36 files changed, 434 insertions, 288 deletions

diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index 0c2f14ff9696..61d75507d5d0 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -1201,7 +1201,7 @@ made_compressed_probe:
                 if (rcv->urb == NULL) {
                         dev_dbg(&intf->dev,
                                 "out of memory (read urbs usb_alloc_urb)\n");
-                        goto alloc_fail7;
+                        goto alloc_fail6;
                 }
 
                 rcv->urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
@@ -1225,7 +1225,7 @@ made_compressed_probe:
                 if (snd->urb == NULL) {
                         dev_dbg(&intf->dev,
                                 "out of memory (write urbs usb_alloc_urb)");
-                        goto alloc_fail7;
+                        goto alloc_fail8;
                 }
 
                 if (usb_endpoint_xfer_int(epwrite))
@@ -1264,6 +1264,7 @@ made_compressed_probe:
                 i = device_create_file(&intf->dev,
                                                 &dev_attr_iCountryCodeRelDate);
                 if (i < 0) {
+                        device_remove_file(&intf->dev, &dev_attr_wCountryCodes);
                         kfree(acm->country_codes);
                         goto skip_countries;
                 }
@@ -1300,6 +1301,7 @@ alloc_fail8:
                 usb_free_urb(acm->wb[i].urb);
 alloc_fail7:
         acm_read_buffers_free(acm);
+alloc_fail6:
         for (i = 0; i < num_rx_buf; i++)
                 usb_free_urb(acm->ru[i].urb);
         usb_free_urb(acm->ctrlurb);
diff --git a/drivers/usb/core/driver.c b/drivers/usb/core/driver.c
index ded550eda5d9..a6bd53ace035 100644
--- a/drivers/usb/core/driver.c
+++ b/drivers/usb/core/driver.c
@@ -1272,8 +1272,7 @@ static int usb_resume_both(struct usb_device *udev, pm_message_t msg)
 
 static void choose_wakeup(struct usb_device *udev, pm_message_t msg)
 {
-        int                     w, i;
-        struct usb_interface    *intf;
+        int     w;
 
         /* Remote wakeup is needed only when we actually go to sleep.
          * For things like FREEZE and QUIESCE, if the device is already
@@ -1285,16 +1284,10 @@ static void choose_wakeup(struct usb_device *udev, pm_message_t msg)
                 return;
         }
 
-        /* If remote wakeup is permitted, see whether any interface drivers
+        /* Enable remote wakeup if it is allowed, even if no interface drivers
          * actually want it.
          */
-        w = 0;
-        if (device_may_wakeup(&udev->dev) && udev->actconfig) {
-                for (i = 0; i < udev->actconfig->desc.bNumInterfaces; i++) {
-                        intf = udev->actconfig->interface[i];
-                        w |= intf->needs_remote_wakeup;
-                }
-        }
+        w = device_may_wakeup(&udev->dev);
 
         /* If the device is autosuspended with the wrong wakeup setting,
          * autoresume now so the setting can be changed.
@@ -1328,6 +1321,7 @@ int usb_resume(struct device *dev, pm_message_t msg)
 
         /* For all other calls, take the device back to full power and
          * tell the PM core in case it was autosuspended previously.
+         * Unbind the interfaces that will need rebinding later.
          */
         } else {
                 status = usb_resume_both(udev, msg);
@@ -1336,6 +1330,7 @@ int usb_resume(struct device *dev, pm_message_t msg)
                         pm_runtime_set_active(dev);
                         pm_runtime_enable(dev);
                         udev->last_busy = jiffies;
+                        do_unbind_rebind(udev, DO_REBIND);
                 }
         }
 
diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c
index a73e08fdab36..fd4c36ea5e46 100644
--- a/drivers/usb/core/message.c
+++ b/drivers/usb/core/message.c
@@ -416,8 +416,11 @@ int usb_sg_init(struct usb_sg_request *io, struct usb_device *dev,
                         /* A length of zero means transfer the whole sg list */
                         len = length;
                         if (len == 0) {
-                                for_each_sg(sg, sg, nents, i)
-                                        len += sg->length;
+                                struct scatterlist      *sg2;
+                                int                     j;
+
+                                for_each_sg(sg, sg2, nents, j)
+                                        len += sg2->length;
                         }
                 } else {
                         /*
diff --git a/drivers/usb/gadget/Kconfig b/drivers/usb/gadget/Kconfig
index 649c0c5f7158..591ae9fde199 100644
--- a/drivers/usb/gadget/Kconfig
+++ b/drivers/usb/gadget/Kconfig
@@ -295,6 +295,7 @@ config USB_GADGET_S3C_HSOTG
         boolean "S3C HS/OtG USB Device controller"
         depends on S3C_DEV_USB_HSOTG
         select USB_GADGET_S3C_HSOTG_PIO
+        select USB_GADGET_DUALSPEED
         help
           The Samsung S3C64XX USB2.0 high-speed gadget controller
           integrated into the S3C64XX series SoC.
diff --git a/drivers/usb/gadget/f_audio.c b/drivers/usb/gadget/f_audio.c
index 43bf44514c41..b91115f84b13 100644
--- a/drivers/usb/gadget/f_audio.c
+++ b/drivers/usb/gadget/f_audio.c
@@ -101,7 +101,7 @@ static struct uac_feature_unit_descriptor_0 feature_unit_desc = {
 static struct usb_audio_control mute_control = {
         .list = LIST_HEAD_INIT(mute_control.list),
         .name = "Mute Control",
-        .type = UAC_MUTE_CONTROL,
+        .type = UAC_FU_MUTE,
         /* Todo: add real Mute control code */
         .set = generic_set_cmd,
         .get = generic_get_cmd,
@@ -110,7 +110,7 @@ static struct usb_audio_control mute_control = {
 static struct usb_audio_control volume_control = {
         .list = LIST_HEAD_INIT(volume_control.list),
         .name = "Volume Control",
-        .type = UAC_VOLUME_CONTROL,
+        .type = UAC_FU_VOLUME,
         /* Todo: add real Volume control code */
         .set = generic_set_cmd,
         .get = generic_get_cmd,
diff --git a/drivers/usb/gadget/f_eem.c b/drivers/usb/gadget/f_eem.c
index 38226e9a371d..95dd4662d6a8 100644
--- a/drivers/usb/gadget/f_eem.c
+++ b/drivers/usb/gadget/f_eem.c
@@ -469,8 +469,7 @@ static int eem_unwrap(struct gether *port,
                                 crc = get_unaligned_le32(skb->data + len
                                                         - ETH_FCS_LEN);
                                 crc2 = ~crc32_le(~0,
-                                                skb->data,
-                                                skb->len - ETH_FCS_LEN);
+                                                skb->data, len - ETH_FCS_LEN);
                         } else {
                                 crc = get_unaligned_be32(skb->data + len
                                                         - ETH_FCS_LEN);
diff --git a/drivers/usb/gadget/f_mass_storage.c b/drivers/usb/gadget/f_mass_storage.c
index 7d05a0be5c60..4ce899c9b165 100644
--- a/drivers/usb/gadget/f_mass_storage.c
+++ b/drivers/usb/gadget/f_mass_storage.c
@@ -321,8 +321,8 @@ struct fsg_dev;
 /* Data shared by all the FSG instances. */
 struct fsg_common {
         struct usb_gadget       *gadget;
-        struct fsg_dev          *fsg;
-        struct fsg_dev          *prev_fsg;
+        struct fsg_dev          *fsg, *new_fsg;
+        wait_queue_head_t       fsg_wait;
 
         /* filesem protects: backing files in use */
         struct rw_semaphore     filesem;
@@ -351,7 +351,6 @@ struct fsg_common {
         enum fsg_state          state;          /* For exception handling */
         unsigned int            exception_req_tag;
 
-        u8                      config, new_config;
         enum data_direction     data_dir;
         u32                     data_size;
         u32                     data_size_from_cmnd;
@@ -595,7 +594,7 @@ static int fsg_setup(struct usb_function *f,
         u16                     w_value = le16_to_cpu(ctrl->wValue);
         u16                     w_length = le16_to_cpu(ctrl->wLength);
 
-        if (!fsg->common->config)
+        if (!fsg_is_set(fsg->common))
                 return -EOPNOTSUPP;
 
         switch (ctrl->bRequest) {
@@ -2303,24 +2302,20 @@ static int alloc_request(struct fsg_common *common, struct usb_ep *ep,
         return -ENOMEM;
 }
 
-/*
- * Reset interface setting and re-init endpoint state (toggle etc).
- * Call with altsetting < 0 to disable the interface.  The only other
- * available altsetting is 0, which enables the interface.
- */
-static int do_set_interface(struct fsg_common *common, int altsetting)
+/* Reset interface setting and re-init endpoint state (toggle etc). */
+static int do_set_interface(struct fsg_common *common, struct fsg_dev *new_fsg)
 {
-        int     rc = 0;
-        int     i;
-        const struct usb_endpoint_descriptor    *d;
+        const struct usb_endpoint_descriptor *d;
+        struct fsg_dev *fsg;
+        int i, rc = 0;
 
         if (common->running)
                 DBG(common, "reset interface\n");
 
 reset:
         /* Deallocate the requests */
-        if (common->prev_fsg) {
-                struct fsg_dev *fsg = common->prev_fsg;
+        if (common->fsg) {
+                fsg = common->fsg;
 
                 for (i = 0; i < FSG_NUM_BUFFERS; ++i) {
                         struct fsg_buffhd *bh = &common->buffhds[i];
@@ -2345,88 +2340,53 @@ reset:
                         fsg->bulk_out_enabled = 0;
                 }
 
-                common->prev_fsg = 0;
+                common->fsg = NULL;
+                wake_up(&common->fsg_wait);
         }
 
         common->running = 0;
-        if (altsetting < 0 || rc != 0)
+        if (!new_fsg || rc)
                 return rc;
 
-        DBG(common, "set interface %d\n", altsetting);
+        common->fsg = new_fsg;
+        fsg = common->fsg;
 
-        if (fsg_is_set(common)) {
-                struct fsg_dev *fsg = common->fsg;
-                common->prev_fsg = common->fsg;
+        /* Enable the endpoints */
+        d = fsg_ep_desc(common->gadget,
+                        &fsg_fs_bulk_in_desc, &fsg_hs_bulk_in_desc);
+        rc = enable_endpoint(common, fsg->bulk_in, d);
+        if (rc)
+                goto reset;
+        fsg->bulk_in_enabled = 1;
+
+        d = fsg_ep_desc(common->gadget,
+                        &fsg_fs_bulk_out_desc, &fsg_hs_bulk_out_desc);
+        rc = enable_endpoint(common, fsg->bulk_out, d);
+        if (rc)
+                goto reset;
+        fsg->bulk_out_enabled = 1;
+        common->bulk_out_maxpacket = le16_to_cpu(d->wMaxPacketSize);
+        clear_bit(IGNORE_BULK_OUT, &fsg->atomic_bitflags);
 
