7 @@ static int mon_text_open(struct inode *inode, struct file *file)
         rp->r.m_bus = mbus;
         rp->r.r_data = rp;
         rp->r.rnf_submit = mon_text_submit;
+        rp->r.rnf_error = mon_text_error;
         rp->r.rnf_complete = mon_text_complete;
 
         snprintf(rp->slab_name, SLAB_NAME_SZ, "mon%dt_%lx", ubus->busnum,
diff --git a/drivers/usb/mon/usb_mon.h b/drivers/usb/mon/usb_mon.h
index 8e0613c350cc..33678c24ebee 100644
--- a/drivers/usb/mon/usb_mon.h
+++ b/drivers/usb/mon/usb_mon.h
@@ -27,6 +27,7 @@ struct mon_bus {
         struct kref ref;                /* Under mon_lock */
 
         /* Stats */
+        unsigned int cnt_events;
         unsigned int cnt_text_lost;
 };
 
@@ -39,6 +40,7 @@ struct mon_reader {
         void *r_data;           /* Use container_of instead? */
 
         void (*rnf_submit)(void *data, struct urb *urb);
+        void (*rnf_error)(void *data, struct urb *urb, int error);
         void (*rnf_complete)(void *data, struct urb *urb);
 };
 
diff --git a/drivers/usb/net/asix.c b/drivers/usb/net/asix.c
index 12b599a0b539..37111acec875 100644
--- a/drivers/usb/net/asix.c
+++ b/drivers/usb/net/asix.c
@@ -912,6 +912,10 @@ static const struct usb_device_id	products [] = {
         USB_DEVICE (0x0b95, 0x7720),
         .driver_info = (unsigned long) &ax88772_info,
 }, {
+        // ASIX AX88178 10/100/1000
+        USB_DEVICE (0x0b95, 0x1780),
+        .driver_info = (unsigned long) &ax88772_info,
+}, {
         // Linksys USB200M Rev 2
         USB_DEVICE (0x13b1, 0x0018),
         .driver_info = (unsigned long) &ax88772_info,
diff --git a/drivers/usb/net/cdc_ether.c b/drivers/usb/net/cdc_ether.c
index 63f1f3ba8e0b..efd195b5912c 100644
--- a/drivers/usb/net/cdc_ether.c
+++ b/drivers/usb/net/cdc_ether.c
@@ -31,7 +31,7 @@
 #include <linux/workqueue.h>
 #include <linux/mii.h>
 #include <linux/usb.h>
-#include <linux/usb_cdc.h>
+#include <linux/usb/cdc.h>
 
 #include "usbnet.h"
 
@@ -455,6 +455,18 @@ static const struct usb_device_id	products [] = {
         .driver_info            = 0,
 },
 
+/* Olympus has some models with a Zaurus-compatible option.
+ * R-1000 uses a FreeScale i.MXL cpu (ARMv4T)
+ */
+{
+        .match_flags    =   USB_DEVICE_ID_MATCH_INT_INFO
+                 | USB_DEVICE_ID_MATCH_DEVICE,
+        .idVendor               = 0x07B4,
+        .idProduct              = 0x0F02,       /* R-1000 */
+        ZAURUS_MASTER_INTERFACE,
+        .driver_info            = 0,
+},
+
 /*
  * WHITELIST!!!
  *
diff --git a/drivers/usb/net/pegasus.c b/drivers/usb/net/pegasus.c
index 7683926a1b6f..ab21f960d255 100644
--- a/drivers/usb/net/pegasus.c
+++ b/drivers/usb/net/pegasus.c
@@ -163,6 +163,8 @@ static int get_registers(pegasus_t * pegasus, __u16 indx, __u16 size,
 
         /* using ATOMIC, we'd never wake up if we slept */
         if ((ret = usb_submit_urb(pegasus->ctrl_urb, GFP_ATOMIC))) {
+                if (ret == -ENODEV)
+                        netif_device_detach(pegasus->net);
                 if (netif_msg_drv(pegasus))
                         dev_err(&pegasus->intf->dev, "%s, status %d\n",
                                         __FUNCTION__, ret);
@@ -217,6 +219,8 @@ static int set_registers(pegasus_t * pegasus, __u16 indx, __u16 size,
         set_current_state(TASK_UNINTERRUPTIBLE);
 
         if ((ret = usb_submit_urb(pegasus->ctrl_urb, GFP_ATOMIC))) {
+                if (ret == -ENODEV)
+                        netif_device_detach(pegasus->net);
                 if (netif_msg_drv(pegasus))
                         dev_err(&pegasus->intf->dev, "%s, status %d\n",
                                         __FUNCTION__, ret);
@@ -268,6 +272,8 @@ static int set_register(pegasus_t * pegasus, __u16 indx, __u8 data)
         set_current_state(TASK_UNINTERRUPTIBLE);
 
         if ((ret = usb_submit_urb(pegasus->ctrl_urb, GFP_ATOMIC))) {
+                if (ret == -ENODEV)
+                        netif_device_detach(pegasus->net);
                 if (netif_msg_drv(pegasus))
                         dev_err(&pegasus->intf->dev, "%s, status %d\n",
                                         __FUNCTION__, ret);
@@ -298,10 +304,13 @@ static int update_eth_regs_async(pegasus_t * pegasus)
                              (char *) &pegasus->dr,
                              pegasus->eth_regs, 3, ctrl_callback, pegasus);
 
-        if ((ret = usb_submit_urb(pegasus->ctrl_urb, GFP_ATOMIC)))
+        if ((ret = usb_submit_urb(pegasus->ctrl_urb, GFP_ATOMIC))) {
+                if (ret == -ENODEV)
+                        netif_device_detach(pegasus->net);
                 if (netif_msg_drv(pegasus))
                         dev_err(&pegasus->intf->dev, "%s, status %d\n",
                                         __FUNCTION__, ret);
+        }
 
         return ret;
 }
@@ -692,7 +701,10 @@ goon:
                           usb_rcvbulkpipe(pegasus->usb, 1),
                           pegasus->rx_skb->data, PEGASUS_MTU + 8,
                           read_bulk_callback, pegasus);
-        if (usb_submit_urb(pegasus->rx_urb, GFP_ATOMIC)) {
+        rx_status = usb_submit_urb(pegasus->rx_urb, GFP_ATOMIC);
+        if (rx_status == -ENODEV)
+                netif_device_detach(pegasus->net);
+        else if (rx_status) {
                 pegasus->flags |= PEGASUS_RX_URB_FAIL;
                 goto tl_sched;
         } else {
@@ -709,6 +721,7 @@ static void rx_fixup(unsigned long data)
 {
         pegasus_t *pegasus;
         unsigned long flags;
+        int status;
 
         pegasus = (pegasus_t *) data;
         if (pegasus->flags & PEGASUS_UNPLUG)
@@ -734,7 +747,10 @@ static void rx_fixup(unsigned long data)
                           pegasus->rx_skb->data, PEGASUS_MTU + 8,
                           read_bulk_callback, pegasus);
 try_again:
-        if (usb_submit_urb(pegasus->rx_urb, GFP_ATOMIC)) {
+        status = usb_submit_urb(pegasus->rx_urb, GFP_ATOMIC);
+        if (status == -ENODEV)
+                netif_device_detach(pegasus->net);
+        else if (status) {
                 pegasus->flags |= PEGASUS_RX_URB_FAIL;
                 tasklet_schedule(&pegasus->rx_tl);
         } else {
@@ -836,6 +852,8 @@ static void intr_callback(struct urb *urb, struct pt_regs *regs)
         }
 
         status = usb_submit_urb(urb, SLAB_ATOMIC);
+        if (status == -ENODEV)
+                netif_device_detach(pegasus->net);
         if (status && netif_msg_timer(pegasus))
                 printk(KERN_ERR "%s: can't resubmit interrupt urb, %d\n",
                                 net->name, status);
@@ -874,6 +892,7 @@ static int pegasus_start_xmit(struct sk_buff *skb, struct net_device *net)
                         /* cleanup should already have been scheduled */
                         break;
                 case -ENODEV:           /* disconnect() upcoming */
+                        netif_device_detach(pegasus->net);
                         break;
                 default:
                         pegasus->stats.tx_errors++;
@@ -999,6 +1018,8 @@ static int pegasus_open(struct net_device *net)
                           pegasus->rx_skb->data, PEGASUS_MTU + 8,
                           read_bulk_callback, pegasus);
         if ((res = usb_submit_urb(pegasus->rx_urb, GFP_KERNEL))) {
+                if (res == -ENODEV)
+                        netif_device_detach(pegasus->net);
                 if (netif_msg_ifup(pegasus))
                         pr_debug("%s: failed rx_urb, %d", net->name, res);
                 goto exit;
@@ -1009,6 +1030,8 @@ static int pegasus_open(struct net_device *net)
                          pegasus->intr_buff, sizeof (pegasus->intr_buff),
                          intr_callback, pegasus, pegasus->intr_interval);
         if ((res = usb_submit_urb(pegasus->intr_urb, GFP_KERNEL))) {
+                if (res == -ENODEV)
+                        netif_device_detach(pegasus->net);
                 if (netif_msg_ifup(pegasus))
                         pr_debug("%s: failed intr_urb, %d\n", net->name, res);
                 usb_kill_urb(pegasus->rx_urb);
diff --git a/drivers/usb/net/rndis_host.c b/drivers/usb/net/rndis_host.c
index 94ddfe16fdda..f551546d7521 100644
--- a/drivers/usb/net/rndis_host.c
+++ b/drivers/usb/net/rndis_host.c
@@ -30,7 +30,7 @@
 #include <linux/workqueue.h>
 #include <linux/mii.h>
 #include <linux/usb.h>
-#include <linux/usb_cdc.h>
+#include <linux/usb/cdc.h>
 
 #include "usbnet.h"
 
diff --git a/drivers/usb/net/zaurus.c b/drivers/usb/net/zaurus.c
index f7ac9d6b9856..813e470d0600 100644
--- a/drivers/usb/net/zaurus.c
+++ b/drivers/usb/net/zaurus.c
@@ -30,7 +30,7 @@
 #include <linux/mii.h>
 #include <linux/crc32.h>
 #include <linux/usb.h>
-#include <linux/usb_cdc.h>
+#include <linux/usb/cdc.h>
 
 #include "usbnet.h"
 
