58 files changed, 688 insertions, 536 deletions

diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index 869d47cb6db3..0a69c0977e3f 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -546,10 +546,6 @@ static int acm_tty_open(struct tty_struct *tty, struct file *filp)
         tty->driver_data = acm;
         acm->tty = tty;
 
-        /* force low_latency on so that our tty_push actually forces the data through,
-           otherwise it is scheduled, and with high data rates data can get lost. */
-        tty->low_latency = 1;
-
         if (usb_autopm_get_interface(acm->control) < 0)
                 goto early_bail;
         else
diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c
index 3771d6e6d0cc..0fe434505ac4 100644
--- a/drivers/usb/class/cdc-wdm.c
+++ b/drivers/usb/class/cdc-wdm.c
@@ -3,7 +3,7 @@
  *
  * This driver supports USB CDC WCM Device Management.
  *
- * Copyright (c) 2007-2008 Oliver Neukum
+ * Copyright (c) 2007-2009 Oliver Neukum
  *
  * Some code taken from cdc-acm.c
  *
@@ -610,7 +610,7 @@ static int wdm_probe(struct usb_interface *intf, const struct usb_device_id *id)
         if (!buffer)
                 goto out;
 
-        while (buflen > 0) {
+        while (buflen > 2) {
                 if (buffer [1] != USB_DT_CS_INTERFACE) {
                         dev_err(&intf->dev, "skipping garbage\n");
                         goto next_desc;
@@ -646,16 +646,18 @@ next_desc:
         spin_lock_init(&desc->iuspin);
         init_waitqueue_head(&desc->wait);
         desc->wMaxCommand = maxcom;
+        /* this will be expanded and needed in hardware endianness */
         desc->inum = cpu_to_le16((u16)intf->cur_altsetting->desc.bInterfaceNumber);
         desc->intf = intf;
         INIT_WORK(&desc->rxwork, wdm_rxwork);
 
-        iface = &intf->altsetting[0];
+        rv = -EINVAL;
+        iface = intf->cur_altsetting;
+        if (iface->desc.bNumEndpoints != 1)
+                goto err;
         ep = &iface->endpoint[0].desc;
-        if (!usb_endpoint_is_int_in(ep)) {
-                rv = -EINVAL;
+        if (!ep || !usb_endpoint_is_int_in(ep))
                 goto err;
-        }
 
         desc->wMaxPacketSize = le16_to_cpu(ep->wMaxPacketSize);
         desc->bMaxPacketSize0 = udev->descriptor.bMaxPacketSize0;
@@ -711,12 +713,19 @@ next_desc:
 
         usb_set_intfdata(intf, desc);
         rv = usb_register_dev(intf, &wdm_class);
-        dev_info(&intf->dev, "cdc-wdm%d: USB WDM device\n",
-                 intf->minor - WDM_MINOR_BASE);
         if (rv < 0)
-                goto err;
+                goto err3;
+        else
+                dev_info(&intf->dev, "cdc-wdm%d: USB WDM device\n",
+                        intf->minor - WDM_MINOR_BASE);
 out:
         return rv;
+err3:
+        usb_set_intfdata(intf, NULL);
+        usb_buffer_free(interface_to_usbdev(desc->intf),
+                        desc->bMaxPacketSize0,
+                        desc->inbuf,
+                        desc->response->transfer_dma);
 err2:
         usb_buffer_free(interface_to_usbdev(desc->intf),
                         desc->wMaxPacketSize,
diff --git a/drivers/usb/core/buffer.c b/drivers/usb/core/buffer.c
index cadb2dc1d28a..3ba2fff71490 100644
--- a/drivers/usb/core/buffer.c
+++ b/drivers/usb/core/buffer.c
@@ -119,7 +119,7 @@ void *hcd_buffer_alloc(
                 if (size <= pool_max [i])
                         return dma_pool_alloc(hcd->pool [i], mem_flags, dma);
         }
-        return dma_alloc_coherent(hcd->self.controller, size, dma, 0);
+        return dma_alloc_coherent(hcd->self.controller, size, dma, mem_flags);
 }
 