-                /* Enable the endpoints */
-                d = fsg_ep_desc(common->gadget,
-                                &fsg_fs_bulk_in_desc, &fsg_hs_bulk_in_desc);
-                rc = enable_endpoint(common, fsg->bulk_in, d);
+        /* Allocate the requests */
+        for (i = 0; i < FSG_NUM_BUFFERS; ++i) {
+                struct fsg_buffhd       *bh = &common->buffhds[i];
+
+                rc = alloc_request(common, fsg->bulk_in, &bh->inreq);
                 if (rc)
                         goto reset;
-                fsg->bulk_in_enabled = 1;
-
-                d = fsg_ep_desc(common->gadget,
-                                &fsg_fs_bulk_out_desc, &fsg_hs_bulk_out_desc);
-                rc = enable_endpoint(common, fsg->bulk_out, d);
+                rc = alloc_request(common, fsg->bulk_out, &bh->outreq);
                 if (rc)
                         goto reset;
-                fsg->bulk_out_enabled = 1;
-                common->bulk_out_maxpacket = le16_to_cpu(d->wMaxPacketSize);
-                clear_bit(IGNORE_BULK_OUT, &fsg->atomic_bitflags);
-
-                /* Allocate the requests */
-                for (i = 0; i < FSG_NUM_BUFFERS; ++i) {
-                        struct fsg_buffhd       *bh = &common->buffhds[i];
-
-                        rc = alloc_request(common, fsg->bulk_in, &bh->inreq);
-                        if (rc)
-                                goto reset;
-                        rc = alloc_request(common, fsg->bulk_out, &bh->outreq);
-                        if (rc)
-                                goto reset;
-                        bh->inreq->buf = bh->outreq->buf = bh->buf;
-                        bh->inreq->context = bh->outreq->context = bh;
-                        bh->inreq->complete = bulk_in_complete;
-                        bh->outreq->complete = bulk_out_complete;
-                }
-
-                common->running = 1;
-                for (i = 0; i < common->nluns; ++i)
-                        common->luns[i].unit_attention_data = SS_RESET_OCCURRED;
-                return rc;
-        } else {
-                return -EIO;
-        }
-}
-
-
-/*
- * Change our operational configuration.  This code must agree with the code
- * that returns config descriptors, and with interface altsetting code.
- *
- * It's also responsible for power management interactions.  Some
- * configurations might not work with our current power sources.
- * For now we just assume the gadget is always self-powered.
- */
-static int do_set_config(struct fsg_common *common, u8 new_config)
-{
-        int     rc = 0;
-
-        /* Disable the single interface */
-        if (common->config != 0) {
-                DBG(common, "reset config\n");
-                common->config = 0;
-                rc = do_set_interface(common, -1);
+                bh->inreq->buf = bh->outreq->buf = bh->buf;
+                bh->inreq->context = bh->outreq->context = bh;
+                bh->inreq->complete = bulk_in_complete;
+                bh->outreq->complete = bulk_out_complete;
         }
 
-        /* Enable the interface */
-        if (new_config != 0) {
-                common->config = new_config;
-                rc = do_set_interface(common, 0);
-                if (rc != 0)
-                        common->config = 0;     /* Reset on errors */
-        }
+        common->running = 1;
+        for (i = 0; i < common->nluns; ++i)
+                common->luns[i].unit_attention_data = SS_RESET_OCCURRED;
         return rc;
 }
 
@@ -2437,9 +2397,7 @@ static int do_set_config(struct fsg_common *common, u8 new_config)
 static int fsg_set_alt(struct usb_function *f, unsigned intf, unsigned alt)
 {
         struct fsg_dev *fsg = fsg_from_func(f);
-        fsg->common->prev_fsg = fsg->common->fsg;
-        fsg->common->fsg = fsg;
-        fsg->common->new_config = 1;
+        fsg->common->new_fsg = fsg;
         raise_exception(fsg->common, FSG_STATE_CONFIG_CHANGE);
         return 0;
 }
@@ -2447,9 +2405,7 @@ static int fsg_set_alt(struct usb_function *f, unsigned intf, unsigned alt)
 static void fsg_disable(struct usb_function *f)
 {
         struct fsg_dev *fsg = fsg_from_func(f);
-        fsg->common->prev_fsg = fsg->common->fsg;
-        fsg->common->fsg = fsg;
-        fsg->common->new_config = 0;
+        fsg->common->new_fsg = NULL;
         raise_exception(fsg->common, FSG_STATE_CONFIG_CHANGE);
 }
 
@@ -2459,19 +2415,17 @@ static void fsg_disable(struct usb_function *f)
 static void handle_exception(struct fsg_common *common)
 {
         siginfo_t               info;
-        int                     sig;
         int                     i;
         struct fsg_buffhd       *bh;
         enum fsg_state          old_state;
-        u8                      new_config;
         struct fsg_lun          *curlun;
         unsigned int            exception_req_tag;
-        int                     rc;
 
         /* Clear the existing signals.  Anything but SIGUSR1 is converted
          * into a high-priority EXIT exception. */
         for (;;) {
-                sig = dequeue_signal_lock(current, &current->blocked, &info);
+                int sig =
+                        dequeue_signal_lock(current, &current->blocked, &info);
                 if (!sig)
                         break;
                 if (sig != SIGUSR1) {
@@ -2482,7 +2436,7 @@ static void handle_exception(struct fsg_common *common)
         }
 
         /* Cancel all the pending transfers */
-        if (fsg_is_set(common)) {
+        if (likely(common->fsg)) {
                 for (i = 0; i < FSG_NUM_BUFFERS; ++i) {
                         bh = &common->buffhds[i];
                         if (bh->inreq_busy)
@@ -2523,7 +2477,6 @@ static void handle_exception(struct fsg_common *common)
         common->next_buffhd_to_fill = &common->buffhds[0];
         common->next_buffhd_to_drain = &common->buffhds[0];
         exception_req_tag = common->exception_req_tag;
-        new_config = common->new_config;
         old_state = common->state;
 
         if (old_state == FSG_STATE_ABORT_BULK_OUT)
@@ -2573,12 +2526,12 @@ static void handle_exception(struct fsg_common *common)
                 break;
 
         case FSG_STATE_CONFIG_CHANGE:
-                rc = do_set_config(common, new_config);
+                do_set_interface(common, common->new_fsg);
                 break;
 
         case FSG_STATE_EXIT:
         case FSG_STATE_TERMINATED:
-                do_set_config(common, 0);               /* Free resources */
+                do_set_interface(common, NULL);         /* Free resources */
                 spin_lock_irq(&common->lock);
                 common->state = FSG_STATE_TERMINATED;   /* Stop the thread */
                 spin_unlock_irq(&common->lock);
@@ -2863,6 +2816,7 @@ buffhds_first_it:
                 goto error_release;
         }
         init_completion(&common->thread_notifier);
+        init_waitqueue_head(&common->fsg_wait);
 #undef OR
 
 
@@ -2957,9 +2911,17 @@ static void fsg_common_release(struct kref *ref)
 static void fsg_unbind(struct usb_configuration *c, struct usb_function *f)
 {
         struct fsg_dev          *fsg = fsg_from_func(f);
+        struct fsg_common       *common = fsg->common;
 
         DBG(fsg, "unbind\n");
-        fsg_common_put(fsg->common);
+        if (fsg->common->fsg == fsg) {
+                fsg->common->new_fsg = NULL;
+                raise_exception(fsg->common, FSG_STATE_CONFIG_CHANGE);
+                /* FIXME: make interruptible or killable somehow? */
+                wait_event(common->fsg_wait, common->fsg != fsg);
+        }
+
+        fsg_common_put(common);
         usb_free_descriptors(fsg->function.descriptors);
         usb_free_descriptors(fsg->function.hs_descriptors);
         kfree(fsg);
@@ -2970,7 +2932,6 @@ static int fsg_bind(struct usb_configuration *c, struct usb_function *f)
 {
         struct fsg_dev          *fsg = fsg_from_func(f);
         struct usb_gadget       *gadget = c->cdev->gadget;
-        int                     rc;
         int                     i;
         struct usb_ep           *ep;
 
@@ -2996,6 +2957,11 @@ static int fsg_bind(struct usb_configuration *c, struct usb_function *f)
         ep->driver_data = fsg->common;  /* claim the endpoint */
         fsg->bulk_out = ep;
 
+        /* Copy descriptors */
+        f->descriptors = usb_copy_descriptors(fsg_fs_function);
+        if (unlikely(!f->descriptors))
+                return -ENOMEM;
+
         if (gadget_is_dualspeed(gadget)) {
                 /* Assume endpoint addresses are the same for both speeds */
                 fsg_hs_bulk_in_desc.bEndpointAddress =
@@ -3003,16 +2969,17 @@ static int fsg_bind(struct usb_configuration *c, struct usb_function *f)
                 fsg_hs_bulk_out_desc.bEndpointAddress =
                         fsg_fs_bulk_out_desc.bEndpointAddress;
                 f->hs_descriptors = usb_copy_descriptors(fsg_hs_function);
-                if (unlikely(!f->hs_descriptors))
+                if (unlikely(!f->hs_descriptors)) {
+                        usb_free_descriptors(f->descriptors);
                         return -ENOMEM;
+                }
         }
 
         return 0;
 
 autoconf_fail:
         ERROR(fsg, "unable to autoconfigure all endpoints\n");
-        rc = -ENOTSUPP;
-        return rc;
+        return -ENOTSUPP;
 }
 