@@ -109,7 +109,7 @@ static const struct driver_info	zaurus_sl5x00_info = {
         .check_connect = always_connected,
         .bind =         zaurus_bind,
         .unbind =       usbnet_cdc_unbind,
-        .tx_fixup =     zaurus_tx_fixup,
+        .tx_fixup =     zaurus_tx_fixup,
 };
 #define ZAURUS_STRONGARM_INFO   ((unsigned long)&zaurus_sl5x00_info)
 
@@ -119,7 +119,7 @@ static const struct driver_info	zaurus_pxa_info = {
         .check_connect = always_connected,
         .bind =         zaurus_bind,
         .unbind =       usbnet_cdc_unbind,
-        .tx_fixup =     zaurus_tx_fixup,
+        .tx_fixup =     zaurus_tx_fixup,
 };
 #define ZAURUS_PXA_INFO         ((unsigned long)&zaurus_pxa_info)
 
@@ -129,7 +129,7 @@ static const struct driver_info	olympus_mxl_info = {
         .check_connect = always_connected,
         .bind =         zaurus_bind,
         .unbind =       usbnet_cdc_unbind,
-        .tx_fixup =     zaurus_tx_fixup,
+        .tx_fixup =     zaurus_tx_fixup,
 };
 #define OLYMPUS_MXL_INFO        ((unsigned long)&olympus_mxl_info)
 
@@ -228,6 +228,11 @@ bad_detail:
                                                 detail->bDetailData[2]);
                                 goto bad_desc;
                         }
+
+                        /* same extra framing as for non-BLAN mode */
+                        dev->net->hard_header_len += 6;
+                        dev->rx_urb_size = dev->net->hard_header_len
+                                        + dev->net->mtu;
                         break;
                 }
 next_desc:
@@ -258,7 +263,7 @@ static const struct driver_info	bogus_mdlm_info = {
         .description =  "pseudo-MDLM (BLAN) device",
         .flags =        FLAG_FRAMING_Z,
         .check_connect = always_connected,
-        .tx_fixup =     zaurus_tx_fixup,
+        .tx_fixup =     zaurus_tx_fixup,
         .bind =         blan_mdlm_bind,
 };
 
@@ -367,13 +372,13 @@ static struct usb_driver zaurus_driver = {
 
 static int __init zaurus_init(void)
 {
-        return usb_register(&zaurus_driver);
+        return usb_register(&zaurus_driver);
 }
 module_init(zaurus_init);
 
 static void __exit zaurus_exit(void)
 {
-        usb_deregister(&zaurus_driver);
+        usb_deregister(&zaurus_driver);
 }
 module_exit(zaurus_exit);
 
diff --git a/drivers/usb/serial/Kconfig b/drivers/usb/serial/Kconfig
index 5c60be521561..8bd44fda5eaf 100644
--- a/drivers/usb/serial/Kconfig
+++ b/drivers/usb/serial/Kconfig
@@ -417,7 +417,7 @@ config USB_SERIAL_MCT_U232
           Magic Control Technology Corp. (U232 is one of the model numbers).
 
           This driver also works with Sitecom U232-P25 and D-Link DU-H3SP USB
-          BAY devices.
+          BAY, Belkin F5U109, and Belkin F5U409 devices.
 
           To compile this driver as a module, choose M here: the
           module will be called mct_u232.
@@ -491,16 +491,22 @@ config USB_SERIAL_XIRCOM
           module will be called keyspan_pda.
 
 config USB_SERIAL_OPTION
-        tristate "USB Option PCMCIA serial driver"
-        depends on USB_SERIAL && USB_OHCI_HCD && PCCARD
+        tristate "USB driver for GSM modems"
+        depends on USB_SERIAL
         help
-          Say Y here if you want to use an Option card. This is a
-          GSM card, controlled by three serial ports which are connected
-          via an OHCI adapter located on a PC card.
+          Say Y here if you have an "Option" GSM PCMCIA card
+          (or an OEM version: branded Huawei, Audiovox, or Novatel).
+
+          These cards feature a built-in OHCI-USB adapter and an
+          internally-connected GSM modem. The USB bus is not
+          accessible externally.
 
           To compile this driver as a module, choose M here: the
           module will be called option.
 
+          If this driver doesn't recognize your device,
+          it might be accessible via the FTDI_SIO driver.
+
 config USB_SERIAL_OMNINET
         tristate "USB ZyXEL omni.net LCD Plus Driver (EXPERIMENTAL)"
         depends on USB_SERIAL && EXPERIMENTAL
diff --git a/drivers/usb/serial/airprime.c b/drivers/usb/serial/airprime.c
index 694b205f9b73..94b9ba0ff875 100644
--- a/drivers/usb/serial/airprime.c
+++ b/drivers/usb/serial/airprime.c
@@ -16,9 +16,11 @@
 #include "usb-serial.h"
 
 static struct usb_device_id id_table [] = {
+        { USB_DEVICE(0x0c88, 0x17da) }, /* Kyocera Wireless KPC650/Passport */
         { USB_DEVICE(0xf3d, 0x0112) },  /* AirPrime CDMA Wireless PC Card */
         { USB_DEVICE(0x1410, 0x1110) }, /* Novatel Wireless Merlin CDMA */
         { USB_DEVICE(0x1199, 0x0112) }, /* Sierra Wireless Aircard 580 */
+        { USB_DEVICE(0x1199, 0x0218) }, /* Sierra Wireless MC5720 */
         { },
 };
 MODULE_DEVICE_TABLE(usb, id_table);
diff --git a/drivers/usb/serial/console.c b/drivers/usb/serial/console.c
index 8023bb7279b1..f3404e10afb4 100644
--- a/drivers/usb/serial/console.c
+++ b/drivers/usb/serial/console.c
@@ -202,7 +202,7 @@ static void usb_console_write(struct console *co, const char *buf, unsigned coun
         struct usb_serial *serial;
         int retval = -ENODEV;
 
-        if (!port)
+        if (!port || port->serial->dev->state == USB_STATE_NOTATTACHED)
                 return;
         serial = port->serial;
 
@@ -213,17 +213,38 @@ static void usb_console_write(struct console *co, const char *buf, unsigned coun
 
         if (!port->open_count) {
                 dbg ("%s - port not opened", __FUNCTION__);
-                goto exit;
+                return;
         }
 
-        /* pass on to the driver specific version of this function if it is available */
-        if (serial->type->write)
-                retval = serial->type->write(port, buf, count);
-        else
-                retval = usb_serial_generic_write(port, buf, count);
-
-exit:
-        dbg("%s - return value (if we had one): %d", __FUNCTION__, retval);
+        while (count) {
+                unsigned int i;
+                unsigned int lf;
+                /* search for LF so we can insert CR if necessary */
+                for (i=0, lf=0 ; i < count ; i++) {
+                        if (*(buf + i) == 10) {
+                                lf = 1;
+                                i++;
+                                break;
+                        }
+                }
+                /* pass on to the driver specific version of this function if it is available */
+                if (serial->type->write)
+                        retval = serial->type->write(port, buf, i);
+                else
+                        retval = usb_serial_generic_write(port, buf, i);
+                dbg("%s - return value : %d", __FUNCTION__, retval);
+                if (lf) {
+                        /* append CR after LF */
+                        unsigned char cr = 13;
+                        if (serial->type->write)
+                                retval = serial->type->write(port, &cr, 1);
+                        else
+                                retval = usb_serial_generic_write(port, &cr, 1);
+                        dbg("%s - return value : %d", __FUNCTION__, retval);
+                }
+                buf += i;
+                count -= i;
+        }
 }
 
 static struct console usbcons = {
@@ -234,6 +255,14 @@ static struct console usbcons = {
         .index =        -1,
 };
 
+void usb_serial_console_disconnect(struct usb_serial *serial)
+{
+        if (serial && serial->port && serial->port[0] && serial->port[0] == usbcons_info.port) {
+                usb_serial_console_exit();
+                usb_serial_put(serial);
+        }
+}
+
 void usb_serial_console_init (int serial_debug, int minor)
 {
         debug = serial_debug;
@@ -259,6 +288,11 @@ void usb_serial_console_init (int serial_debug, int minor)
 
 void usb_serial_console_exit (void)
 {
-        unregister_console(&usbcons);
+        if (usbcons_info.port) {
+                unregister_console(&usbcons);
+                if (usbcons_info.port->open_count)
+                        usbcons_info.port->open_count--;
+                usbcons_info.port = NULL;
+        }
 }
 
diff --git a/drivers/usb/serial/cp2101.c b/drivers/usb/serial/cp2101.c
index e0c2acdb3f06..f8c0cb287736 100644
--- a/drivers/usb/serial/cp2101.c
+++ b/drivers/usb/serial/cp2101.c
@@ -59,6 +59,7 @@ static struct usb_device_id id_table [] = {
         { USB_DEVICE(0x10AB, 0x10C5) }, /* Siemens MC60 Cable */
         { USB_DEVICE(0x10B5, 0xAC70) }, /* Nokia CA-42 USB */
         { USB_DEVICE(0x10C4, 0x803B) }, /* Pololu USB-serial converter */
+        { USB_DEVICE(0x10C4, 0x8066) }, /* Argussoft In-System Programmer */
         { USB_DEVICE(0x10C4, 0x807A) }, /* Crumb128 board */
         { USB_DEVICE(0x10C4, 0x80CA) }, /* Degree Controls Inc */
         { USB_DEVICE(0x10C4, 0x80F6) }, /* Suunto sports instrument */
diff --git a/drivers/usb/serial/cyberjack.c b/drivers/usb/serial/cyberjack.c
index 2357b1d102d7..1fd5c5a9f2ef 100644
--- a/drivers/usb/serial/cyberjack.c
+++ b/drivers/usb/serial/cyberjack.c
@@ -469,7 +469,7 @@ static void cyberjack_write_bulk_callback (struct urb *urb, struct pt_regs *regs
 
 exit:
         spin_unlock(&priv->lock);
-        schedule_work(&port->work);
+        usb_serial_port_softint(port);
 }
 
 static int __init cyberjack_init (void)
diff --git a/drivers/usb/serial/cypress_m8.c b/drivers/usb/serial/cypress_m8.c
index 7212fbe3b6f2..5de76efe1b37 100644
--- a/drivers/usb/serial/cypress_m8.c
+++ b/drivers/usb/serial/cypress_m8.c
@@ -824,7 +824,7 @@ send:
         priv->bytes_out += count; /* do not count the line control and size bytes */
         spin_unlock_irqrestore(&priv->lock, flags);
 