 void hcd_buffer_free(
diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
index df3c539f652a..308609039c73 100644
--- a/drivers/usb/core/devio.c
+++ b/drivers/usb/core/devio.c
@@ -841,7 +841,7 @@ static int proc_resetep(struct dev_state *ps, void __user *arg)
         ret = checkintf(ps, ret);
         if (ret)
                 return ret;
-        usb_settoggle(ps->dev, ep & 0xf, !(ep & USB_DIR_IN), 0);
+        usb_reset_endpoint(ps->dev, ep);
         return 0;
 }
 
diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c
index 81fa8506825d..42b93da1085d 100644
--- a/drivers/usb/core/hcd.c
+++ b/drivers/usb/core/hcd.c
@@ -1539,6 +1539,32 @@ void usb_hcd_disable_endpoint(struct usb_device *udev,
                 hcd->driver->endpoint_disable(hcd, ep);
 }
 
+/**
+ * usb_hcd_reset_endpoint - reset host endpoint state
+ * @udev: USB device.
+ * @ep:   the endpoint to reset.
+ *
+ * Resets any host endpoint state such as the toggle bit, sequence
+ * number and current window.
+ */
+void usb_hcd_reset_endpoint(struct usb_device *udev,
+                            struct usb_host_endpoint *ep)
+{
+        struct usb_hcd *hcd = bus_to_hcd(udev->bus);
+
+        if (hcd->driver->endpoint_reset)
+                hcd->driver->endpoint_reset(hcd, ep);
+        else {
+                int epnum = usb_endpoint_num(&ep->desc);
+                int is_out = usb_endpoint_dir_out(&ep->desc);
+                int is_control = usb_endpoint_xfer_control(&ep->desc);
+
+                usb_settoggle(udev, epnum, is_out, 0);
+                if (is_control)
+                        usb_settoggle(udev, epnum, !is_out, 0);
+        }
+}
+
 /* Protect against drivers that try to unlink URBs after the device
  * is gone, by waiting until all unlinks for @udev are finished.
  * Since we don't currently track URBs by device, simply wait until
diff --git a/drivers/usb/core/hcd.h b/drivers/usb/core/hcd.h
index f750eb1ab595..e7d4479de41c 100644
--- a/drivers/usb/core/hcd.h
+++ b/drivers/usb/core/hcd.h
@@ -206,6 +206,11 @@ struct hc_driver {
         void    (*endpoint_disable)(struct usb_hcd *hcd,
                         struct usb_host_endpoint *ep);
 
+        /* (optional) reset any endpoint state such as sequence number
+           and current window */
+        void    (*endpoint_reset)(struct usb_hcd *hcd,
+                        struct usb_host_endpoint *ep);
+
         /* root hub support */
         int     (*hub_status_data) (struct usb_hcd *hcd, char *buf);
         int     (*hub_control) (struct usb_hcd *hcd,
@@ -234,6 +239,8 @@ extern void usb_hcd_flush_endpoint(struct usb_device *udev,
                 struct usb_host_endpoint *ep);
 extern void usb_hcd_disable_endpoint(struct usb_device *udev,
                 struct usb_host_endpoint *ep);
+extern void usb_hcd_reset_endpoint(struct usb_device *udev,
+                struct usb_host_endpoint *ep);
 extern void usb_hcd_synchronize_unlinks(struct usb_device *udev);
 extern int usb_hcd_get_frame_number(struct usb_device *udev);
 
@@ -279,6 +286,13 @@ extern irqreturn_t usb_hcd_irq(int irq, void *__hcd);
 extern void usb_hc_died(struct usb_hcd *hcd);
 extern void usb_hcd_poll_rh_status(struct usb_hcd *hcd);
 
+/* The D0/D1 toggle bits ... USE WITH CAUTION (they're almost hcd-internal) */
+#define usb_gettoggle(dev, ep, out) (((dev)->toggle[out] >> (ep)) & 1)
+#define usb_dotoggle(dev, ep, out)  ((dev)->toggle[out] ^= (1 << (ep)))
+#define usb_settoggle(dev, ep, out, bit) \
+                ((dev)->toggle[out] = ((dev)->toggle[out] & ~(1 << (ep))) | \
+                 ((bit) << (ep)))
+
 /* -------------------------------------------------------------------------- */
 