 
@@ -3036,11 +3003,6 @@ static int fsg_add(struct usb_composite_dev *cdev,
 
         fsg->function.name        = FSG_DRIVER_DESC;
         fsg->function.strings     = fsg_strings_array;
-        fsg->function.descriptors = usb_copy_descriptors(fsg_fs_function);
-        if (unlikely(!fsg->function.descriptors)) {
-                rc = -ENOMEM;
-                goto error_free_fsg;
-        }
         fsg->function.bind        = fsg_bind;
         fsg->function.unbind      = fsg_unbind;
         fsg->function.setup       = fsg_setup;
@@ -3056,19 +3018,9 @@ static int fsg_add(struct usb_composite_dev *cdev,
 
         rc = usb_add_function(c, &fsg->function);
         if (unlikely(rc))
-                goto error_free_all;
-
-        fsg_common_get(fsg->common);
-        return 0;
-
-error_free_all:
-        usb_free_descriptors(fsg->function.descriptors);
-        /* fsg_bind() might have copied those; or maybe not? who cares
-         * -- free it just in case. */
-        usb_free_descriptors(fsg->function.hs_descriptors);
-error_free_fsg:
-        kfree(fsg);
-
+                kfree(fsg);
+        else
+                fsg_common_get(fsg->common);
         return rc;
 }
 
diff --git a/drivers/usb/gadget/fsl_qe_udc.c b/drivers/usb/gadget/fsl_qe_udc.c
index 2928523268b5..82506ca297d5 100644
--- a/drivers/usb/gadget/fsl_qe_udc.c
+++ b/drivers/usb/gadget/fsl_qe_udc.c
@@ -2400,7 +2400,7 @@ EXPORT_SYMBOL(usb_gadget_unregister_driver);
 static struct qe_udc __devinit *qe_udc_config(struct of_device *ofdev)
 {
         struct qe_udc *udc;
-        struct device_node *np = ofdev->node;
+        struct device_node *np = ofdev->dev.of_node;
         unsigned int tmp_addr = 0;
         struct usb_device_para __iomem *usbpram;
         unsigned int i;
@@ -2525,7 +2525,7 @@ static void qe_udc_release(struct device *dev)
 static int __devinit qe_udc_probe(struct of_device *ofdev,
                         const struct of_device_id *match)
 {
-        struct device_node *np = ofdev->node;
+        struct device_node *np = ofdev->dev.of_node;
         struct qe_ep *ep;
         unsigned int ret = 0;
         unsigned int i;
diff --git a/drivers/usb/gadget/g_ffs.c b/drivers/usb/gadget/g_ffs.c
index 4b0e4a040d6f..d1af253a9105 100644
--- a/drivers/usb/gadget/g_ffs.c
+++ b/drivers/usb/gadget/g_ffs.c
@@ -392,6 +392,17 @@ static int __gfs_do_config(struct usb_configuration *c,
         if (unlikely(ret < 0))
                 return ret;
 
+        /* After previous do_configs there may be some invalid
+         * pointers in c->interface array.  This happens every time
+         * a user space function with fewer interfaces than a user
+         * space function that was run before the new one is run.  The
+         * compasit's set_config() assumes that if there is no more
+         * then MAX_CONFIG_INTERFACES interfaces in a configuration
+         * then there is a NULL pointer after the last interface in
+         * c->interface array.  We need to make sure this is true. */
+        if (c->next_interface_id < ARRAY_SIZE(c->interface))
+                c->interface[c->next_interface_id] = NULL;
+
         return 0;
 }
 
diff --git a/drivers/usb/gadget/m66592-udc.h b/drivers/usb/gadget/m66592-udc.h
index 8b960deed680..c3caf1ac73ce 100644
--- a/drivers/usb/gadget/m66592-udc.h
+++ b/drivers/usb/gadget/m66592-udc.h
@@ -537,35 +537,35 @@ struct m66592 {
 /*-------------------------------------------------------------------------*/
 static inline u16 m66592_read(struct m66592 *m66592, unsigned long offset)
 {
-        return inw((unsigned long)m66592->reg + offset);
+        return ioread16(m66592->reg + offset);
 }
 
 static inline void m66592_read_fifo(struct m66592 *m66592,
                 unsigned long offset,
                 void *buf, unsigned long len)
 {
-        unsigned long fifoaddr = (unsigned long)m66592->reg + offset;
+        void __iomem *fifoaddr = m66592->reg + offset;
 
         if (m66592->pdata->on_chip) {
                 len = (len + 3) / 4;
-                insl(fifoaddr, buf, len);
+                ioread32_rep(fifoaddr, buf, len);
         } else {
                 len = (len + 1) / 2;
-                insw(fifoaddr, buf, len);
+                ioread16_rep(fifoaddr, buf, len);
         }
 }
 
 static inline void m66592_write(struct m66592 *m66592, u16 val,
                                 unsigned long offset)
 {
-        outw(val, (unsigned long)m66592->reg + offset);
+        iowrite16(val, m66592->reg + offset);
 }
 
 static inline void m66592_write_fifo(struct m66592 *m66592,
                 unsigned long offset,
                 void *buf, unsigned long len)
 {
-        unsigned long fifoaddr = (unsigned long)m66592->reg + offset;
+        void __iomem *fifoaddr = m66592->reg + offset;
 
         if (m66592->pdata->on_chip) {
                 unsigned long count;
@@ -573,25 +573,25 @@ static inline void m66592_write_fifo(struct m66592 *m66592,
                 int i;
 
                 count = len / 4;
-                outsl(fifoaddr, buf, count);
+                iowrite32_rep(fifoaddr, buf, count);
 
                 if (len & 0x00000003) {
                         pb = buf + count * 4;
                         for (i = 0; i < (len & 0x00000003); i++) {
                                 if (m66592_read(m66592, M66592_CFBCFG)) /* le */
-                                        outb(pb[i], fifoaddr + (3 - i));
+                                        iowrite8(pb[i], fifoaddr + (3 - i));
                                 else
-                                        outb(pb[i], fifoaddr + i);
+                                        iowrite8(pb[i], fifoaddr + i);
                         }
                 }
         } else {
                 unsigned long odd = len & 0x0001;
 
                 len = len / 2;
-                outsw(fifoaddr, buf, len);
+                iowrite16_rep(fifoaddr, buf, len);
                 if (odd) {
                         unsigned char *p = buf + len*2;
-                        outb(*p, fifoaddr);
+                        iowrite8(*p, fifoaddr);
                 }
         }
 }
diff --git a/drivers/usb/gadget/printer.c b/drivers/usb/gadget/printer.c
index 43abf55d8c60..4c3ac5c42237 100644
--- a/drivers/usb/gadget/printer.c
+++ b/drivers/usb/gadget/printer.c
@@ -82,7 +82,7 @@ static struct class *usb_gadget_class;
 struct printer_dev {
         spinlock_t              lock;           /* lock this structure */
         /* lock buffer lists during read/write calls */
-        spinlock_t              lock_printer_io;
+        struct mutex            lock_printer_io;
         struct usb_gadget       *gadget;
         struct usb_request      *req;           /* for control responses */
         u8                      config;
@@ -567,7 +567,7 @@ printer_read(struct file *fd, char __user *buf, size_t len, loff_t *ptr)
 
         DBG(dev, "printer_read trying to read %d bytes\n", (int)len);
 
-        spin_lock(&dev->lock_printer_io);
+        mutex_lock(&dev->lock_printer_io);
         spin_lock_irqsave(&dev->lock, flags);
 
         /* We will use this flag later to check if a printer reset happened
@@ -601,7 +601,7 @@ printer_read(struct file *fd, char __user *buf, size_t len, loff_t *ptr)
                  * call or not.
                  */
                 if (fd->f_flags & (O_NONBLOCK|O_NDELAY)) {
-                        spin_unlock(&dev->lock_printer_io);
+                        mutex_unlock(&dev->lock_printer_io);
                         return -EAGAIN;
                 }
 
@@ -648,7 +648,7 @@ printer_read(struct file *fd, char __user *buf, size_t len, loff_t *ptr)
                 if (dev->reset_printer) {
                         list_add(&current_rx_req->list, &dev->rx_reqs);
                         spin_unlock_irqrestore(&dev->lock, flags);
-                        spin_unlock(&dev->lock_printer_io);
+                        mutex_unlock(&dev->lock_printer_io);
                         return -EAGAIN;
                 }
 
@@ -673,7 +673,7 @@ printer_read(struct file *fd, char __user *buf, size_t len, loff_t *ptr)
         dev->current_rx_buf = current_rx_buf;
 
         spin_unlock_irqrestore(&dev->lock, flags);
-        spin_unlock(&dev->lock_printer_io);
+        mutex_unlock(&dev->lock_printer_io);
 
         DBG(dev, "printer_read returned %d bytes\n", (int)bytes_copied);
 
@@ -697,7 +697,7 @@ printer_write(struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
         if (len == 0)
                 return -EINVAL;
 
-        spin_lock(&dev->lock_printer_io);
+        mutex_lock(&dev->lock_printer_io);
         spin_lock_irqsave(&dev->lock, flags);
 
         /* Check if a printer reset happens while we have interrupts on */
@@ -713,7 +713,7 @@ printer_write(struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
                  * a NON-Blocking call or not.
                  */
                 if (fd->f_flags & (O_NONBLOCK|O_NDELAY)) {
-                        spin_unlock(&dev->lock_printer_io);
+                        mutex_unlock(&dev->lock_printer_io);
                         return -EAGAIN;
                 }
 
@@ -752,7 +752,7 @@ printer_write(struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
 
                 if (copy_from_user(req->buf, buf, size)) {
                         list_add(&req->list, &dev->tx_reqs);
-                        spin_unlock(&dev->lock_printer_io);
+                        mutex_unlock(&dev->lock_printer_io);
                         return bytes_copied;
                 }
 
@@ -766,14 +766,14 @@ printer_write(struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
                 if (dev->reset_printer) {
                         list_add(&req->list, &dev->tx_reqs);
                         spin_unlock_irqrestore(&dev->lock, flags);
-                        spin_unlock(&dev->lock_printer_io);
+                        mutex_unlock(&dev->lock_printer_io);
                         return -EAGAIN;
                 }
 
                 if (usb_ep_queue(dev->in_ep, req, GFP_ATOMIC)) {
                         list_add(&req->list, &dev->tx_reqs);
                         spin_unlock_irqrestore(&dev->lock, flags);
-                        spin_unlock(&dev->lock_printer_io);
+                        mutex_unlock(&dev->lock_printer_io);
                         return -EAGAIN;
                 }
 
@@ -782,7 +782,7 @@ printer_write(struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
         }
 
         spin_unlock_irqrestore(&dev->lock, flags);
-        spin_unlock(&dev->lock_printer_io);
+        mutex_unlock(&dev->lock_printer_io);
 
         DBG(dev, "printer_write sent %d bytes\n", (int)bytes_copied);
 
@@ -820,11 +820,11 @@ printer_poll(struct file *fd, poll_table *wait)
         unsigned long           flags;
         int                     status = 0;
 
-        spin_lock(&dev->lock_printer_io);
+        mutex_lock(&dev->lock_printer_io);
         spin_lock_irqsave(&dev->lock, flags);
         setup_rx_reqs(dev);
         spin_unlock_irqrestore(&dev->lock, flags);
-        spin_unlock(&dev->lock_printer_io);
+        mutex_unlock(&dev->lock_printer_io);
 
         poll_wait(fd, &dev->rx_wait, wait);
         poll_wait(fd, &dev->tx_wait, wait);
@@ -1461,7 +1461,7 @@ autoconf_fail:
         }
 
         spin_lock_init(&dev->lock);
-        spin_lock_init(&dev->lock_printer_io);
+        mutex_init(&dev->lock_printer_io);
         INIT_LIST_HEAD(&dev->tx_reqs);
         INIT_LIST_HEAD(&dev->tx_reqs_active);
         INIT_LIST_HEAD(&dev->rx_reqs);
@@ -1594,7 +1594,7 @@ cleanup(void)
 {
         int status;
 