-        schedule_work(&port->work);
+        usb_serial_port_softint(port);
 } /* cypress_send */
 
 
diff --git a/drivers/usb/serial/empeg.c b/drivers/usb/serial/empeg.c
index 63f7c78a1152..afca1eae5fb5 100644
--- a/drivers/usb/serial/empeg.c
+++ b/drivers/usb/serial/empeg.c
@@ -335,7 +335,7 @@ static void empeg_write_bulk_callback (struct urb *urb, struct pt_regs *regs)
                 return;
         }
 
-        schedule_work(&port->work);
+        usb_serial_port_softint(port);
 }
 
 
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index 986d7622273d..b2bfea7c815a 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -500,6 +500,7 @@ static struct usb_device_id id_table_combined [] = {
         { USB_DEVICE(ICOM_ID1_VID, ICOM_ID1_PID) },
         { USB_DEVICE(PAPOUCH_VID, PAPOUCH_TMU_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_ACG_HFDUAL_PID) },
+        { USB_DEVICE(FTDI_VID, FTDI_YEI_SERVOCENTER31_PID) },
         { },                                    /* Optional parameter entry */
         { }                                     /* Terminating entry */
 };
@@ -1261,7 +1262,6 @@ static void ftdi_shutdown (struct usb_serial *serial)
 
 static int  ftdi_open (struct usb_serial_port *port, struct file *filp)
 { /* ftdi_open */
-        struct termios tmp_termios;
         struct usb_device *dev = port->serial->dev;
         struct ftdi_private *priv = usb_get_serial_port_data(port);
         unsigned long flags;
@@ -1271,8 +1271,8 @@ static int  ftdi_open (struct usb_serial_port *port, struct file *filp)
 
         dbg("%s", __FUNCTION__);
 
-
-        port->tty->low_latency = (priv->flags & ASYNC_LOW_LATENCY) ? 1 : 0;
+        if (port->tty)
+                port->tty->low_latency = (priv->flags & ASYNC_LOW_LATENCY) ? 1 : 0;
 
         /* No error checking for this (will get errors later anyway) */
         /* See ftdi_sio.h for description of what is reset */
@@ -1286,7 +1286,8 @@ static int  ftdi_open (struct usb_serial_port *port, struct file *filp)
            This is same behaviour as serial.c/rs_open() - Kuba */
 
         /* ftdi_set_termios  will send usb control messages */
-        ftdi_set_termios(port, &tmp_termios);
+        if (port->tty)
+                ftdi_set_termios(port, NULL);
 
         /* FIXME: Flow control might be enabled, so it should be checked -
            we have no control of defaults! */
@@ -1472,7 +1473,7 @@ static void ftdi_write_bulk_callback (struct urb *urb, struct pt_regs *regs)
                 return;
         }
 
-        schedule_work(&port->work);
+        usb_serial_port_softint(port);
 } /* ftdi_write_bulk_callback */
 
 
@@ -1867,7 +1868,7 @@ static void ftdi_set_termios (struct usb_serial_port *port, struct termios *old_
                         err("%s urb failed to set baudrate", __FUNCTION__);
                 }
                 /* Ensure RTS and DTR are raised when baudrate changed from 0 */
-                if ((old_termios->c_cflag & CBAUD) == B0) {
+                if (!old_termios || (old_termios->c_cflag & CBAUD) == B0) {
                         set_mctrl(port, TIOCM_DTR | TIOCM_RTS);
                 }
         }
diff --git a/drivers/usb/serial/ftdi_sio.h b/drivers/usb/serial/ftdi_sio.h
index d69a917e768f..6ab2ac845bd7 100644
--- a/drivers/usb/serial/ftdi_sio.h
+++ b/drivers/usb/serial/ftdi_sio.h
@@ -436,6 +436,12 @@
  */
 #define FTDI_ACG_HFDUAL_PID             0xDD20  /* HF Dual ISO Reader (RFID) */
 
+/*
+ * Yost Engineering, Inc. products (www.yostengineering.com).
+ * PID 0xE050 submitted by Aaron Prose.
+ */
+#define FTDI_YEI_SERVOCENTER31_PID      0xE050  /* YEI ServoCenter3.1 USB */
+
 /* Commands */
 #define FTDI_SIO_RESET          0 /* Reset the port */
 #define FTDI_SIO_MODEM_CTRL     1 /* Set the modem control register */
diff --git a/drivers/usb/serial/garmin_gps.c b/drivers/usb/serial/garmin_gps.c
index 5ec9bf5bac8d..04767759cf8a 100644
--- a/drivers/usb/serial/garmin_gps.c
+++ b/drivers/usb/serial/garmin_gps.c
@@ -1012,7 +1012,7 @@ static void garmin_write_bulk_callback (struct urb *urb, struct pt_regs *regs)
                 garmin_data_p->flags |= CLEAR_HALT_REQUIRED;
         }
 
-        schedule_work(&port->work);
+        usb_serial_port_softint(port);
 }
 
 
diff --git a/drivers/usb/serial/generic.c b/drivers/usb/serial/generic.c
index c62cc2876519..07a478c59fb2 100644
--- a/drivers/usb/serial/generic.c
+++ b/drivers/usb/serial/generic.c
@@ -299,9 +299,7 @@ void usb_serial_generic_write_bulk_callback (struct urb *urb, struct pt_regs *re
                 return;
         }
 
-        usb_serial_port_softint((void *)port);
-
-        schedule_work(&port->work);
+        usb_serial_port_softint(port);
 }
 EXPORT_SYMBOL_GPL(usb_serial_generic_write_bulk_callback);
 
diff --git a/drivers/usb/serial/io_edgeport.c b/drivers/usb/serial/io_edgeport.c
index b606c5968102..b85d2156dfdc 100644
--- a/drivers/usb/serial/io_edgeport.c
+++ b/drivers/usb/serial/io_edgeport.c
@@ -142,7 +142,7 @@ struct edgeport_port {
 
 /* This structure holds all of the individual device information */
 struct edgeport_serial {
-        char                    name[MAX_NAME_LEN+1];           /* string name of this device */
+        char                    name[MAX_NAME_LEN+2];           /* string name of this device */
 
         struct edge_manuf_descriptor    manuf_descriptor;       /* the manufacturer descriptor */
         struct edge_boot_descriptor     boot_descriptor;        /* the boot firmware descriptor */
@@ -270,7 +270,7 @@ static void get_manufacturing_desc	(struct edgeport_serial *edge_serial);
 static void get_boot_desc               (struct edgeport_serial *edge_serial);
 static void load_application_firmware   (struct edgeport_serial *edge_serial);
 
-static void unicode_to_ascii            (char *string, __le16 *unicode, int unicode_size);
+static void unicode_to_ascii(char *string, int buflen, __le16 *unicode, int unicode_size);
 
 
 // ************************************************************************
@@ -373,7 +373,7 @@ static void update_edgeport_E2PROM (struct edgeport_serial *edge_serial)
  *  Get string descriptor from device                                   *
  *                                                                      *
  ************************************************************************/
-static int get_string (struct usb_device *dev, int Id, char *string)
+static int get_string (struct usb_device *dev, int Id, char *string, int buflen)
 {
         struct usb_string_descriptor StringDesc;
         struct usb_string_descriptor *pStringDesc;
@@ -395,7 +395,7 @@ static int get_string (struct usb_device *dev, int Id, char *string)
                 return 0;
         }
 
-        unicode_to_ascii(string,  pStringDesc->wData,     pStringDesc->bLength/2-1);
+        unicode_to_ascii(string, buflen, pStringDesc->wData, pStringDesc->bLength/2);
 
         kfree(pStringDesc);
         return strlen(string);
@@ -2564,16 +2564,20 @@ static void change_port_settings (struct edgeport_port *edge_port, struct termio
  *      ASCII range, but it's only for debugging...
  *      NOTE: expects the unicode in LE format
  ****************************************************************************/
-static void unicode_to_ascii (char *string, __le16 *unicode, int unicode_size)
+static void unicode_to_ascii(char *string, int buflen, __le16 *unicode, int unicode_size)
 {
         int i;
 
-        if (unicode_size <= 0)
+        if (buflen <= 0)        /* never happens, but... */
                 return;
+        --buflen;               /* space for nul */
 
-        for (i = 0; i < unicode_size; ++i)
+        for (i = 0; i < unicode_size; i++) {
+                if (i >= buflen)
+                        break;
                 string[i] = (char)(le16_to_cpu(unicode[i]));
-        string[unicode_size] = 0x00;
+        }
+        string[i] = 0x00;
 }
 
 
@@ -2603,11 +2607,17 @@ static void get_manufacturing_desc (struct edgeport_serial *edge_serial)
                 dbg("  BoardRev:       %d", edge_serial->manuf_descriptor.BoardRev);
                 dbg("  NumPorts:       %d", edge_serial->manuf_descriptor.NumPorts);
                 dbg("  DescDate:       %d/%d/%d", edge_serial->manuf_descriptor.DescDate[0], edge_serial->manuf_descriptor.DescDate[1], edge_serial->manuf_descriptor.DescDate[2]+1900);
-                unicode_to_ascii (string, edge_serial->manuf_descriptor.SerialNumber, edge_serial->manuf_descriptor.SerNumLength/2-1);
+                unicode_to_ascii(string, sizeof(string),
+                    edge_serial->manuf_descriptor.SerialNumber,
+                    edge_serial->manuf_descriptor.SerNumLength/2);
                 dbg("  SerialNumber: %s", string);
-                unicode_to_ascii (string, edge_serial->manuf_descriptor.AssemblyNumber, edge_serial->manuf_descriptor.AssemblyNumLength/2-1);
+                unicode_to_ascii(string, sizeof(string),
+                    edge_serial->manuf_descriptor.AssemblyNumber,
+                    edge_serial->manuf_descriptor.AssemblyNumLength/2);
                 dbg("  AssemblyNumber: %s", string);
-                unicode_to_ascii (string, edge_serial->manuf_descriptor.OemAssyNumber, edge_serial->manuf_descriptor.OemAssyNumLength/2-1);
+                unicode_to_ascii(string, sizeof(string),
+                    edge_serial->manuf_descriptor.OemAssyNumber,
+                    edge_serial->manuf_descriptor.OemAssyNumLength/2);
                 dbg("  OemAssyNumber:  %s", string);
                 dbg("  UartType:       %d", edge_serial->manuf_descriptor.UartType);
                 dbg("  IonPid:         %d", edge_serial->manuf_descriptor.IonPid);
@@ -2720,7 +2730,7 @@ static int edge_startup (struct usb_serial *serial)
         struct edgeport_serial *edge_serial;
         struct edgeport_port *edge_port;
         struct usb_device *dev;
-        int i;
+        int i, j;
 
         dev = serial->dev;
 