 /* Enumeration is only for the hub driver, or HCD virtual root hubs */
diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c
index 30a0690f3683..b62628377654 100644
--- a/drivers/usb/core/message.c
+++ b/drivers/usb/core/message.c
@@ -1002,8 +1002,7 @@ int usb_clear_halt(struct usb_device *dev, int pipe)
          * the copy in usb-storage, for as long as we need two copies.
          */
 
-        /* toggle was reset by the clear */
-        usb_settoggle(dev, usb_pipeendpoint(pipe), usb_pipeout(pipe), 0);
+        usb_reset_endpoint(dev, endp);
 
         return 0;
 }
@@ -1076,6 +1075,30 @@ void usb_disable_endpoint(struct usb_device *dev, unsigned int epaddr,
 }
 
 /**
+ * usb_reset_endpoint - Reset an endpoint's state.
+ * @dev: the device whose endpoint is to be reset
+ * @epaddr: the endpoint's address.  Endpoint number for output,
+ *      endpoint number + USB_DIR_IN for input
+ *
+ * Resets any host-side endpoint state such as the toggle bit,
+ * sequence number or current window.
+ */
+void usb_reset_endpoint(struct usb_device *dev, unsigned int epaddr)
+{
+        unsigned int epnum = epaddr & USB_ENDPOINT_NUMBER_MASK;
+        struct usb_host_endpoint *ep;
+
+        if (usb_endpoint_out(epaddr))
+                ep = dev->ep_out[epnum];
+        else
+                ep = dev->ep_in[epnum];
+        if (ep)
+                usb_hcd_reset_endpoint(dev, ep);
+}
+EXPORT_SYMBOL_GPL(usb_reset_endpoint);
+
+
+/**
  * usb_disable_interface -- Disable all endpoints for an interface
  * @dev: the device whose interface is being disabled
  * @intf: pointer to the interface descriptor
@@ -1117,7 +1140,6 @@ void usb_disable_device(struct usb_device *dev, int skip_ep0)
                 usb_disable_endpoint(dev, i, true);
                 usb_disable_endpoint(dev, i + USB_DIR_IN, true);
         }
-        dev->toggle[0] = dev->toggle[1] = 0;
 
         /* getting rid of interfaces will disconnect
          * any drivers bound to them (a key side effect)
@@ -1154,28 +1176,24 @@ void usb_disable_device(struct usb_device *dev, int skip_ep0)
  * usb_enable_endpoint - Enable an endpoint for USB communications
  * @dev: the device whose interface is being enabled
  * @ep: the endpoint
- * @reset_toggle: flag to set the endpoint's toggle back to 0
+ * @reset_ep: flag to reset the endpoint state
  *
- * Resets the endpoint toggle if asked, and sets dev->ep_{in,out} pointers.
+ * Resets the endpoint state if asked, and sets dev->ep_{in,out} pointers.
  * For control endpoints, both the input and output sides are handled.
  */
 void usb_enable_endpoint(struct usb_device *dev, struct usb_host_endpoint *ep,
-                bool reset_toggle)
+                bool reset_ep)
 {
         int epnum = usb_endpoint_num(&ep->desc);
         int is_out = usb_endpoint_dir_out(&ep->desc);
         int is_control = usb_endpoint_xfer_control(&ep->desc);
 
-        if (is_out || is_control) {
-                if (reset_toggle)
-                        usb_settoggle(dev, epnum, 1, 0);
+        if (reset_ep)
+                usb_hcd_reset_endpoint(dev, ep);
+        if (is_out || is_control)
                 dev->ep_out[epnum] = ep;
-        }
-        if (!is_out || is_control) {
-                if (reset_toggle)
-                        usb_settoggle(dev, epnum, 0, 0);
+        if (!is_out || is_control)
                 dev->ep_in[epnum] = ep;
-        }
         ep->enabled = 1;
 }
 
@@ -1183,18 +1201,18 @@ void usb_enable_endpoint(struct usb_device *dev, struct usb_host_endpoint *ep,
  * usb_enable_interface - Enable all the endpoints for an interface
  * @dev: the device whose interface is being enabled
  * @intf: pointer to the interface descriptor
- * @reset_toggles: flag to set the endpoints' toggles back to 0
+ * @reset_eps: flag to reset the endpoints' state
  *
  * Enables all the endpoints for the interface's current altsetting.
  */
 void usb_enable_interface(struct usb_device *dev,
-                struct usb_interface *intf, bool reset_toggles)
+                struct usb_interface *intf, bool reset_eps)
 {
         struct usb_host_interface *alt = intf->cur_altsetting;
         int i;
 
         for (i = 0; i < alt->desc.bNumEndpoints; ++i)
-                usb_enable_endpoint(dev, &alt->endpoint[i], reset_toggles);
+                usb_enable_endpoint(dev, &alt->endpoint[i], reset_eps);
 }
 