-        spin_lock(&usb_printer_gadget.lock_printer_io);
+        mutex_lock(&usb_printer_gadget.lock_printer_io);
         class_destroy(usb_gadget_class);
         unregister_chrdev_region(g_printer_devno, 2);
 
@@ -1602,6 +1602,6 @@ cleanup(void)
         if (status)
                 ERROR(dev, "usb_gadget_unregister_driver %x\n", status);
 
-        spin_unlock(&usb_printer_gadget.lock_printer_io);
+        mutex_unlock(&usb_printer_gadget.lock_printer_io);
 }
 module_exit(cleanup);
diff --git a/drivers/usb/gadget/r8a66597-udc.c b/drivers/usb/gadget/r8a66597-udc.c
index 888d8f166c0b..70a817842755 100644
--- a/drivers/usb/gadget/r8a66597-udc.c
+++ b/drivers/usb/gadget/r8a66597-udc.c
@@ -1500,7 +1500,7 @@ static int __exit r8a66597_remove(struct platform_device *pdev)
         struct r8a66597         *r8a66597 = dev_get_drvdata(&pdev->dev);
 
         del_timer_sync(&r8a66597->timer);
-        iounmap((void *)r8a66597->reg);
+        iounmap(r8a66597->reg);
         free_irq(platform_get_irq(pdev, 0), r8a66597);
         r8a66597_free_request(&r8a66597->ep[0].ep, r8a66597->ep0_req);
 #ifdef CONFIG_HAVE_CLK
@@ -1578,7 +1578,7 @@ static int __init r8a66597_probe(struct platform_device *pdev)
         init_timer(&r8a66597->timer);
         r8a66597->timer.function = r8a66597_timer;
         r8a66597->timer.data = (unsigned long)r8a66597;
-        r8a66597->reg = (unsigned long)reg;
+        r8a66597->reg = reg;
 
 #ifdef CONFIG_HAVE_CLK
         if (r8a66597->pdata->on_chip) {
diff --git a/drivers/usb/gadget/r8a66597-udc.h b/drivers/usb/gadget/r8a66597-udc.h
index 9a537aa07968..f763b5190afa 100644
--- a/drivers/usb/gadget/r8a66597-udc.h
+++ b/drivers/usb/gadget/r8a66597-udc.h
@@ -91,7 +91,7 @@ struct r8a66597_ep {
 
 struct r8a66597 {
         spinlock_t              lock;
-        unsigned long           reg;
+        void __iomem            *reg;
 
 #ifdef CONFIG_HAVE_CLK
         struct clk *clk;
@@ -127,7 +127,7 @@ struct r8a66597 {
 
 static inline u16 r8a66597_read(struct r8a66597 *r8a66597, unsigned long offset)
 {
-        return inw(r8a66597->reg + offset);
+        return ioread16(r8a66597->reg + offset);
 }
 
 static inline void r8a66597_read_fifo(struct r8a66597 *r8a66597,
@@ -135,7 +135,7 @@ static inline void r8a66597_read_fifo(struct r8a66597 *r8a66597,
                                       unsigned char *buf,
                                       int len)
 {
-        unsigned long fifoaddr = r8a66597->reg + offset;
+        void __iomem *fifoaddr = r8a66597->reg + offset;
         unsigned int data;
         int i;
 
@@ -144,7 +144,7 @@ static inline void r8a66597_read_fifo(struct r8a66597 *r8a66597,
 
                 /* aligned buf case */
                 if (len >= 4 && !((unsigned long)buf & 0x03)) {
-                        insl(fifoaddr, buf, len / 4);
+                        ioread32_rep(fifoaddr, buf, len / 4);
                         buf += len & ~0x03;
                         len &= 0x03;
                 }
@@ -152,7 +152,7 @@ static inline void r8a66597_read_fifo(struct r8a66597 *r8a66597,
                 /* unaligned buf case */
                 for (i = 0; i < len; i++) {
                         if (!(i & 0x03))
-                                data = inl(fifoaddr);
+                                data = ioread32(fifoaddr);
 
                         buf[i] = (data >> ((i & 0x03) * 8)) & 0xff;
                 }
@@ -161,7 +161,7 @@ static inline void r8a66597_read_fifo(struct r8a66597 *r8a66597,
 
                 /* aligned buf case */
                 if (len >= 2 && !((unsigned long)buf & 0x01)) {
-                        insw(fifoaddr, buf, len / 2);
+                        ioread16_rep(fifoaddr, buf, len / 2);
                         buf += len & ~0x01;
                         len &= 0x01;
                 }
@@ -169,7 +169,7 @@ static inline void r8a66597_read_fifo(struct r8a66597 *r8a66597,
                 /* unaligned buf case */
                 for (i = 0; i < len; i++) {
                         if (!(i & 0x01))
-                                data = inw(fifoaddr);
+                                data = ioread16(fifoaddr);
 
                         buf[i] = (data >> ((i & 0x01) * 8)) & 0xff;
                 }
@@ -179,7 +179,7 @@ static inline void r8a66597_read_fifo(struct r8a66597 *r8a66597,
 static inline void r8a66597_write(struct r8a66597 *r8a66597, u16 val,
                                   unsigned long offset)
 {
-        outw(val, r8a66597->reg + offset);
+        iowrite16(val, r8a66597->reg + offset);
 }
 
 static inline void r8a66597_write_fifo(struct r8a66597 *r8a66597,
@@ -187,21 +187,21 @@ static inline void r8a66597_write_fifo(struct r8a66597 *r8a66597,
                                        unsigned char *buf,
                                        int len)
 {
-        unsigned long fifoaddr = r8a66597->reg + offset;
+        void __iomem *fifoaddr = r8a66597->reg + offset;
         int adj = 0;
         int i;
 
         if (r8a66597->pdata->on_chip) {
                 /* 32-bit access only if buf is 32-bit aligned */
                 if (len >= 4 && !((unsigned long)buf & 0x03)) {
-                        outsl(fifoaddr, buf, len / 4);
+                        iowrite32_rep(fifoaddr, buf, len / 4);
                         buf += len & ~0x03;
                         len &= 0x03;
                 }
         } else {
                 /* 16-bit access only if buf is 16-bit aligned */
                 if (len >= 2 && !((unsigned long)buf & 0x01)) {
-                        outsw(fifoaddr, buf, len / 2);
+                        iowrite16_rep(fifoaddr, buf, len / 2);
                         buf += len & ~0x01;
                         len &= 0x01;
                 }
@@ -216,7 +216,7 @@ static inline void r8a66597_write_fifo(struct r8a66597 *r8a66597,
         }
 
         for (i = 0; i < len; i++)
-                outb(buf[i], fifoaddr + adj - (i & adj));
+                iowrite8(buf[i], fifoaddr + adj - (i & adj));
 }
 
 static inline void r8a66597_mdfy(struct r8a66597 *r8a66597,
diff --git a/drivers/usb/gadget/s3c-hsotg.c b/drivers/usb/gadget/s3c-hsotg.c
index 1f73b485732d..26193eceb323 100644
--- a/drivers/usb/gadget/s3c-hsotg.c
+++ b/drivers/usb/gadget/s3c-hsotg.c
@@ -297,6 +297,12 @@ static void s3c_hsotg_ctrl_epint(struct s3c_hsotg *hsotg,
  */
 static void s3c_hsotg_init_fifo(struct s3c_hsotg *hsotg)
 {
+        unsigned int ep;
+        unsigned int addr;
+        unsigned int size;
+        int timeout;
+        u32 val;
+
         /* the ryu 2.6.24 release ahs
            writel(0x1C0, hsotg->regs + S3C_GRXFSIZ);
            writel(S3C_GNPTXFSIZ_NPTxFStAddr(0x200) |
@@ -310,6 +316,51 @@ static void s3c_hsotg_init_fifo(struct s3c_hsotg *hsotg)
         writel(S3C_GNPTXFSIZ_NPTxFStAddr(2048) |
                S3C_GNPTXFSIZ_NPTxFDep(0x1C0),
                hsotg->regs + S3C_GNPTXFSIZ);
+
+        /* arange all the rest of the TX FIFOs, as some versions of this
+         * block have overlapping default addresses. This also ensures
+         * that if the settings have been changed, then they are set to
+         * known values. */
+
+        /* start at the end of the GNPTXFSIZ, rounded up */
+        addr = 2048 + 1024;
+        size = 768;
+
+        /* currently we allocate TX FIFOs for all possible endpoints,
+         * and assume that they are all the same size. */
+
+        for (ep = 0; ep <= 15; ep++) {
+                val = addr;
+                val |= size << S3C_DPTXFSIZn_DPTxFSize_SHIFT;
+                addr += size;
+
+                writel(val, hsotg->regs + S3C_DPTXFSIZn(ep));
+        }
+
+        /* according to p428 of the design guide, we need to ensure that
+         * all fifos are flushed before continuing */
+
+        writel(S3C_GRSTCTL_TxFNum(0x10) | S3C_GRSTCTL_TxFFlsh |
+               S3C_GRSTCTL_RxFFlsh, hsotg->regs + S3C_GRSTCTL);
+
+        /* wait until the fifos are both flushed */
+        timeout = 100;
+        while (1) {
+                val = readl(hsotg->regs + S3C_GRSTCTL);
+
+                if ((val & (S3C_GRSTCTL_TxFFlsh | S3C_GRSTCTL_RxFFlsh)) == 0)
+                        break;
+
+                if (--timeout == 0) {
+                        dev_err(hsotg->dev,
+                                "%s: timeout flushing fifos (GRSTCTL=%08x)\n",
+                                __func__, val);
+                }
+
+                udelay(1);
+        }
+
+        dev_dbg(hsotg->dev, "FIFOs reset, timeout at %d\n", timeout);
 }
 
 /**
@@ -2574,6 +2625,9 @@ int usb_gadget_register_driver(struct usb_gadget_driver *driver)
         writel(S3C_DCTL_CGOUTNak | S3C_DCTL_CGNPInNAK,
                hsotg->regs + S3C_DCTL);
 
+        /* must be at-least 3ms to allow bus to see disconnect */
+        msleep(3);
+
         /* remove the soft-disconnect and let's go */
         __bic32(hsotg->regs + S3C_DCTL, S3C_DCTL_SftDiscon);
 