@@ -2735,11 +2745,11 @@ static int edge_startup (struct usb_serial *serial)
         usb_set_serial_data(serial, edge_serial);
 
         /* get the name for the device from the device */
-        if ( (i = get_string(dev, dev->descriptor.iManufacturer, &edge_serial->name[0])) != 0) {
-                edge_serial->name[i-1] = ' ';
-        }
-
-        get_string(dev, dev->descriptor.iProduct, &edge_serial->name[i]);
+        i = get_string(dev, dev->descriptor.iManufacturer,
+            &edge_serial->name[0], MAX_NAME_LEN+1);
+        edge_serial->name[i++] = ' ';
+        get_string(dev, dev->descriptor.iProduct,
+            &edge_serial->name[i], MAX_NAME_LEN+2 - i);
 
         dev_info(&serial->dev->dev, "%s detected\n", edge_serial->name);
 
@@ -2784,6 +2794,10 @@ static int edge_startup (struct usb_serial *serial)
                 edge_port = kmalloc (sizeof(struct edgeport_port), GFP_KERNEL);
                 if (edge_port == NULL) {
                         dev_err(&serial->dev->dev, "%s - Out of memory\n", __FUNCTION__);
+                        for (j = 0; j < i; ++j) {
+                                kfree (usb_get_serial_port_data(serial->port[j]));
+                                usb_set_serial_port_data(serial->port[j],  NULL);
+                        }
                         usb_set_serial_data(serial, NULL);
                         kfree(edge_serial);
                         return -ENOMEM;
diff --git a/drivers/usb/serial/ipaq.c b/drivers/usb/serial/ipaq.c
index 9a5c97989562..9da6d2a8f2b0 100644
--- a/drivers/usb/serial/ipaq.c
+++ b/drivers/usb/serial/ipaq.c
@@ -870,7 +870,7 @@ static void ipaq_write_bulk_callback(struct urb *urb, struct pt_regs *regs)
                 spin_unlock_irqrestore(&write_list_lock, flags);
         }
 
-        schedule_work(&port->work);
+        usb_serial_port_softint(port);
 }
 
 static int ipaq_write_room(struct usb_serial_port *port)
diff --git a/drivers/usb/serial/ipw.c b/drivers/usb/serial/ipw.c
index e760a70242c1..a4a0bfeaab00 100644
--- a/drivers/usb/serial/ipw.c
+++ b/drivers/usb/serial/ipw.c
@@ -376,7 +376,7 @@ static void ipw_write_bulk_callback(struct urb *urb, struct pt_regs *regs)
         if (urb->status)
                 dbg("%s - nonzero write bulk status received: %d", __FUNCTION__, urb->status);
 
-        schedule_work(&port->work);
+        usb_serial_port_softint(port);
 }
 
 static int ipw_write(struct usb_serial_port *port, const unsigned char *buf, int count)
diff --git a/drivers/usb/serial/ir-usb.c b/drivers/usb/serial/ir-usb.c
index 426182ddc42a..9432c7302275 100644
--- a/drivers/usb/serial/ir-usb.c
+++ b/drivers/usb/serial/ir-usb.c
@@ -408,7 +408,7 @@ static void ir_write_bulk_callback (struct urb *urb, struct pt_regs *regs)
                 urb->actual_length,
                 urb->transfer_buffer);
 
-        schedule_work(&port->work);
+        usb_serial_port_softint(port);
 }
 
 static void ir_read_bulk_callback (struct urb *urb, struct pt_regs *regs)
diff --git a/drivers/usb/serial/keyspan.c b/drivers/usb/serial/keyspan.c
index 052b735c4fbd..2cf6ade704e4 100644
--- a/drivers/usb/serial/keyspan.c
+++ b/drivers/usb/serial/keyspan.c
@@ -481,7 +481,7 @@ static void	usa2x_outdat_callback(struct urb *urb, struct pt_regs *regs)
         dbg ("%s - urb %d", __FUNCTION__, urb == p_priv->out_urbs[1]); 
 
         if (port->open_count)
-                schedule_work(&port->work);
+                usb_serial_port_softint(port);
 }
 
 static void     usa26_inack_callback(struct urb *urb, struct pt_regs *regs)
diff --git a/drivers/usb/serial/kl5kusb105.c b/drivers/usb/serial/kl5kusb105.c
index 78335a5f7743..65d79f630fa4 100644
--- a/drivers/usb/serial/kl5kusb105.c
+++ b/drivers/usb/serial/kl5kusb105.c
@@ -569,8 +569,7 @@ static void klsi_105_write_bulk_callback ( struct urb *urb, struct pt_regs *regs
                 return;
         }
 
-        /* from generic_write_bulk_callback */
-        schedule_work(&port->work);
+        usb_serial_port_softint(port);
 } /* klsi_105_write_bulk_completion_callback */
 
 
diff --git a/drivers/usb/serial/omninet.c b/drivers/usb/serial/omninet.c
index 238033a87092..6dcdb5f598b8 100644
--- a/drivers/usb/serial/omninet.c
+++ b/drivers/usb/serial/omninet.c
@@ -320,7 +320,7 @@ static void omninet_write_bulk_callback (struct urb *urb, struct pt_regs *regs)
                 return;
         }
 
-        schedule_work(&port->work);
+        usb_serial_port_softint(port);
 }
 
 
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index 5cf2b80add7a..b0861b61bba7 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -1,5 +1,5 @@
 /*
-  Option Card (PCMCIA to) USB to Serial Driver
+  USB Driver for GSM modems
 
   Copyright (C) 2005  Matthias Urlichs <smurf@smurf.noris.de>
 
@@ -28,15 +28,34 @@
   2005-09-10  v0.4.3 added HUAWEI E600 card and Audiovox AirCard
   2005-09-20  v0.4.4 increased recv buffer size: the card sometimes
                      wants to send >2000 bytes.
-  2006-04-10  v0.4.2 fixed two array overrun errors :-/
+  2006-04-10  v0.5   fixed two array overrun errors :-/
+  2006-04-21  v0.5.1 added support for Sierra Wireless MC8755
+  2006-05-15  v0.6   re-enable multi-port support
+  2006-06-01  v0.6.1 add COBRA
+  2006-06-01  v0.6.2 add backwards-compatibility stuff
+  2006-06-01  v0.6.3 add Novatel Wireless
+  2006-06-01  v0.7   Option => GSM
 
   Work sponsored by: Sigos GmbH, Germany <info@sigos.de>
 
+  This driver exists because the "normal" serial driver doesn't work too well
+  with GSM modems. Issues:
+  - data loss -- one single Receive URB is not nearly enough
+  - nonstandard flow (Option devices) and multiplex (Sierra) control
+  - controlling the baud rate doesn't make sense
+
+  This driver is named "option" because the most common device it's
+  used for is a PC-Card (with an internal OHCI-USB interface, behind
+  which the GSM interface sits), made by Option Inc.
+
+  Some of the "one port" devices actually exhibit multiple USB instances
+  on the USB bus. This is not a bug, these ports are used for different
+  device features.
 */
 
-#define DRIVER_VERSION "v0.4"
+#define DRIVER_VERSION "v0.7.0"
 #define DRIVER_AUTHOR "Matthias Urlichs <smurf@smurf.noris.de>"
-#define DRIVER_DESC "Option Card (PC-Card to) USB to Serial Driver"
+#define DRIVER_DESC "USB Driver for GSM modems"
 
 #include <linux/config.h>
 #include <linux/kernel.h>
@@ -74,22 +93,45 @@ static int  option_tiocmset(struct usb_serial_port *port, struct file *file,
 static int  option_send_setup(struct usb_serial_port *port);
 
 /* Vendor and product IDs */
-#define OPTION_VENDOR_ID                        0x0AF0
-#define HUAWEI_VENDOR_ID                        0x12D1
-#define AUDIOVOX_VENDOR_ID                      0x0F3D
-
-#define OPTION_PRODUCT_OLD              0x5000
-#define OPTION_PRODUCT_FUSION   0x6000
-#define OPTION_PRODUCT_FUSION2  0x6300
-#define HUAWEI_PRODUCT_E600     0x1001
-#define AUDIOVOX_PRODUCT_AIRCARD 0x0112
+#define OPTION_VENDOR_ID                0x0AF0
+#define HUAWEI_VENDOR_ID                0x12D1
+#define AUDIOVOX_VENDOR_ID              0x0F3D
+#define SIERRAWIRELESS_VENDOR_ID        0x1199
+#define NOVATELWIRELESS_VENDOR_ID       0x1410
+
+#define OPTION_PRODUCT_OLD              0x5000
+#define OPTION_PRODUCT_FUSION           0x6000
+#define OPTION_PRODUCT_FUSION2          0x6300
+#define OPTION_PRODUCT_COBRA            0x6500
+#define HUAWEI_PRODUCT_E600             0x1001
+#define AUDIOVOX_PRODUCT_AIRCARD        0x0112
+#define SIERRAWIRELESS_PRODUCT_MC8755   0x6802
+#define NOVATELWIRELESS_PRODUCT_U740    0x1400
 
 static struct usb_device_id option_ids[] = {
         { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_OLD) },
         { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_FUSION) },
         { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_FUSION2) },
+        { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_COBRA) },
         { USB_DEVICE(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E600) },
         { USB_DEVICE(AUDIOVOX_VENDOR_ID, AUDIOVOX_PRODUCT_AIRCARD) },
+        { USB_DEVICE(SIERRAWIRELESS_VENDOR_ID, SIERRAWIRELESS_PRODUCT_MC8755) },
+        { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID,NOVATELWIRELESS_PRODUCT_U740) },
+        { } /* Terminating entry */
+};
+
+static struct usb_device_id option_ids1[] = {
+        { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_OLD) },
+        { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_FUSION) },
+        { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_FUSION2) },
+        { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_COBRA) },
+        { USB_DEVICE(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E600) },
+        { USB_DEVICE(AUDIOVOX_VENDOR_ID, AUDIOVOX_PRODUCT_AIRCARD) },
+        { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID,NOVATELWIRELESS_PRODUCT_U740) },
+        { } /* Terminating entry */
+};
+static struct usb_device_id option_ids3[] = {
+        { USB_DEVICE(SIERRAWIRELESS_VENDOR_ID, SIERRAWIRELESS_PRODUCT_MC8755) },
         { } /* Terminating entry */
 };
 