 /**
@@ -1335,7 +1353,7 @@ EXPORT_SYMBOL_GPL(usb_set_interface);
  * This issues a standard SET_CONFIGURATION request to the device using
  * the current configuration.  The effect is to reset most USB-related
  * state in the device, including interface altsettings (reset to zero),
- * endpoint halts (cleared), and data toggle (only for bulk and interrupt
+ * endpoint halts (cleared), and endpoint state (only for bulk and interrupt
  * endpoints).  Other usbcore state is unchanged, including bindings of
  * usb device drivers to interfaces.
  *
@@ -1343,7 +1361,7 @@ EXPORT_SYMBOL_GPL(usb_set_interface);
  * (multi-interface) devices.  Instead, the driver for each interface may
  * use usb_set_interface() on the interfaces it claims.  Be careful though;
  * some devices don't support the SET_INTERFACE request, and others won't
- * reset all the interface state (notably data toggles).  Resetting the whole
+ * reset all the interface state (notably endpoint state).  Resetting the whole
  * configuration would affect other drivers' interfaces.
  *
  * The caller must own the device lock.
@@ -1376,8 +1394,6 @@ int usb_reset_configuration(struct usb_device *dev)
         if (retval < 0)
                 return retval;
 
-        dev->toggle[0] = dev->toggle[1] = 0;
-
         /* re-init hc/hcd interface/endpoint state */
         for (i = 0; i < config->desc.bNumInterfaces; i++) {
                 struct usb_interface *intf = config->interface[i];
diff --git a/drivers/usb/core/usb.c b/drivers/usb/core/usb.c
index dcfc072630c1..7eee400d3e32 100644
--- a/drivers/usb/core/usb.c
+++ b/drivers/usb/core/usb.c
@@ -362,7 +362,7 @@ struct usb_device *usb_alloc_dev(struct usb_device *parent,
         dev->ep0.desc.bLength = USB_DT_ENDPOINT_SIZE;
         dev->ep0.desc.bDescriptorType = USB_DT_ENDPOINT;
         /* ep0 maxpacket comes later, from device descriptor */
-        usb_enable_endpoint(dev, &dev->ep0, true);
+        usb_enable_endpoint(dev, &dev->ep0, false);
         dev->can_submit = 1;
 
         /* Save readable and stable topology id, distinguishing devices
diff --git a/drivers/usb/gadget/ci13xxx_udc.c b/drivers/usb/gadget/ci13xxx_udc.c
index 22c65960c429..38e531ecae4d 100644
--- a/drivers/usb/gadget/ci13xxx_udc.c
+++ b/drivers/usb/gadget/ci13xxx_udc.c
@@ -51,6 +51,7 @@
  * - Gadget API (majority of optional features)
  * - Suspend & Remote Wakeup
  */
+#include <linux/delay.h>
 #include <linux/device.h>
 #include <linux/dmapool.h>
 #include <linux/dma-mapping.h>
@@ -142,7 +143,7 @@ static struct {
 #define CAP_DEVICEADDR      (0x014UL)
 #define CAP_ENDPTLISTADDR   (0x018UL)
 #define CAP_PORTSC          (0x044UL)
-#define CAP_DEVLC           (0x0B4UL)
+#define CAP_DEVLC           (0x084UL)
 #define CAP_USBMODE         (hw_bank.lpm ? 0x0C8UL : 0x068UL)
 #define CAP_ENDPTSETUPSTAT  (hw_bank.lpm ? 0x0D8UL : 0x06CUL)
 #define CAP_ENDPTPRIME      (hw_bank.lpm ? 0x0DCUL : 0x070UL)
@@ -1986,6 +1987,8 @@ static int ep_enable(struct usb_ep *ep,
         do {
                 dbg_event(_usb_addr(mEp), "ENABLE", 0);
 