@@ -2730,6 +2784,9 @@ static void s3c_hsotg_init(struct s3c_hsotg *hsotg)
 
         writel(0, hsotg->regs + S3C_DAINTMSK);
 
+        /* Be in disconnected state until gadget is registered */
+        __orr32(hsotg->regs + S3C_DCTL, S3C_DCTL_SftDiscon);
+
         if (0) {
                 /* post global nak until we're ready */
                 writel(S3C_DCTL_SGNPInNAK | S3C_DCTL_SGOUTNak,
diff --git a/drivers/usb/gadget/s3c2410_udc.c b/drivers/usb/gadget/s3c2410_udc.c
index d5f4c1d45c97..e724a051bfdd 100644
--- a/drivers/usb/gadget/s3c2410_udc.c
+++ b/drivers/usb/gadget/s3c2410_udc.c
@@ -1700,9 +1700,13 @@ int usb_gadget_unregister_driver(struct usb_gadget_driver *driver)
         if (!driver || driver != udc->driver || !driver->unbind)
                 return -EINVAL;
 
-        dprintk(DEBUG_NORMAL,"usb_gadget_register_driver() '%s'\n",
+        dprintk(DEBUG_NORMAL, "usb_gadget_unregister_driver() '%s'\n",
                 driver->driver.name);
 
+        /* report disconnect */
+        if (driver->disconnect)
+                driver->disconnect(&udc->gadget);
+
         driver->unbind(&udc->gadget);
 
         device_del(&udc->gadget.dev);
diff --git a/drivers/usb/gadget/u_serial.c b/drivers/usb/gadget/u_serial.c
index 16bdf77f582a..3e8dcb5455e3 100644
--- a/drivers/usb/gadget/u_serial.c
+++ b/drivers/usb/gadget/u_serial.c
@@ -536,17 +536,11 @@ recycle:
                 list_move(&req->list, &port->read_pool);
         }
 
-        /* Push from tty to ldisc; this is immediate with low_latency, and
-         * may trigger callbacks to this driver ... so drop the spinlock.
+        /* Push from tty to ldisc; without low_latency set this is handled by
+         * a workqueue, so we won't get callbacks and can hold port_lock
          */
         if (tty && do_push) {
-                spin_unlock_irq(&port->port_lock);
                 tty_flip_buffer_push(tty);
-                wake_up_interruptible(&tty->read_wait);
-                spin_lock_irq(&port->port_lock);
-
-                /* tty may have been closed */
-                tty = port->port_tty;
         }
 
 
@@ -784,11 +778,6 @@ static int gs_open(struct tty_struct *tty, struct file *file)
         port->open_count = 1;
         port->openclose = false;
 
-        /* low_latency means ldiscs work in tasklet context, without
-         * needing a workqueue schedule ... easier to keep up.
-         */
-        tty->low_latency = 1;
-
         /* if connected, start the I/O stream */
         if (port->port_usb) {
                 struct gserial  *gser = port->port_usb;
@@ -1195,6 +1184,7 @@ void gserial_cleanup(void)
         n_ports = 0;
 
         tty_unregister_driver(gs_tty_driver);
+        put_tty_driver(gs_tty_driver);
         gs_tty_driver = NULL;
 
         pr_debug("%s: cleaned up ttyGS* support\n", __func__);
diff --git a/drivers/usb/host/ehci-hcd.c b/drivers/usb/host/ehci-hcd.c
index ef3e88f0b3c3..a3ef2a9d9dc2 100644
--- a/drivers/usb/host/ehci-hcd.c
+++ b/drivers/usb/host/ehci-hcd.c
@@ -1135,7 +1135,7 @@ MODULE_LICENSE ("GPL");
 
 #ifdef CONFIG_XPS_USB_HCD_XILINX
 #include "ehci-xilinx-of.c"
-#define OF_PLATFORM_DRIVER      ehci_hcd_xilinx_of_driver
+#define XILINX_OF_PLATFORM_DRIVER       ehci_hcd_xilinx_of_driver
 #endif
 
 #ifdef CONFIG_PLAT_ORION
@@ -1159,7 +1159,8 @@ MODULE_LICENSE ("GPL");
 #endif
 
 #if !defined(PCI_DRIVER) && !defined(PLATFORM_DRIVER) && \
-    !defined(PS3_SYSTEM_BUS_DRIVER) && !defined(OF_PLATFORM_DRIVER)
+    !defined(PS3_SYSTEM_BUS_DRIVER) && !defined(OF_PLATFORM_DRIVER) && \
+    !defined(XILINX_OF_PLATFORM_DRIVER)
 #error "missing bus glue for ehci-hcd"
 #endif
 
@@ -1213,10 +1214,20 @@ static int __init ehci_hcd_init(void)
         if (retval < 0)
                 goto clean3;
 #endif
+
+#ifdef XILINX_OF_PLATFORM_DRIVER
+        retval = of_register_platform_driver(&XILINX_OF_PLATFORM_DRIVER);
+        if (retval < 0)
+                goto clean4;
+#endif
         return retval;
 
+#ifdef XILINX_OF_PLATFORM_DRIVER
+        /* of_unregister_platform_driver(&XILINX_OF_PLATFORM_DRIVER); */
+clean4:
+#endif
 #ifdef OF_PLATFORM_DRIVER
-        /* of_unregister_platform_driver(&OF_PLATFORM_DRIVER); */
+        of_unregister_platform_driver(&OF_PLATFORM_DRIVER);
 clean3:
 #endif
 #ifdef PS3_SYSTEM_BUS_DRIVER
@@ -1243,6 +1254,9 @@ module_init(ehci_hcd_init);
 
 static void __exit ehci_hcd_cleanup(void)
 {
+#ifdef XILINX_OF_PLATFORM_DRIVER
+        of_unregister_platform_driver(&XILINX_OF_PLATFORM_DRIVER);
+#endif
 #ifdef OF_PLATFORM_DRIVER
         of_unregister_platform_driver(&OF_PLATFORM_DRIVER);
 #endif
diff --git a/drivers/usb/host/ehci-mxc.c b/drivers/usb/host/ehci-mxc.c
index 544ccfd7056e..bd4027745aa7 100644
--- a/drivers/usb/host/ehci-mxc.c
+++ b/drivers/usb/host/ehci-mxc.c
@@ -207,10 +207,17 @@ static int ehci_mxc_drv_probe(struct platform_device *pdev)
         /* Initialize the transceiver */
         if (pdata->otg) {
                 pdata->otg->io_priv = hcd->regs + ULPI_VIEWPORT_OFFSET;
-                if (otg_init(pdata->otg) != 0)
-                        dev_err(dev, "unable to init transceiver\n");
-                else if (otg_set_vbus(pdata->otg, 1) != 0)
+                ret = otg_init(pdata->otg);
+                if (ret) {
+                        dev_err(dev, "unable to init transceiver, probably missing\n");
+                        ret = -ENODEV;
+                        goto err_add;
+                }
+                ret = otg_set_vbus(pdata->otg, 1);
+                if (ret) {
                         dev_err(dev, "unable to enable vbus on transceiver\n");
+                        goto err_add;
+                }
         }
 
         priv->hcd = hcd;
diff --git a/drivers/usb/host/ehci-xilinx-of.c b/drivers/usb/host/ehci-xilinx-of.c
index 013972bbde57..4899f451add9 100644
--- a/drivers/usb/host/ehci-xilinx-of.c
+++ b/drivers/usb/host/ehci-xilinx-of.c
@@ -151,7 +151,7 @@ static const struct hc_driver ehci_xilinx_of_hc_driver = {
 static int __devinit
 ehci_hcd_xilinx_of_probe(struct of_device *op, const struct of_device_id *match)
 {
-        struct device_node *dn = op->node;
+        struct device_node *dn = op->dev.of_node;
         struct usb_hcd *hcd;
         struct ehci_hcd *ehci;
         struct resource res;
diff --git a/drivers/usb/host/isp1362-hcd.c b/drivers/usb/host/isp1362-hcd.c
index 20a0dfe0fe36..0587ad4ce5c2 100644
--- a/drivers/usb/host/isp1362-hcd.c
+++ b/drivers/usb/host/isp1362-hcd.c
@@ -2224,12 +2224,9 @@ static void remove_debug_file(struct isp1362_hcd *isp1362_hcd)
 
 /*-------------------------------------------------------------------------*/
 
-static void isp1362_sw_reset(struct isp1362_hcd *isp1362_hcd)
+static void __isp1362_sw_reset(struct isp1362_hcd *isp1362_hcd)
 {
         int tmp = 20;
-        unsigned long flags;
-
-        spin_lock_irqsave(&isp1362_hcd->lock, flags);
 
         isp1362_write_reg16(isp1362_hcd, HCSWRES, HCSWRES_MAGIC);
         isp1362_write_reg32(isp1362_hcd, HCCMDSTAT, OHCI_HCR);
@@ -2240,6 +2237,14 @@ static void isp1362_sw_reset(struct isp1362_hcd *isp1362_hcd)
         }
         if (!tmp)
                 pr_err("Software reset timeout\n");
+}
+
+static void isp1362_sw_reset(struct isp1362_hcd *isp1362_hcd)
+{
+        unsigned long flags;
+
+        spin_lock_irqsave(&isp1362_hcd->lock, flags);
+        __isp1362_sw_reset(isp1362_hcd);
         spin_unlock_irqrestore(&isp1362_hcd->lock, flags);
 }
 
@@ -2418,7 +2423,7 @@ static void isp1362_hc_stop(struct usb_hcd *hcd)
         if (isp1362_hcd->board && isp1362_hcd->board->reset)
                 isp1362_hcd->board->reset(hcd->self.controller, 1);
         else
-                isp1362_sw_reset(isp1362_hcd);
+                __isp1362_sw_reset(isp1362_hcd);
 
         if (isp1362_hcd->board && isp1362_hcd->board->clock)
                 isp1362_hcd->board->clock(hcd->self.controller, 0);
diff --git a/drivers/usb/host/isp1362.h b/drivers/usb/host/isp1362.h
index 5151516ea1de..d995351f9bed 100644
--- a/drivers/usb/host/isp1362.h
+++ b/drivers/usb/host/isp1362.h
@@ -65,7 +65,7 @@ static inline void delayed_insw(unsigned int addr, void *buf, int len)
         unsigned short *bp = (unsigned short *)buf;
         while (len--) {
                 DUMMY_DELAY_ACCESS;
-                *bp++ = inw((void *)addr);
+                *bp++ = inw(addr);
         }
 }
 
diff --git a/drivers/usb/host/r8a66597-hcd.c b/drivers/usb/host/r8a66597-hcd.c
index 6db57ab6079d..77be3c24a427 100644
--- a/drivers/usb/host/r8a66597-hcd.c
+++ b/drivers/usb/host/r8a66597-hcd.c
@@ -1065,7 +1065,7 @@ static void r8a66597_usb_connect(struct r8a66597 *r8a66597, int port)
         else if (speed == LSMODE)
                 rh->port |= USB_PORT_STAT_LOW_SPEED;
 