@@ -111,12 +153,39 @@ static struct usb_serial_driver option_3port_device = {
                 .owner =        THIS_MODULE,
                 .name =         "option",
         },
-        .description       = "Option 3G data card",
-        .id_table          = option_ids,
+        .description       = "GSM modem (3-port)",
+        .id_table          = option_ids3,
         .num_interrupt_in  = NUM_DONT_CARE,
         .num_bulk_in       = NUM_DONT_CARE,
         .num_bulk_out      = NUM_DONT_CARE,
-        .num_ports         = 1, /* 3, but the card reports its ports separately */
+        .num_ports         = 3,
+        .open              = option_open,
+        .close             = option_close,
+        .write             = option_write,
+        .write_room        = option_write_room,
+        .chars_in_buffer   = option_chars_in_buffer,
+        .throttle          = option_rx_throttle,
+        .unthrottle        = option_rx_unthrottle,
+        .set_termios       = option_set_termios,
+        .break_ctl         = option_break_ctl,
+        .tiocmget          = option_tiocmget,
+        .tiocmset          = option_tiocmset,
+        .attach            = option_startup,
+        .shutdown          = option_shutdown,
+        .read_int_callback = option_instat_callback,
+};
+
+static struct usb_serial_driver option_1port_device = {
+        .driver = {
+                .owner =        THIS_MODULE,
+                .name =         "option",
+        },
+        .description       = "GSM modem (1-port)",
+        .id_table          = option_ids1,
+        .num_interrupt_in  = NUM_DONT_CARE,
+        .num_bulk_in       = NUM_DONT_CARE,
+        .num_bulk_out      = NUM_DONT_CARE,
+        .num_ports         = 1,
         .open              = option_open,
         .close             = option_close,
         .write             = option_write,
@@ -170,6 +239,9 @@ struct option_port_private {
 static int __init option_init(void)
 {
         int retval;
+        retval = usb_serial_register(&option_1port_device);
+        if (retval)
+                goto failed_1port_device_register;
         retval = usb_serial_register(&option_3port_device);
         if (retval)
                 goto failed_3port_device_register;
@@ -184,6 +256,8 @@ static int __init option_init(void)
 failed_driver_register:
         usb_serial_deregister (&option_3port_device);
 failed_3port_device_register:
+        usb_serial_deregister (&option_1port_device);
+failed_1port_device_register:
         return retval;
 }
 
@@ -191,6 +265,7 @@ static void __exit option_exit(void)
 {
         usb_deregister (&option_driver);
         usb_serial_deregister (&option_3port_device);
+        usb_serial_deregister (&option_1port_device);
 }
 
 module_init(option_init);
@@ -365,8 +440,7 @@ static void option_outdat_callback(struct urb *urb, struct pt_regs *regs)
 
         port = (struct usb_serial_port *) urb->context;
 
-        if (port->open_count)
-                schedule_work(&port->work);
+        usb_serial_port_softint(port);
 }
 
 static void option_instat_callback(struct urb *urb, struct pt_regs *regs)
@@ -573,27 +647,30 @@ static struct urb *option_setup_urb(struct usb_serial *serial, int endpoint,
 /* Setup urbs */
 static void option_setup_urbs(struct usb_serial *serial)
 {
-        int j;
+        int i,j;
         struct usb_serial_port *port;
         struct option_port_private *portdata;
 
         dbg("%s", __FUNCTION__);
 
-        port = serial->port[0];
-        portdata = usb_get_serial_port_data(port);
+
+        for (i = 0; i < serial->num_ports; i++) {
+                port = serial->port[i];
+                portdata = usb_get_serial_port_data(port);
 
         /* Do indat endpoints first */
-        for (j = 0; j < N_IN_URB; ++j) {
-                portdata->in_urbs[j] = option_setup_urb (serial,
-                  port->bulk_in_endpointAddress, USB_DIR_IN, port,
-                  portdata->in_buffer[j], IN_BUFLEN, option_indat_callback);
-        }
+                for (j = 0; j < N_IN_URB; ++j) {
+                        portdata->in_urbs[j] = option_setup_urb (serial,
+                        port->bulk_in_endpointAddress, USB_DIR_IN, port,
+                        portdata->in_buffer[j], IN_BUFLEN, option_indat_callback);
+                }
 
-        /* outdat endpoints */
-        for (j = 0; j < N_OUT_URB; ++j) {
-                portdata->out_urbs[j] = option_setup_urb (serial,
-                  port->bulk_out_endpointAddress, USB_DIR_OUT, port,
-                  portdata->out_buffer[j], OUT_BUFLEN, option_outdat_callback);
+                /* outdat endpoints */
+                for (j = 0; j < N_OUT_URB; ++j) {
+                        portdata->out_urbs[j] = option_setup_urb (serial,
+                        port->bulk_out_endpointAddress, USB_DIR_OUT, port,
+                        portdata->out_buffer[j], OUT_BUFLEN, option_outdat_callback);
+                }
         }
 }
 
diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c
index c96714bb1cb8..d88704387202 100644
--- a/drivers/usb/serial/pl2303.c
+++ b/drivers/usb/serial/pl2303.c
@@ -314,7 +314,7 @@ static void pl2303_send(struct usb_serial_port *port)
                 // TODO: reschedule pl2303_send
         }
 
-        schedule_work(&port->work);
+        usb_serial_port_softint(port);
 }
 
 static int pl2303_write_room(struct usb_serial_port *port)
@@ -600,7 +600,7 @@ static void pl2303_close (struct usb_serial_port *port, struct file *filp)
         unsigned int c_cflag;
         int bps;
         long timeout;
-        wait_queue_t wait;                                              \
+        wait_queue_t wait;
 
         dbg("%s - port %d", __FUNCTION__, port->number);
 
diff --git a/drivers/usb/serial/usb-serial.c b/drivers/usb/serial/usb-serial.c
index 9c36f0ece20f..a30135c7cfe6 100644
--- a/drivers/usb/serial/usb-serial.c
+++ b/drivers/usb/serial/usb-serial.c
@@ -162,12 +162,19 @@ static void destroy_serial(struct kref *kref)
                 }
         }
 
+        flush_scheduled_work();         /* port->work */
+
         usb_put_dev(serial->dev);
 
         /* free up any memory that we allocated */
         kfree (serial);
 }
 
+void usb_serial_put(struct usb_serial *serial)
+{
+        kref_put(&serial->kref, destroy_serial);
+}
+
 /*****************************************************************************
  * Driver tty interface functions
  *****************************************************************************/
@@ -201,12 +208,12 @@ static int serial_open (struct tty_struct *tty, struct file * filp)
          
         ++port->open_count;
 
-        if (port->open_count == 1) {
+        /* set up our port structure making the tty driver
+         * remember our port object, and us it */
+        tty->driver_data = port;
+        port->tty = tty;
 
-                /* set up our port structure making the tty driver
-                 * remember our port object, and us it */
-                tty->driver_data = port;
-                port->tty = tty;
+        if (port->open_count == 1) {
 
                 /* lock this module before we call it
                  * this may fail, which means we must bail out,
@@ -230,9 +237,11 @@ bailout_module_put:
         module_put(serial->type->driver.owner);
 bailout_mutex_unlock:
         port->open_count = 0;
+        tty->driver_data = NULL;
+        port->tty = NULL;
         mutex_unlock(&port->mutex);
 bailout_kref_put:
-        kref_put(&serial->kref, destroy_serial);
+        usb_serial_put(serial);
         return retval;
 }
 
@@ -268,7 +277,7 @@ static void serial_close(struct tty_struct *tty, struct file * filp)
         }
 
         mutex_unlock(&port->mutex);
-        kref_put(&port->serial->kref, destroy_serial);
+        usb_serial_put(port->serial);
 }
 
 static int serial_write (struct tty_struct * tty, const unsigned char *buf, int count)
@@ -276,7 +285,7 @@ static int serial_write (struct tty_struct * tty, const unsigned char *buf, int
         struct usb_serial_port *port = tty->driver_data;
         int retval = -EINVAL;
 
-        if (!port)
+        if (!port || port->serial->dev->state == USB_STATE_NOTATTACHED)
                 goto exit;
 
         dbg("%s - port %d, %d byte(s)", __FUNCTION__, port->number, count);
@@ -296,7 +305,7 @@ exit:
 static int serial_write_room (struct tty_struct *tty) 
 {
         struct usb_serial_port *port = tty->driver_data;
-        int retval = -EINVAL;
+        int retval = -ENODEV;
 
         if (!port)
                 goto exit;
@@ -318,7 +327,7 @@ exit:
 static int serial_chars_in_buffer (struct tty_struct *tty) 
 {
         struct usb_serial_port *port = tty->driver_data;
-        int retval = -EINVAL;
+        int retval = -ENODEV;
 
         if (!port)
                 goto exit;
@@ -473,7 +482,7 @@ static int serial_read_proc (char *page, char **start, off_t off, int count, int
                         begin += length;
                         length = 0;
                 }
-                kref_put(&serial->kref, destroy_serial);
+                usb_serial_put(serial);
         }
         *eof = 1;
 done:
@@ -488,19 +497,18 @@ static int serial_tiocmget (struct tty_struct *tty, struct file *file)
         struct usb_serial_port *port = tty->driver_data;
 
         if (!port)
-                goto exit;
+                return -ENODEV;
 
         dbg("%s - port %d", __FUNCTION__, port->number);
 
         if (!port->open_count) {
                 dbg("%s - port not open", __FUNCTION__);
-                goto exit;
+                return -ENODEV;
         }
 
         if (port->serial->type->tiocmget)
                 return port->serial->type->tiocmget(port, file);
 
-exit:
         return -EINVAL;
 }
 
@@ -510,23 +518,32 @@ static int serial_tiocmset (struct tty_struct *tty, struct file *file,
         struct usb_serial_port *port = tty->driver_data;
 
         if (!port)
-                goto exit;
+                return -ENODEV;
 
         dbg("%s - port %d", __FUNCTION__, port->number);
 
         if (!port->open_count) {
                 dbg("%s - port not open", __FUNCTION__);
-                goto exit;
+                return -ENODEV;
         }
 
         if (port->serial->type->tiocmset)
                 return port->serial->type->tiocmset(port, file, set, clear);
 