-        rh->port &= USB_PORT_STAT_RESET;
+        rh->port &= ~USB_PORT_STAT_RESET;
         rh->port |= USB_PORT_STAT_ENABLE;
 }
 
@@ -2404,7 +2404,7 @@ static int __init_or_module r8a66597_remove(struct platform_device *pdev)
 
         del_timer_sync(&r8a66597->rh_timer);
         usb_remove_hcd(hcd);
-        iounmap((void *)r8a66597->reg);
+        iounmap(r8a66597->reg);
 #ifdef CONFIG_HAVE_CLK
         if (r8a66597->pdata->on_chip)
                 clk_put(r8a66597->clk);
@@ -2496,7 +2496,7 @@ static int __devinit r8a66597_probe(struct platform_device *pdev)
         init_timer(&r8a66597->rh_timer);
         r8a66597->rh_timer.function = r8a66597_timer;
         r8a66597->rh_timer.data = (unsigned long)r8a66597;
-        r8a66597->reg = (unsigned long)reg;
+        r8a66597->reg = reg;
 
         /* make sure no interrupts are pending */
         ret = r8a66597_clock_enable(r8a66597);
diff --git a/drivers/usb/host/r8a66597.h b/drivers/usb/host/r8a66597.h
index 228e3fb23854..95d0f5adfdcf 100644
--- a/drivers/usb/host/r8a66597.h
+++ b/drivers/usb/host/r8a66597.h
@@ -112,7 +112,7 @@ struct r8a66597_root_hub {
 
 struct r8a66597 {
         spinlock_t lock;
-        unsigned long reg;
+        void __iomem *reg;
 #ifdef CONFIG_HAVE_CLK
         struct clk *clk;
 #endif
@@ -170,67 +170,67 @@ static inline struct urb *r8a66597_get_urb(struct r8a66597 *r8a66597,
 
 static inline u16 r8a66597_read(struct r8a66597 *r8a66597, unsigned long offset)
 {
-        return inw(r8a66597->reg + offset);
+        return ioread16(r8a66597->reg + offset);
 }
 
 static inline void r8a66597_read_fifo(struct r8a66597 *r8a66597,
                                       unsigned long offset, u16 *buf,
                                       int len)
 {
-        unsigned long fifoaddr = r8a66597->reg + offset;
+        void __iomem *fifoaddr = r8a66597->reg + offset;
         unsigned long count;
 
         if (r8a66597->pdata->on_chip) {
                 count = len / 4;
-                insl(fifoaddr, buf, count);
+                ioread32_rep(fifoaddr, buf, count);
 
                 if (len & 0x00000003) {
-                        unsigned long tmp = inl(fifoaddr);
+                        unsigned long tmp = ioread32(fifoaddr);
                         memcpy((unsigned char *)buf + count * 4, &tmp,
                                len & 0x03);
                 }
         } else {
                 len = (len + 1) / 2;
-                insw(fifoaddr, buf, len);
+                ioread16_rep(fifoaddr, buf, len);
         }
 }
 
 static inline void r8a66597_write(struct r8a66597 *r8a66597, u16 val,
                                   unsigned long offset)
 {
-        outw(val, r8a66597->reg + offset);
+        iowrite16(val, r8a66597->reg + offset);
 }
 
 static inline void r8a66597_write_fifo(struct r8a66597 *r8a66597,
                                        unsigned long offset, u16 *buf,
                                        int len)
 {
-        unsigned long fifoaddr = r8a66597->reg + offset;
+        void __iomem *fifoaddr = r8a66597->reg + offset;
         unsigned long count;
         unsigned char *pb;
         int i;
 
         if (r8a66597->pdata->on_chip) {
                 count = len / 4;
-                outsl(fifoaddr, buf, count);
+                iowrite32_rep(fifoaddr, buf, count);
 
                 if (len & 0x00000003) {
                         pb = (unsigned char *)buf + count * 4;
                         for (i = 0; i < (len & 0x00000003); i++) {
                                 if (r8a66597_read(r8a66597, CFIFOSEL) & BIGEND)
-                                        outb(pb[i], fifoaddr + i);
+                                        iowrite8(pb[i], fifoaddr + i);
                                 else
-                                        outb(pb[i], fifoaddr + 3 - i);
+                                        iowrite8(pb[i], fifoaddr + 3 - i);
                         }
                 }
         } else {
                 int odd = len & 0x0001;
 
                 len = len / 2;
-                outsw(fifoaddr, buf, len);
+                ioread16_rep(fifoaddr, buf, len);
                 if (unlikely(odd)) {
                         buf = &buf[len];
-                        outb((unsigned char)*buf, fifoaddr);
+                        iowrite8((unsigned char)*buf, fifoaddr);
                 }
         }
 }
diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
index edffd81fc253..11482b6b9381 100644
--- a/drivers/usb/host/xhci-pci.c
+++ b/drivers/usb/host/xhci-pci.c
@@ -78,6 +78,8 @@ static int xhci_pci_setup(struct usb_hcd *hcd)
                         xhci_dbg(xhci, "QUIRK: Fresco Logic xHC needs configure"
                                         " endpoint cmd after reset endpoint\n");
         }
+        if (pdev->vendor == PCI_VENDOR_ID_NEC)
+                xhci->quirks |= XHCI_NEC_HOST;
 
         /* Make sure the HC is halted. */
         retval = xhci_halt(xhci);
diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index 36c858e5b529..94e6934edb09 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -182,8 +182,12 @@ static void inc_deq(struct xhci_hcd *xhci, struct xhci_ring *ring, bool consumer
  * set, but other sections talk about dealing with the chain bit set.  This was
  * fixed in the 0.96 specification errata, but we have to assume that all 0.95
  * xHCI hardware can't handle the chain bit being cleared on a link TRB.
+ *
+ * @more_trbs_coming:   Will you enqueue more TRBs before calling
+ *                      prepare_transfer()?
  */
-static void inc_enq(struct xhci_hcd *xhci, struct xhci_ring *ring, bool consumer)
+static void inc_enq(struct xhci_hcd *xhci, struct xhci_ring *ring,
+                bool consumer, bool more_trbs_coming)
 {
         u32 chain;
         union xhci_trb *next;
@@ -199,15 +203,28 @@ static void inc_enq(struct xhci_hcd *xhci, struct xhci_ring *ring, bool consumer
         while (last_trb(xhci, ring, ring->enq_seg, next)) {
                 if (!consumer) {
                         if (ring != xhci->event_ring) {
-                                if (chain) {
-                                        next->link.control |= TRB_CHAIN;
-
-                                        /* Give this link TRB to the hardware */
-                                        wmb();
-                                        next->link.control ^= TRB_CYCLE;
-                                } else {
+                                /*
+                                 * If the caller doesn't plan on enqueueing more
+                                 * TDs before ringing the doorbell, then we
+                                 * don't want to give the link TRB to the
+                                 * hardware just yet.  We'll give the link TRB
+                                 * back in prepare_ring() just before we enqueue
+                                 * the TD at the top of the ring.
+                                 */
+                                if (!chain && !more_trbs_coming)
                                         break;
+
+                                /* If we're not dealing with 0.95 hardware,
+                                 * carry over the chain bit of the previous TRB
+                                 * (which may mean the chain bit is cleared).
+                                 */
+                                if (!xhci_link_trb_quirk(xhci)) {
+                                        next->link.control &= ~TRB_CHAIN;
+                                        next->link.control |= chain;
                                 }
+                                /* Give this link TRB to the hardware */
+                                wmb();
+                                next->link.control ^= TRB_CYCLE;
                         }
                         /* Toggle the cycle bit after the last ring segment. */
                         if (last_trb_on_last_seg(xhci, ring, ring->enq_seg, next)) {
@@ -1071,6 +1088,15 @@ bandwidth_change:
                         xhci_warn(xhci, "Reset device command completion "
                                         "for disabled slot %u\n", slot_id);
                 break;
+        case TRB_TYPE(TRB_NEC_GET_FW):
+                if (!(xhci->quirks & XHCI_NEC_HOST)) {
+                        xhci->error_bitmask |= 1 << 6;
+                        break;
+                }
+                xhci_dbg(xhci, "NEC firmware version %2x.%02x\n",
+                                NEC_FW_MAJOR(event->status),
+                                NEC_FW_MINOR(event->status));
+                break;
         default:
                 /* Skip over unknown commands on the event ring */
                 xhci->error_bitmask |= 1 << 6;
@@ -1079,6 +1105,17 @@ bandwidth_change:
         inc_deq(xhci, xhci->cmd_ring, false);
 }
 
+static void handle_vendor_event(struct xhci_hcd *xhci,
+                union xhci_trb *event)
+{
+        u32 trb_type;
+
+        trb_type = TRB_FIELD_TO_TYPE(event->generic.field[3]);
+        xhci_dbg(xhci, "Vendor specific event TRB type = %u\n", trb_type);
+        if (trb_type == TRB_NEC_CMD_COMP && (xhci->quirks & XHCI_NEC_HOST))
+                handle_cmd_completion(xhci, &event->event_cmd);
+}
+
 static void handle_port_status(struct xhci_hcd *xhci,
                 union xhci_trb *event)
 {
@@ -1659,7 +1696,10 @@ void xhci_handle_event(struct xhci_hcd *xhci)
                         update_ptrs = 0;
                 break;
         default:
-                xhci->error_bitmask |= 1 << 3;
+                if ((event->event_cmd.flags & TRB_TYPE_BITMASK) >= TRB_TYPE(48))
+                        handle_vendor_event(xhci, event);
+                else
+                        xhci->error_bitmask |= 1 << 3;
         }
         /* Any of the above functions may drop and re-acquire the lock, so check
          * to make sure a watchdog timer didn't mark the host as non-responsive.
@@ -1684,9 +1724,12 @@ void xhci_handle_event(struct xhci_hcd *xhci)
 /*
  * Generic function for queueing a TRB on a ring.
  * The caller must have checked to make sure there's room on the ring.
+ *
+ * @more_trbs_coming:   Will you enqueue more TRBs before calling
+ *                      prepare_transfer()?
  */
 static void queue_trb(struct xhci_hcd *xhci, struct xhci_ring *ring,
-                bool consumer,
+                bool consumer, bool more_trbs_coming,
                 u32 field1, u32 field2, u32 field3, u32 field4)
 {
         struct xhci_generic_trb *trb;
@@ -1696,7 +1739,7 @@ static void queue_trb(struct xhci_hcd *xhci, struct xhci_ring *ring,
         trb->field[1] = field2;
         trb->field[2] = field3;
         trb->field[3] = field4;
-        inc_enq(xhci, ring, consumer);
+        inc_enq(xhci, ring, consumer, more_trbs_coming);
 }
 