-exit:
         return -EINVAL;
 }
 
-void usb_serial_port_softint(void *private)
+/*
+ * We would be calling tty_wakeup here, but unfortunately some line
+ * disciplines have an annoying habit of calling tty->write from
+ * the write wakeup callback (e.g. n_hdlc.c).
+ */
+void usb_serial_port_softint(struct usb_serial_port *port)
+{
+        schedule_work(&port->work);
+}
+
+static void usb_serial_port_work(void *private)
 {
         struct usb_serial_port *port = private;
         struct tty_struct *tty;
@@ -789,7 +806,7 @@ int usb_serial_probe(struct usb_interface *interface,
                 port->serial = serial;
                 spin_lock_init(&port->lock);
                 mutex_init(&port->mutex);
-                INIT_WORK(&port->work, usb_serial_port_softint, port);
+                INIT_WORK(&port->work, usb_serial_port_work, port);
                 serial->port[i] = port;
         }
 
@@ -985,6 +1002,7 @@ void usb_serial_disconnect(struct usb_interface *interface)
         struct device *dev = &interface->dev;
         struct usb_serial_port *port;
 
+        usb_serial_console_disconnect(serial);
         dbg ("%s", __FUNCTION__);
 
         usb_set_intfdata (interface, NULL);
@@ -996,7 +1014,7 @@ void usb_serial_disconnect(struct usb_interface *interface)
                 }
                 /* let the last holder of this object 
                  * cause it to be cleaned up */
-                kref_put(&serial->kref, destroy_serial);
+                usb_serial_put(serial);
         }
         dev_info(dev, "device disconnected\n");
 }
diff --git a/drivers/usb/serial/usb-serial.h b/drivers/usb/serial/usb-serial.h
index dc89d8710460..d53ea9b11e81 100644
--- a/drivers/usb/serial/usb-serial.h
+++ b/drivers/usb/serial/usb-serial.h
@@ -236,7 +236,7 @@ struct usb_serial_driver {
 
 extern int  usb_serial_register(struct usb_serial_driver *driver);
 extern void usb_serial_deregister(struct usb_serial_driver *driver);
-extern void usb_serial_port_softint(void *private);
+extern void usb_serial_port_softint(struct usb_serial_port *port);
 
 extern int usb_serial_probe(struct usb_interface *iface, const struct usb_device_id *id);
 extern void usb_serial_disconnect(struct usb_interface *iface);
@@ -248,13 +248,16 @@ extern int ezusb_set_reset (struct usb_serial *serial, unsigned char reset_bit);
 #ifdef CONFIG_USB_SERIAL_CONSOLE
 extern void usb_serial_console_init (int debug, int minor);
 extern void usb_serial_console_exit (void);
+extern void usb_serial_console_disconnect(struct usb_serial *serial);
 #else
 static inline void usb_serial_console_init (int debug, int minor) { }
 static inline void usb_serial_console_exit (void) { }
+static inline void usb_serial_console_disconnect(struct usb_serial *serial) {}
 #endif
 
 /* Functions needed by other parts of the usbserial core */
 extern struct usb_serial *usb_serial_get_by_index (unsigned int minor);
+extern void usb_serial_put(struct usb_serial *serial);
 extern int usb_serial_generic_open (struct usb_serial_port *port, struct file *filp);
 extern int usb_serial_generic_write (struct usb_serial_port *port, const unsigned char *buf, int count);
 extern void usb_serial_generic_close (struct usb_serial_port *port, struct file *filp);
diff --git a/drivers/usb/serial/visor.c b/drivers/usb/serial/visor.c
index f5c3841d4843..9e89b8d54f72 100644
--- a/drivers/usb/serial/visor.c
+++ b/drivers/usb/serial/visor.c
@@ -480,7 +480,7 @@ static void visor_write_bulk_callback (struct urb *urb, struct pt_regs *regs)
         --priv->outstanding_urbs;
         spin_unlock_irqrestore(&priv->lock, flags);
 
-        schedule_work(&port->work);
+        usb_serial_port_softint(port);
 }
 
 
diff --git a/drivers/usb/serial/whiteheat.c b/drivers/usb/serial/whiteheat.c
index f806553cd9a4..5b06fa366098 100644
--- a/drivers/usb/serial/whiteheat.c
+++ b/drivers/usb/serial/whiteheat.c
@@ -388,7 +388,7 @@ static int whiteheat_attach (struct usb_serial *serial)
         if (ret) {
                 err("%s: Couldn't send command [%d]", serial->type->description, ret);
                 goto no_firmware;
-        } else if (alen != sizeof(command)) {
+        } else if (alen != 2) {
                 err("%s: Send command incomplete [%d]", serial->type->description, alen);
                 goto no_firmware;
         }
@@ -400,7 +400,7 @@ static int whiteheat_attach (struct usb_serial *serial)
         if (ret) {
                 err("%s: Couldn't get results [%d]", serial->type->description, ret);
                 goto no_firmware;
-        } else if (alen != sizeof(result)) {
+        } else if (alen != sizeof(*hw_info) + 1) {
                 err("%s: Get results incomplete [%d]", serial->type->description, alen);
                 goto no_firmware;
         } else if (result[0] != command[0]) {
@@ -1089,9 +1089,7 @@ static void whiteheat_write_callback(struct urb *urb, struct pt_regs *regs)
                 return;
         }
 
-        usb_serial_port_softint((void *)port);
-
-        schedule_work(&port->work);
+        usb_serial_port_softint(port);
 }
 
 
diff --git a/drivers/usb/storage/onetouch.c b/drivers/usb/storage/onetouch.c
index 55ee2d36d585..026a587eb8dd 100644
--- a/drivers/usb/storage/onetouch.c
+++ b/drivers/usb/storage/onetouch.c
@@ -34,9 +34,8 @@
 #include <linux/init.h>
 #include <linux/slab.h>
 #include <linux/module.h>
-#include <linux/usb.h>
 #include <linux/usb_ch9.h>
-#include <linux/usb_input.h>
+#include <linux/usb/input.h>
 #include "usb.h"
 #include "onetouch.h"
 #include "debug.h"
diff --git a/drivers/usb/storage/scsiglue.c b/drivers/usb/storage/scsiglue.c
index 5f11e19eaae3..5715291ba540 100644
--- a/drivers/usb/storage/scsiglue.c
+++ b/drivers/usb/storage/scsiglue.c
@@ -286,11 +286,7 @@ static int bus_reset(struct scsi_cmnd *srb)
         int result;
 
         US_DEBUGP("%s called\n", __FUNCTION__);
-
-        mutex_lock(&(us->dev_mutex));
         result = usb_stor_port_reset(us);
-        mutex_unlock(&us->dev_mutex);
-
         return result < 0 ? FAILED : SUCCESS;
 }
 
diff --git a/drivers/usb/storage/shuttle_usbat.c b/drivers/usb/storage/shuttle_usbat.c
index f2bc5c9e23d5..8fcec01dc622 100644
--- a/drivers/usb/storage/shuttle_usbat.c
+++ b/drivers/usb/storage/shuttle_usbat.c
@@ -131,28 +131,30 @@ static int usbat_write(struct us_data *us,
  * Convenience function to perform a bulk read
  */
 static int usbat_bulk_read(struct us_data *us,
-                                                         unsigned char *data,
-                                                         unsigned int len)
+                           unsigned char *data,
+                           unsigned int len,
+                           int use_sg)
 {
         if (len == 0)
                 return USB_STOR_XFER_GOOD;
 
         US_DEBUGP("usbat_bulk_read: len = %d\n", len);
-        return usb_stor_bulk_transfer_buf(us, us->recv_bulk_pipe, data, len, NULL);
+        return usb_stor_bulk_transfer_sg(us, us->recv_bulk_pipe, data, len, use_sg, NULL);
 }
 
 /*
  * Convenience function to perform a bulk write
  */
 static int usbat_bulk_write(struct us_data *us,
-                                                        unsigned char *data,
-                                                        unsigned int len)
+                            unsigned char *data,
+                            unsigned int len,
+                            int use_sg)
 {
         if (len == 0)
                 return USB_STOR_XFER_GOOD;
 
         US_DEBUGP("usbat_bulk_write:  len = %d\n", len);
-        return usb_stor_bulk_transfer_buf(us, us->send_bulk_pipe, data, len, NULL);
+        return usb_stor_bulk_transfer_sg(us, us->send_bulk_pipe, data, len, use_sg, NULL);
 }
 
 /*
@@ -317,7 +319,8 @@ static int usbat_wait_not_busy(struct us_data *us, int minutes)
  */
 static int usbat_read_block(struct us_data *us,
                             unsigned char *content,
-                            unsigned short len)
+                            unsigned short len,
+                            int use_sg)
 {
         int result;
         unsigned char *command = us->iobuf;
@@ -338,7 +341,7 @@ static int usbat_read_block(struct us_data *us,
         if (result != USB_STOR_XFER_GOOD)
                 return USB_STOR_TRANSPORT_ERROR;
 
-        result = usbat_bulk_read(us, content, len);
+        result = usbat_bulk_read(us, content, len, use_sg);
         return (result == USB_STOR_XFER_GOOD ?
                         USB_STOR_TRANSPORT_GOOD : USB_STOR_TRANSPORT_ERROR);
 }
@@ -350,7 +353,8 @@ static int usbat_write_block(struct us_data *us,
                              unsigned char access,
                              unsigned char *content,
                              unsigned short len,
-                             int minutes)
+                             int minutes,
+                             int use_sg)
 {
         int result;
         unsigned char *command = us->iobuf;
@@ -372,7 +376,7 @@ static int usbat_write_block(struct us_data *us,
         if (result != USB_STOR_XFER_GOOD)
                 return USB_STOR_TRANSPORT_ERROR;
 
-        result = usbat_bulk_write(us, content, len);
+        result = usbat_bulk_write(us, content, len, use_sg);
         if (result != USB_STOR_XFER_GOOD)
                 return USB_STOR_TRANSPORT_ERROR;
 
@@ -465,7 +469,7 @@ static int usbat_hp8200e_rw_block_test(struct us_data *us,
                                 data[1+(j<<1)] = data_out[j];
                         }
 
-                        result = usbat_bulk_write(us, data, num_registers*2);
+                        result = usbat_bulk_write(us, data, num_registers*2, 0);
                         if (result != USB_STOR_XFER_GOOD)
                                 return USB_STOR_TRANSPORT_ERROR;
 
@@ -583,7 +587,7 @@ static int usbat_multiple_write(struct us_data *us,
         }
 
         /* Send the data */
-        result = usbat_bulk_write(us, data, num_registers*2);
+        result = usbat_bulk_write(us, data, num_registers*2, 0);
         if (result != USB_STOR_XFER_GOOD)
                 return USB_STOR_TRANSPORT_ERROR;
 