 /*
@@ -1965,6 +2008,7 @@ static int queue_bulk_sg_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
         int trb_buff_len, this_sg_len, running_total;
         bool first_trb;
         u64 addr;
+        bool more_trbs_coming;
 
         struct xhci_generic_trb *start_trb;
         int start_cycle;
@@ -2050,7 +2094,11 @@ static int queue_bulk_sg_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
                 length_field = TRB_LEN(trb_buff_len) |
                         remainder |
                         TRB_INTR_TARGET(0);
-                queue_trb(xhci, ep_ring, false,
+                if (num_trbs > 1)
+                        more_trbs_coming = true;
+                else
+                        more_trbs_coming = false;
+                queue_trb(xhci, ep_ring, false, more_trbs_coming,
                                 lower_32_bits(addr),
                                 upper_32_bits(addr),
                                 length_field,
@@ -2101,6 +2149,7 @@ int xhci_queue_bulk_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
         int num_trbs;
         struct xhci_generic_trb *start_trb;
         bool first_trb;
+        bool more_trbs_coming;
         int start_cycle;
         u32 field, length_field;
 
@@ -2189,7 +2238,11 @@ int xhci_queue_bulk_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
                 length_field = TRB_LEN(trb_buff_len) |
                         remainder |
                         TRB_INTR_TARGET(0);
-                queue_trb(xhci, ep_ring, false,
+                if (num_trbs > 1)
+                        more_trbs_coming = true;
+                else
+                        more_trbs_coming = false;
+                queue_trb(xhci, ep_ring, false, more_trbs_coming,
                                 lower_32_bits(addr),
                                 upper_32_bits(addr),
                                 length_field,
@@ -2268,7 +2321,7 @@ int xhci_queue_ctrl_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
         /* Queue setup TRB - see section 6.4.1.2.1 */
         /* FIXME better way to translate setup_packet into two u32 fields? */
         setup = (struct usb_ctrlrequest *) urb->setup_packet;
-        queue_trb(xhci, ep_ring, false,
+        queue_trb(xhci, ep_ring, false, true,
                         /* FIXME endianness is probably going to bite my ass here. */
                         setup->bRequestType | setup->bRequest << 8 | setup->wValue << 16,
                         setup->wIndex | setup->wLength << 16,
@@ -2284,7 +2337,7 @@ int xhci_queue_ctrl_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
         if (urb->transfer_buffer_length > 0) {
                 if (setup->bRequestType & USB_DIR_IN)
                         field |= TRB_DIR_IN;
-                queue_trb(xhci, ep_ring, false,
+                queue_trb(xhci, ep_ring, false, true,
                                 lower_32_bits(urb->transfer_dma),
                                 upper_32_bits(urb->transfer_dma),
                                 length_field,
@@ -2301,7 +2354,7 @@ int xhci_queue_ctrl_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
                 field = 0;
         else
                 field = TRB_DIR_IN;
-        queue_trb(xhci, ep_ring, false,
+        queue_trb(xhci, ep_ring, false, false,
                         0,
                         0,
                         TRB_INTR_TARGET(0),
@@ -2338,7 +2391,7 @@ static int queue_command(struct xhci_hcd *xhci, u32 field1, u32 field2,
                                         "unfailable commands failed.\n");
                 return -ENOMEM;
         }
-        queue_trb(xhci, xhci->cmd_ring, false, field1, field2, field3,
+        queue_trb(xhci, xhci->cmd_ring, false, false, field1, field2, field3,
                         field4 | xhci->cmd_ring->cycle_state);
         return 0;
 }
@@ -2378,6 +2431,12 @@ int xhci_queue_address_device(struct xhci_hcd *xhci, dma_addr_t in_ctx_ptr,
                         false);
 }
 
+int xhci_queue_vendor_command(struct xhci_hcd *xhci,
+                u32 field1, u32 field2, u32 field3, u32 field4)
+{
+        return queue_command(xhci, field1, field2, field3, field4, false);
+}
+
 /* Queue a reset device command TRB */
 int xhci_queue_reset_device(struct xhci_hcd *xhci, u32 slot_id)
 {
diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index 40e0a0c221b8..27345cd04da0 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -106,6 +106,33 @@ int xhci_halt(struct xhci_hcd *xhci)
 }
 
 /*
+ * Set the run bit and wait for the host to be running.
+ */
+int xhci_start(struct xhci_hcd *xhci)
+{
+        u32 temp;
+        int ret;
+
+        temp = xhci_readl(xhci, &xhci->op_regs->command);
+        temp |= (CMD_RUN);
+        xhci_dbg(xhci, "// Turn on HC, cmd = 0x%x.\n",
+                        temp);
+        xhci_writel(xhci, temp, &xhci->op_regs->command);
+
+        /*
+         * Wait for the HCHalted Status bit to be 0 to indicate the host is
+         * running.
+         */
+        ret = handshake(xhci, &xhci->op_regs->status,
+                        STS_HALT, 0, XHCI_MAX_HALT_USEC);
+        if (ret == -ETIMEDOUT)
+                xhci_err(xhci, "Host took too long to start, "
+                                "waited %u microseconds.\n",
+                                XHCI_MAX_HALT_USEC);
+        return ret;
+}
+
+/*
  * Reset a halted HC, and set the internal HC state to HC_STATE_HALT.
  *
  * This resets pipelines, timers, counters, state machines, etc.
@@ -116,6 +143,7 @@ int xhci_reset(struct xhci_hcd *xhci)
 {
         u32 command;
         u32 state;
+        int ret;
 
         state = xhci_readl(xhci, &xhci->op_regs->status);
         if ((state & STS_HALT) == 0) {
@@ -130,7 +158,17 @@ int xhci_reset(struct xhci_hcd *xhci)
         /* XXX: Why does EHCI set this here?  Shouldn't other code do this? */
         xhci_to_hcd(xhci)->state = HC_STATE_HALT;
 
-        return handshake(xhci, &xhci->op_regs->command, CMD_RESET, 0, 250 * 1000);
+        ret = handshake(xhci, &xhci->op_regs->command,
+                        CMD_RESET, 0, 250 * 1000);
+        if (ret)
+                return ret;
+
+        xhci_dbg(xhci, "Wait for controller to be ready for doorbell rings\n");
+        /*
+         * xHCI cannot write to any doorbells or operational registers other
+         * than status until the "Controller Not Ready" flag is cleared.
+         */
+        return handshake(xhci, &xhci->op_regs->status, STS_CNR, 0, 250 * 1000);
 }
 
 
@@ -448,17 +486,20 @@ int xhci_run(struct usb_hcd *hcd)
 
         if (NUM_TEST_NOOPS > 0)
                 doorbell = xhci_setup_one_noop(xhci);
+        if (xhci->quirks & XHCI_NEC_HOST)
+                xhci_queue_vendor_command(xhci, 0, 0, 0,
+                                TRB_TYPE(TRB_NEC_GET_FW));
+
+        if (xhci_start(xhci)) {
+                xhci_halt(xhci);
+                return -ENODEV;
+        }
 
-        temp = xhci_readl(xhci, &xhci->op_regs->command);
-        temp |= (CMD_RUN);
-        xhci_dbg(xhci, "// Turn on HC, cmd = 0x%x.\n",
-                        temp);
-        xhci_writel(xhci, temp, &xhci->op_regs->command);
-        /* Flush PCI posted writes */
-        temp = xhci_readl(xhci, &xhci->op_regs->command);
         xhci_dbg(xhci, "// @%p = 0x%x\n", &xhci->op_regs->command, temp);
         if (doorbell)
                 (*doorbell)(xhci);
+        if (xhci->quirks & XHCI_NEC_HOST)
+                xhci_ring_cmd_db(xhci);
 
         xhci_dbg(xhci, "Finished xhci_run\n");
         return 0;
diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
index dada2fb59261..8b4b7d39f79c 100644
--- a/drivers/usb/host/xhci.h
+++ b/drivers/usb/host/xhci.h
@@ -925,6 +925,7 @@ union xhci_trb {
 /* TRB bit mask */
 #define TRB_TYPE_BITMASK        (0xfc00)
 #define TRB_TYPE(p)             ((p) << 10)
+#define TRB_FIELD_TO_TYPE(p)    (((p) & TRB_TYPE_BITMASK) >> 10)
 /* TRB type IDs */
 /* bulk, interrupt, isoc scatter/gather, and control data stage */
 #define TRB_NORMAL              1
@@ -992,6 +993,14 @@ union xhci_trb {
 #define TRB_MFINDEX_WRAP        39
 /* TRB IDs 40-47 reserved, 48-63 is vendor-defined */
 
+/* Nec vendor-specific command completion event. */
+#define TRB_NEC_CMD_COMP        48
+/* Get NEC firmware revision. */
+#define TRB_NEC_GET_FW          49
+
+#define NEC_FW_MINOR(p)         (((p) >> 0) & 0xff)
+#define NEC_FW_MAJOR(p)         (((p) >> 8) & 0xff)
+
 /*
  * TRBS_PER_SEGMENT must be a multiple of 4,
  * since the command ring is 64-byte aligned.
@@ -1172,6 +1181,7 @@ struct xhci_hcd {
         unsigned int            quirks;
 #define XHCI_LINK_TRB_QUIRK     (1 << 0)
 #define XHCI_RESET_EP_QUIRK     (1 << 1)
+#define XHCI_NEC_HOST           (1 << 2)
 };
 
 /* For testing purposes */
@@ -1379,6 +1389,8 @@ void xhci_set_hc_event_deq(struct xhci_hcd *xhci);
 int xhci_queue_slot_control(struct xhci_hcd *xhci, u32 trb_type, u32 slot_id);
 int xhci_queue_address_device(struct xhci_hcd *xhci, dma_addr_t in_ctx_ptr,
                 u32 slot_id);
+int xhci_queue_vendor_command(struct xhci_hcd *xhci,
+                u32 field1, u32 field2, u32 field3, u32 field4);
 int xhci_queue_stop_endpoint(struct xhci_hcd *xhci, int slot_id,
                 unsigned int ep_index);
 int xhci_queue_ctrl_tx(struct xhci_hcd *xhci, gfp_t mem_flags, struct urb *urb,
diff --git a/drivers/usb/musb/musb_core.c b/drivers/usb/musb/musb_core.c
index fad70bc83555..3b795c56221f 100644
--- a/drivers/usb/musb/musb_core.c
+++ b/drivers/usb/musb/musb_core.c
@@ -219,8 +219,8 @@ static int musb_ulpi_write(struct otg_transceiver *otg,
         return 0;
 }
 #else
-#define musb_ulpi_read(a, b)            NULL
-#define musb_ulpi_write(a, b, c)        NULL
+#define musb_ulpi_read          NULL
+#define musb_ulpi_write         NULL
 #endif
 
 static struct otg_io_access_ops musb_ulpi_access = {
@@ -451,10 +451,6 @@ void musb_hnp_stop(struct musb *musb)
  * @param power
  */
 