@@ -606,8 +610,9 @@ static int usbat_multiple_write(struct us_data *us,
  * other related details) are defined beforehand with _set_shuttle_features().
  */
 static int usbat_read_blocks(struct us_data *us,
-                                                         unsigned char *buffer,
-                                                         int len)
+                             unsigned char *buffer,
+                             int len,
+                             int use_sg)
 {
         int result;
         unsigned char *command = us->iobuf;
@@ -627,7 +632,7 @@ static int usbat_read_blocks(struct us_data *us,
                 return USB_STOR_TRANSPORT_FAILED;
         
         /* Read the blocks we just asked for */
-        result = usbat_bulk_read(us, buffer, len);
+        result = usbat_bulk_read(us, buffer, len, use_sg);
         if (result != USB_STOR_XFER_GOOD)
                 return USB_STOR_TRANSPORT_FAILED;
 
@@ -648,7 +653,8 @@ static int usbat_read_blocks(struct us_data *us,
  */
 static int usbat_write_blocks(struct us_data *us,
                                                           unsigned char *buffer,
-                                                          int len)
+                              int len,
+                              int use_sg)
 {
         int result;
         unsigned char *command = us->iobuf;
@@ -668,7 +674,7 @@ static int usbat_write_blocks(struct us_data *us,
                 return USB_STOR_TRANSPORT_FAILED;
         
         /* Write the data */
-        result = usbat_bulk_write(us, buffer, len);
+        result = usbat_bulk_write(us, buffer, len, use_sg);
         if (result != USB_STOR_XFER_GOOD)
                 return USB_STOR_TRANSPORT_FAILED;
 
@@ -887,22 +893,28 @@ static int usbat_identify_device(struct us_data *us,
  * Set the transport function based on the device type
  */
 static int usbat_set_transport(struct us_data *us,
-                               struct usbat_info *info)
+                               struct usbat_info *info,
+                               int devicetype)
 {
-        int rc;
 
-        if (!info->devicetype) {
-                rc = usbat_identify_device(us, info);
-                if (rc != USB_STOR_TRANSPORT_GOOD) {
-                        US_DEBUGP("usbat_set_transport: Could not identify device\n");
-                        return 1;
-                }
-        }
+        if (!info->devicetype)
+                info->devicetype = devicetype;
 
-        if (usbat_get_device_type(us) == USBAT_DEV_HP8200)
+        if (!info->devicetype)
+                usbat_identify_device(us, info);
+
+        switch (info->devicetype) {
+        default:
+                return USB_STOR_TRANSPORT_ERROR;
+
+        case  USBAT_DEV_HP8200:
                 us->transport = usbat_hp8200e_transport;
-        else if (usbat_get_device_type(us) == USBAT_DEV_FLASH)
+                break;
+
+        case USBAT_DEV_FLASH:
                 us->transport = usbat_flash_transport;
+                break;
+        }
 
         return 0;
 }
@@ -947,7 +959,7 @@ static int usbat_flash_get_sector_count(struct us_data *us,
         msleep(100);
 
         /* Read the device identification data */
-        rc = usbat_read_block(us, reply, 512);
+        rc = usbat_read_block(us, reply, 512, 0);
         if (rc != USB_STOR_TRANSPORT_GOOD)
                 goto leave;
 
@@ -1031,7 +1043,7 @@ static int usbat_flash_read_data(struct us_data *us,
                         goto leave;
 
                 /* Read the data we just requested */
-                result = usbat_read_blocks(us, buffer, len);
+                result = usbat_read_blocks(us, buffer, len, 0);
                 if (result != USB_STOR_TRANSPORT_GOOD)
                         goto leave;
          
@@ -1125,7 +1137,7 @@ static int usbat_flash_write_data(struct us_data *us,
                         goto leave;
 
                 /* Write the data */
-                result = usbat_write_blocks(us, buffer, len);
+                result = usbat_write_blocks(us, buffer, len, 0);
                 if (result != USB_STOR_TRANSPORT_GOOD)
                         goto leave;
 
@@ -1310,7 +1322,7 @@ static int usbat_select_and_test_registers(struct us_data *us)
 /*
  * Initialize the USBAT processor and the storage device
  */
-int init_usbat(struct us_data *us)
+static int init_usbat(struct us_data *us, int devicetype)
 {
         int rc;
         struct usbat_info *info;
@@ -1392,7 +1404,7 @@ int init_usbat(struct us_data *us)
         US_DEBUGP("INIT 9\n");
 
         /* At this point, we need to detect which device we are using */
-        if (usbat_set_transport(us, info))
+        if (usbat_set_transport(us, info, devicetype))
                 return USB_STOR_TRANSPORT_ERROR;
 
         US_DEBUGP("INIT 10\n");
@@ -1503,10 +1515,10 @@ static int usbat_hp8200e_transport(struct scsi_cmnd *srb, struct us_data *us)
          * AT SPEED 4 IS UNRELIABLE!!!
          */
 
-        if ( (result = usbat_write_block(us, 
+        if ((result = usbat_write_block(us,
                         USBAT_ATA, srb->cmnd, 12,
-                        srb->cmnd[0]==GPCMD_BLANK ? 75 : 10)) !=
-                                USB_STOR_TRANSPORT_GOOD) {
+                                (srb->cmnd[0]==GPCMD_BLANK ? 75 : 10), 0) !=
+                             USB_STOR_TRANSPORT_GOOD)) {
                 return result;
         }
 
@@ -1533,7 +1545,7 @@ static int usbat_hp8200e_transport(struct scsi_cmnd *srb, struct us_data *us)
                         len = *status;
 
 
-                result = usbat_read_block(us, srb->request_buffer, len);
+                result = usbat_read_block(us, srb->request_buffer, len, srb->use_sg);
 
                 /* Debug-print the first 32 bytes of the transfer */
 
@@ -1695,6 +1707,22 @@ static int usbat_flash_transport(struct scsi_cmnd * srb, struct us_data *us)
         return USB_STOR_TRANSPORT_FAILED;
 }
 
+int init_usbat_cd(struct us_data *us)
+{
+        return init_usbat(us, USBAT_DEV_HP8200);
+}
+
+
+int init_usbat_flash(struct us_data *us)
+{
+        return init_usbat(us, USBAT_DEV_FLASH);
+}
+
+int init_usbat_probe(struct us_data *us)
+{
+        return init_usbat(us, 0);
+}
+
 /*
  * Default transport function. Attempts to detect which transport function
  * should be called, makes it the new default, and calls it.
@@ -1708,9 +1736,8 @@ int usbat_transport(struct scsi_cmnd *srb, struct us_data *us)
 {
         struct usbat_info *info = (struct usbat_info*) (us->extra);
 
-        if (usbat_set_transport(us, info))
+        if (usbat_set_transport(us, info, 0))
                 return USB_STOR_TRANSPORT_ERROR;
 
         return us->transport(srb, us);  
 }
-
diff --git a/drivers/usb/storage/shuttle_usbat.h b/drivers/usb/storage/shuttle_usbat.h
index 25e7d8b340b8..3ddf143a1dec 100644
--- a/drivers/usb/storage/shuttle_usbat.h
+++ b/drivers/usb/storage/shuttle_usbat.h
@@ -106,7 +106,9 @@
 #define USBAT_FEAT_ET2  0x01
 
 extern int usbat_transport(struct scsi_cmnd *srb, struct us_data *us);
-extern int init_usbat(struct us_data *us);
+extern int init_usbat_cd(struct us_data *us);
+extern int init_usbat_flash(struct us_data *us);
+extern int init_usbat_probe(struct us_data *us);
 
 struct usbat_info {
         int devicetype;
diff --git a/drivers/usb/storage/transport.c b/drivers/usb/storage/transport.c
index 7ca896a342e3..19b25c5cafd4 100644
--- a/drivers/usb/storage/transport.c
+++ b/drivers/usb/storage/transport.c
@@ -115,19 +115,6 @@ static void usb_stor_blocking_completion(struct urb *urb, struct pt_regs *regs)
 
         complete(urb_done_ptr);
 }
- 
-/* This is the timeout handler which will cancel an URB when its timeout
- * expires.
- */
-static void timeout_handler(unsigned long us_)
-{
-        struct us_data *us = (struct us_data *) us_;
-
-        if (test_and_clear_bit(US_FLIDX_URB_ACTIVE, &us->flags)) {
-                US_DEBUGP("Timeout -- cancelling URB\n");
-                usb_unlink_urb(us->current_urb);
-        }
-}
 
 /* This is the common part of the URB message submission code
  *
@@ -138,7 +125,7 @@ static void timeout_handler(unsigned long us_)
 static int usb_stor_msg_common(struct us_data *us, int timeout)
 {
         struct completion urb_done;
-        struct timer_list to_timer;
+        long timeleft;
         int status;
 
         /* don't submit URBs during abort/disconnect processing */
@@ -185,22 +172,17 @@ static int usb_stor_msg_common(struct us_data *us, int timeout)
                 }
         }
  
-        /* submit the timeout timer, if a timeout was requested */
-        if (timeout > 0) {
-                init_timer(&to_timer);
-                to_timer.expires = jiffies + timeout;
-                to_timer.function = timeout_handler;
-                to_timer.data = (unsigned long) us;
-                add_timer(&to_timer);
-        }
-
         /* wait for the completion of the URB */
-        wait_for_completion(&urb_done);
-        clear_bit(US_FLIDX_URB_ACTIVE, &us->flags);
+        timeleft = wait_for_completion_interruptible_timeout(
+                        &urb_done, timeout ? : MAX_SCHEDULE_TIMEOUT);
  
-        /* clean up the timeout timer */
-        if (timeout > 0)
-                del_timer_sync(&to_timer);
+        clear_bit(US_FLIDX_URB_ACTIVE, &us->flags);
+
+        if (timeleft <= 0) {
+                US_DEBUGP("%s -- cancelling URB\n",
+                          timeleft == 0 ? "Timeout" : "Signal");
+                usb_unlink_urb(us->current_urb);
+        }
 
         /* return the URB status */
         return us->current_urb->status;
@@ -721,16 +703,19 @@ void usb_stor_invoke_transport(struct scsi_cmnd *srb, struct us_data *us)
          * device reset. */
   Handle_Errors:
 
-        /* Let the SCSI layer know we are doing a reset, set the
-         * RESETTING bit, and clear the ABORTING bit so that the reset
-         * may proceed. */
+        /* Set the RESETTING bit, and clear the ABORTING bit so that
+         * the reset may proceed. */
         scsi_lock(us_to_host(us));
-        usb_stor_report_bus_reset(us);
         set_bit(US_FLIDX_RESETTING, &us->flags);
         clear_bit(US_FLIDX_ABORTING, &us->flags);
         scsi_unlock(us_to_host(us));
 
+        /* We must release the device lock because the pre_reset routine
+         * will want to acquire it. */
+        mutex_unlock(&us->dev_mutex);
         result = usb_stor_port_reset(us);
+        mutex_lock(&us->dev_mutex);
+
         if (result < 0) {
                 scsi_lock(us_to_host(us));
                 usb_stor_report_device_reset(us);
@@ -1214,31 +1199,30 @@ int usb_stor_Bulk_reset(struct us_data *us)
                                  0, us->ifnum, NULL, 0);
 }
 
-/* Issue a USB port reset to the device.  But don't do anything if
- * there's more than one interface in the device, so that other users
- * are not affected. */
+/* Issue a USB port reset to the device.  The caller must not hold
+ * us->dev_mutex.
+ */
 int usb_stor_port_reset(struct us_data *us)
 {
-        int result, rc;
+        int result, rc_lock;
 
-        if (test_bit(US_FLIDX_DISCONNECTING, &us->flags)) {
-                result = -EIO;
-                US_DEBUGP("No reset during disconnect\n");
-        } else if (us->pusb_dev->actconfig->desc.bNumInterfaces != 1) {
-                result = -EBUSY;
-                US_DEBUGP("Refusing to reset a multi-interface device\n");
-        } else {
-                result = rc =
-                        usb_lock_device_for_reset(us->pusb_dev, us->pusb_intf);
-                if (result < 0) {
-                        US_DEBUGP("unable to lock device for reset: %d\n",
-                                        result);
+        result = rc_lock =
+                usb_lock_device_for_reset(us->pusb_dev, us->pusb_intf);
+        if (result < 0)
+                US_DEBUGP("unable to lock device for reset: %d\n", result);
+        else {
+                /* Were we disconnected while waiting for the lock? */
+                if (test_bit(US_FLIDX_DISCONNECTING, &us->flags)) {
+                        result = -EIO;
+                        US_DEBUGP("No reset during disconnect\n");
                 } else {
-                        result = usb_reset_device(us->pusb_dev);
-                        if (rc)
-                                usb_unlock_device(us->pusb_dev);
-                        US_DEBUGP("usb_reset_device returns %d\n", result);
+                        result = usb_reset_composite_device(
+                                        us->pusb_dev, us->pusb_intf);
+                        US_DEBUGP("usb_reset_composite_device returns %d\n",
+                                        result);
                 }
+                if (rc_lock)
+                        usb_unlock_device(us->pusb_dev);
         }
         return result;
 }
diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
index aec5ea8682d5..543244d421c1 100644
--- a/drivers/usb/storage/unusual_devs.h
+++ b/drivers/usb/storage/unusual_devs.h
@@ -78,12 +78,12 @@ UNUSUAL_DEV(  0x03f0, 0x0107, 0x0200, 0x0200,
 UNUSUAL_DEV(  0x03f0, 0x0207, 0x0001, 0x0001, 
                 "HP",
                 "CD-Writer+ 8200e",
-                US_SC_8070, US_PR_USBAT, init_usbat, 0),
+                US_SC_8070, US_PR_USBAT, init_usbat_cd, 0),
 
 UNUSUAL_DEV(  0x03f0, 0x0307, 0x0001, 0x0001, 
                 "HP",
                 "CD-Writer+ CD-4e",
-                US_SC_8070, US_PR_USBAT, init_usbat, 0),
+                US_SC_8070, US_PR_USBAT, init_usbat_cd, 0),
 #endif
 
 /* Reported by Sebastian Kapfer <sebastian_kapfer@gmx.net>
@@ -133,6 +133,14 @@ UNUSUAL_DEV(  0x0420, 0x0001, 0x0100, 0x0100,
                 US_SC_DEVICE, US_PR_DEVICE, NULL,
                 US_FL_IGNORE_RESIDUE ),
 
+/* Reported by Jiri Slaby <jirislaby@gmail.com> and
+ * Rene C. Castberg <Rene@Castberg.org> */
+UNUSUAL_DEV(  0x0421, 0x0446, 0x0100, 0x0100,
+                "Nokia",
+                "N80",
+                US_SC_DEVICE, US_PR_DEVICE, NULL,
+                US_FL_IGNORE_RESIDUE | US_FL_FIX_CAPACITY ),
+
 /* Reported by Olaf Hering <olh@suse.de> from novell bug #105878 */
 UNUSUAL_DEV(  0x0424, 0x0fdc, 0x0210, 0x0210,
                 "SMSC",
@@ -216,6 +224,14 @@ UNUSUAL_DEV(  0x04a4, 0x0004, 0x0001, 0x0001,
                 "DVD-CAM DZ-MV100A Camcorder",
                 US_SC_SCSI, US_PR_CB, NULL, US_FL_SINGLE_LUN),
 
+/* Patch for Nikon coolpix 2000
+ * Submitted by Fabien Cosse <fabien.cosse@wanadoo.fr>*/
+UNUSUAL_DEV(  0x04b0, 0x0301, 0x0010, 0x0010,
+                "NIKON",
+                "NIKON DSC E2000",
+                US_SC_DEVICE, US_PR_DEVICE,NULL,
+                US_FL_NOT_LOCKABLE ),
+
 /* Reported by Andreas Bockhold <andreas@bockionline.de> */
 UNUSUAL_DEV(  0x04b0, 0x0405, 0x0100, 0x0100,
                 "NIKON",
@@ -223,13 +239,12 @@ UNUSUAL_DEV(  0x04b0, 0x0405, 0x0100, 0x0100,
                 US_SC_DEVICE, US_PR_DEVICE, NULL,
                 US_FL_FIX_CAPACITY),
 
-/* Patch for Nikon coolpix 2000
- * Submitted by Fabien Cosse <fabien.cosse@wanadoo.fr>*/
-UNUSUAL_DEV(  0x04b0, 0x0301, 0x0010, 0x0010,
+/* Reported by Jamie Kitson <jamie@staberinde.fsnet.co.uk> */
+UNUSUAL_DEV(  0x04b0, 0x040d, 0x0100, 0x0100,
                 "NIKON",
-                "NIKON DSC E2000",
-                US_SC_DEVICE, US_PR_DEVICE,NULL,
-                US_FL_NOT_LOCKABLE ),
+                "NIKON DSC D70s",
+                US_SC_DEVICE, US_PR_DEVICE, NULL,
+                US_FL_FIX_CAPACITY),
 
 /* BENQ DC5330
  * Reported by Manuel Fombuena <mfombuena@ya.com> and
@@ -393,7 +408,7 @@ UNUSUAL_DEV(  0x04fc, 0x80c2, 0x0100, 0x0100,
 UNUSUAL_DEV(  0x04e6, 0x1010, 0x0000, 0x9999,
                 "Shuttle/SCM",
                 "USBAT-02",
-                US_SC_SCSI, US_PR_USBAT, init_usbat,
+                US_SC_SCSI, US_PR_USBAT, init_usbat_flash,
                 US_FL_SINGLE_LUN),
 #endif
 
@@ -797,7 +812,7 @@ UNUSUAL_DEV(  0x0781, 0x0002, 0x0009, 0x0009,
 UNUSUAL_DEV(  0x0781, 0x0005, 0x0005, 0x0005,
                 "Sandisk",
                 "ImageMate SDDR-05b",
-                US_SC_SCSI, US_PR_USBAT, init_usbat,
+                US_SC_SCSI, US_PR_USBAT, init_usbat_flash,
                 US_FL_SINGLE_LUN ),
 #endif
 
diff --git a/drivers/usb/storage/usb.c b/drivers/usb/storage/usb.c
index dd108634348e..e232c7c89909 100644
--- a/drivers/usb/storage/usb.c
+++ b/drivers/usb/storage/usb.c
@@ -221,6 +221,37 @@ static int storage_resume(struct usb_interface *iface)
 #endif /* CONFIG_PM */
 
 /*
+ * The next two routines get called just before and just after
+ * a USB port reset, whether from this driver or a different one.
+ */
+
+static void storage_pre_reset(struct usb_interface *iface)
+{
+        struct us_data *us = usb_get_intfdata(iface);
+
+        US_DEBUGP("%s\n", __FUNCTION__);
+
+        /* Make sure no command runs during the reset */
+        mutex_lock(&us->dev_mutex);
+}
+
+static void storage_post_reset(struct usb_interface *iface)
+{
+        struct us_data *us = usb_get_intfdata(iface);
+
+        US_DEBUGP("%s\n", __FUNCTION__);
+
+        /* Report the reset to the SCSI core */
+        scsi_lock(us_to_host(us));
+        usb_stor_report_bus_reset(us);
+        scsi_unlock(us_to_host(us));
+
+        /* FIXME: Notify the subdrivers that they need to reinitialize
+         * the device */
+        mutex_unlock(&us->dev_mutex);
+}
+
+/*
  * fill_inquiry_response takes an unsigned char array (which must
  * be at least 36 characters) and populates the vendor name,
  * product name, and revision fields. Then the array is copied
@@ -593,6 +624,15 @@ static int get_transport(struct us_data *us)
                 break;
 #endif
 
+#ifdef CONFIG_USB_STORAGE_ALAUDA
+        case US_PR_ALAUDA:
+                us->transport_name  = "Alauda Control/Bulk";
+                us->transport = alauda_transport;
+                us->transport_reset = usb_stor_Bulk_reset;
+                us->max_lun = 1;
+                break;
+#endif
+
         default:
                 return -EIO;
         }
@@ -648,15 +688,6 @@ static int get_protocol(struct us_data *us)
                 break;
 #endif
 
-#ifdef CONFIG_USB_STORAGE_ALAUDA
-        case US_PR_ALAUDA:
-                us->transport_name  = "Alauda Control/Bulk";
-                us->transport = alauda_transport;
-                us->transport_reset = usb_stor_Bulk_reset;
-                us->max_lun = 1;
-                break;
-#endif
-
         default:
                 return -EIO;
         }
@@ -1002,6 +1033,8 @@ static struct usb_driver usb_storage_driver = {
         .suspend =      storage_suspend,
         .resume =       storage_resume,
 #endif
+        .pre_reset =    storage_pre_reset,
+        .post_reset =   storage_post_reset,
         .id_table =     storage_usb_ids,
 };