-#define STAGE0_MASK (MUSB_INTR_RESUME | MUSB_INTR_SESSREQ \
-                | MUSB_INTR_VBUSERROR | MUSB_INTR_CONNECT \
-                | MUSB_INTR_RESET)
-
 static irqreturn_t musb_stage0_irq(struct musb *musb, u8 int_usb,
                                 u8 devctl, u8 power)
 {
@@ -642,7 +638,7 @@ static irqreturn_t musb_stage0_irq(struct musb *musb, u8 int_usb,
                 handled = IRQ_HANDLED;
         }
 
-
+#endif
         if (int_usb & MUSB_INTR_SUSPEND) {
                 DBG(1, "SUSPEND (%s) devctl %02x power %02x\n",
                                 otg_state_string(musb), devctl, power);
@@ -705,6 +701,7 @@ static irqreturn_t musb_stage0_irq(struct musb *musb, u8 int_usb,
                 }
         }
 
+#ifdef CONFIG_USB_MUSB_HDRC_HCD
         if (int_usb & MUSB_INTR_CONNECT) {
                 struct usb_hcd *hcd = musb_to_hcd(musb);
                 void __iomem *mbase = musb->mregs;
@@ -1597,7 +1594,7 @@ irqreturn_t musb_interrupt(struct musb *musb)
         /* the core can interrupt us for multiple reasons; docs have
          * a generic interrupt flowchart to follow
          */
-        if (musb->int_usb & STAGE0_MASK)
+        if (musb->int_usb)
                 retval |= musb_stage0_irq(musb, musb->int_usb,
                                 devctl, power);
 
diff --git a/drivers/usb/musb/musb_core.h b/drivers/usb/musb/musb_core.h
index b22d02dea7d3..91d67794e350 100644
--- a/drivers/usb/musb/musb_core.h
+++ b/drivers/usb/musb/musb_core.h
@@ -470,7 +470,8 @@ struct musb_csr_regs {
 
 struct musb_context_registers {
 
-#ifdef CONFIG_PM
+#if defined(CONFIG_ARCH_OMAP2430) || defined(CONFIG_ARCH_OMAP3) || \
+    defined(CONFIG_ARCH_OMAP4)
         u32 otg_sysconfig, otg_forcestandby;
 #endif
         u8 power;
@@ -484,7 +485,8 @@ struct musb_context_registers {
         struct musb_csr_regs index_regs[MUSB_C_NUM_EPS];
 };
 
-#ifdef CONFIG_PM
+#if defined(CONFIG_ARCH_OMAP2430) || defined(CONFIG_ARCH_OMAP3) || \
+    defined(CONFIG_ARCH_OMAP4)
 extern void musb_platform_save_context(struct musb *musb,
                 struct musb_context_registers *musb_context);
 extern void musb_platform_restore_context(struct musb *musb,
diff --git a/drivers/usb/musb/musbhsdma.c b/drivers/usb/musb/musbhsdma.c
index 1008044a3bbc..dc66e4376d49 100644
--- a/drivers/usb/musb/musbhsdma.c
+++ b/drivers/usb/musb/musbhsdma.c
@@ -132,18 +132,9 @@ static void configure_channel(struct dma_channel *channel,
         if (mode) {
                 csr |= 1 << MUSB_HSDMA_MODE1_SHIFT;
                 BUG_ON(len < packet_sz);
-
-                if (packet_sz >= 64) {
-                        csr |= MUSB_HSDMA_BURSTMODE_INCR16
-                                        << MUSB_HSDMA_BURSTMODE_SHIFT;
-                } else if (packet_sz >= 32) {
-                        csr |= MUSB_HSDMA_BURSTMODE_INCR8
-                                        << MUSB_HSDMA_BURSTMODE_SHIFT;
-                } else if (packet_sz >= 16) {
-                        csr |= MUSB_HSDMA_BURSTMODE_INCR4
-                                        << MUSB_HSDMA_BURSTMODE_SHIFT;
-                }
         }
+        csr |= MUSB_HSDMA_BURSTMODE_INCR16
+                                << MUSB_HSDMA_BURSTMODE_SHIFT;
 
         csr |= (musb_channel->epnum << MUSB_HSDMA_ENDPOINT_SHIFT)
                 | (1 << MUSB_HSDMA_ENABLE_SHIFT)
diff --git a/drivers/usb/otg/ulpi.c b/drivers/usb/otg/ulpi.c
index b1b346932946..d331b222ad21 100644
--- a/drivers/usb/otg/ulpi.c
+++ b/drivers/usb/otg/ulpi.c
@@ -59,12 +59,17 @@ static int ulpi_set_flags(struct otg_transceiver *otg)
 
 static int ulpi_init(struct otg_transceiver *otg)
 {
-        int i, vid, pid;
-
-        vid = (otg_io_read(otg, ULPI_VENDOR_ID_HIGH) << 8) |
-               otg_io_read(otg, ULPI_VENDOR_ID_LOW);
-        pid = (otg_io_read(otg, ULPI_PRODUCT_ID_HIGH) << 8) |
-               otg_io_read(otg, ULPI_PRODUCT_ID_LOW);
+        int i, vid, pid, ret;
+        u32 ulpi_id = 0;
+
+        for (i = 0; i < 4; i++) {
+                ret = otg_io_read(otg, ULPI_PRODUCT_ID_HIGH - i);
+                if (ret < 0)
+                        return ret;
+                ulpi_id = (ulpi_id << 8) | ret;
+        }
+        vid = ulpi_id & 0xffff;
+        pid = ulpi_id >> 16;
 
         pr_info("ULPI transceiver vendor/product ID 0x%04x/0x%04x\n", vid, pid);
 
diff --git a/drivers/usb/serial/digi_acceleport.c b/drivers/usb/serial/digi_acceleport.c
index 3edda3ed822a..fd35f73b5721 100644
--- a/drivers/usb/serial/digi_acceleport.c
+++ b/drivers/usb/serial/digi_acceleport.c
@@ -1239,8 +1239,7 @@ static void digi_write_bulk_callback(struct urb *urb)
 
         /* port and serial sanity check */
         if (port == NULL || (priv = usb_get_serial_port_data(port)) == NULL) {
-                dev_err(&port->dev,
-                        "%s: port or port->private is NULL, status=%d\n",
+                pr_err("%s: port or port->private is NULL, status=%d\n",
                         __func__, status);
                 return;
         }
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index 050211afc07e..da7e334b0407 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -653,7 +653,6 @@ static struct usb_device_id id_table_combined [] = {
         { USB_DEVICE(EVOLUTION_VID, EVOLUTION_ER1_PID) },
         { USB_DEVICE(EVOLUTION_VID, EVO_HYBRID_PID) },
         { USB_DEVICE(EVOLUTION_VID, EVO_RCM4_PID) },
-        { USB_DEVICE(CONTEC_VID, CONTEC_COM1USBH_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_ARTEMIS_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_ATIK_ATK16_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_ATIK_ATK16C_PID) },
@@ -2005,6 +2004,8 @@ static void ftdi_set_termios(struct tty_struct *tty,
                                 "urb failed to set to rts/cts flow control\n");
                 }
 
+                /* raise DTR/RTS */
+                set_mctrl(port, TIOCM_DTR | TIOCM_RTS);
         } else {
                 /*
                  * Xon/Xoff code
@@ -2052,6 +2053,8 @@ static void ftdi_set_termios(struct tty_struct *tty,
                         }
                 }
 
+                /* lower DTR/RTS */
+                clear_mctrl(port, TIOCM_DTR | TIOCM_RTS);
         }
         return;
 }
diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
index 94d86c3febcb..bbc159a1df45 100644
--- a/drivers/usb/serial/ftdi_sio_ids.h
+++ b/drivers/usb/serial/ftdi_sio_ids.h
@@ -501,13 +501,6 @@
 #define CONTEC_COM1USBH_PID     0x8311  /* COM-1(USB)H */
 
 /*
- * Contec products (http://www.contec.com)
- * Submitted by Daniel Sangorrin
- */
-#define CONTEC_VID              0x06CE  /* Vendor ID */
-#define CONTEC_COM1USBH_PID     0x8311  /* COM-1(USB)H */
-
-/*
  * Definitions for B&B Electronics products.
  */
 #define BANDB_VID               0x0856  /* B&B Electronics Vendor ID */
diff --git a/drivers/usb/serial/mos7840.c b/drivers/usb/serial/mos7840.c
index f8424d1bfc1b..585b7e663740 100644
--- a/drivers/usb/serial/mos7840.c
+++ b/drivers/usb/serial/mos7840.c
@@ -730,7 +730,6 @@ static void mos7840_bulk_in_callback(struct urb *urb)
         mos7840_port = urb->context;
         if (!mos7840_port) {
                 dbg("%s", "NULL mos7840_port pointer");
-                mos7840_port->read_urb_busy = false;
                 return;
         }
 
diff --git a/drivers/usb/serial/qcserial.c b/drivers/usb/serial/qcserial.c
index 04bb759536bb..93d72eb8cafc 100644
--- a/drivers/usb/serial/qcserial.c
+++ b/drivers/usb/serial/qcserial.c
@@ -139,6 +139,7 @@ static int qcprobe(struct usb_serial *serial, const struct usb_device_id *id)
                                         "Could not set interface, error %d\n",
                                         retval);
                                 retval = -ENODEV;
+                                kfree(data);
                         }
                         return retval;
                 }
@@ -155,6 +156,7 @@ static int qcprobe(struct usb_serial *serial, const struct usb_device_id *id)
                                         "Could not set interface, error %d\n",
                                         retval);
                                 retval = -ENODEV;
+                                kfree(data);
                         }
                         return retval;
                 }
@@ -163,6 +165,7 @@ static int qcprobe(struct usb_serial *serial, const struct usb_device_id *id)
         default:
                 dev_err(&serial->dev->dev,
                         "unknown number of interfaces: %d\n", nintf);
+                kfree(data);
                 return -ENODEV;
         }