+                mEp->qh[mEp->dir].ptr->cap = 0;
+
                 if (mEp->type == USB_ENDPOINT_XFER_CONTROL)
                         mEp->qh[mEp->dir].ptr->cap |=  QH_IOS;
                 else if (mEp->type == USB_ENDPOINT_XFER_ISOC)
diff --git a/drivers/usb/gadget/file_storage.c b/drivers/usb/gadget/file_storage.c
index 5c030b080d4c..381a53b3e11c 100644
--- a/drivers/usb/gadget/file_storage.c
+++ b/drivers/usb/gadget/file_storage.c
@@ -738,7 +738,6 @@ static struct fsg_dev			*the_fsg;
 static struct usb_gadget_driver         fsg_driver;
 
 static void     close_backing_file(struct lun *curlun);
-static void     close_all_backing_files(struct fsg_dev *fsg);
 
 
 /*-------------------------------------------------------------------------*/
@@ -3593,12 +3592,10 @@ static int fsg_main_thread(void *fsg_)
         fsg->thread_task = NULL;
         spin_unlock_irq(&fsg->lock);
 
-        /* In case we are exiting because of a signal, unregister the
-         * gadget driver and close the backing file. */
-        if (test_and_clear_bit(REGISTERED, &fsg->atomic_bitflags)) {
+        /* If we are exiting because of a signal, unregister the
+         * gadget driver. */
+        if (test_and_clear_bit(REGISTERED, &fsg->atomic_bitflags))
                 usb_gadget_unregister_driver(&fsg_driver);
-                close_all_backing_files(fsg);
-        }
 
         /* Let the unbind and cleanup routines know the thread has exited */
         complete_and_exit(&fsg->thread_notifier, 0);
@@ -3703,14 +3700,6 @@ static void close_backing_file(struct lun *curlun)
         }
 }
 
-static void close_all_backing_files(struct fsg_dev *fsg)
-{
-        int     i;
-
-        for (i = 0; i < fsg->nluns; ++i)
-                close_backing_file(&fsg->luns[i]);
-}
-
 
 static ssize_t show_ro(struct device *dev, struct device_attribute *attr, char *buf)
 {
@@ -3845,6 +3834,7 @@ static void /* __init_or_exit */ fsg_unbind(struct usb_gadget *gadget)
                 if (curlun->registered) {
                         device_remove_file(&curlun->dev, &dev_attr_ro);
                         device_remove_file(&curlun->dev, &dev_attr_file);
+                        close_backing_file(curlun);
                         device_unregister(&curlun->dev);
                         curlun->registered = 0;
                 }
@@ -4190,7 +4180,6 @@ autoconf_fail:
 out:
         fsg->state = FSG_STATE_TERMINATED;      // The thread is dead
         fsg_unbind(gadget);
-        close_all_backing_files(fsg);
         complete(&fsg->thread_notifier);
         return rc;
 }
@@ -4284,7 +4273,6 @@ static void __exit fsg_cleanup(void)
         /* Wait for the thread to finish up */
         wait_for_completion(&fsg->thread_notifier);
 
-        close_all_backing_files(fsg);
         kref_put(&fsg->ref, fsg_release);
 }
 module_exit(fsg_cleanup);
diff --git a/drivers/usb/gadget/omap_udc.c b/drivers/usb/gadget/omap_udc.c
index 57d9641c6bf8..a2db0e174f2c 100644
--- a/drivers/usb/gadget/omap_udc.c
+++ b/drivers/usb/gadget/omap_udc.c
@@ -3104,7 +3104,6 @@ static int omap_udc_resume(struct platform_device *dev)
 /*-------------------------------------------------------------------------*/
 
 static struct platform_driver udc_driver = {
-        .probe          = omap_udc_probe,
         .remove         = __exit_p(omap_udc_remove),
         .suspend        = omap_udc_suspend,
         .resume         = omap_udc_resume,
@@ -3122,7 +3121,7 @@ static int __init udc_init(void)
 #endif
                 "%s\n", driver_desc,
                 use_dma ?  " (dma)" : "");
-        return platform_driver_register(&udc_driver);
+        return platform_driver_probe(&udc_driver, omap_udc_probe);
 }
 module_init(udc_init);
 
diff --git a/drivers/usb/gadget/u_ether.c b/drivers/usb/gadget/u_ether.c
index 96d65ca06ecd..4007770f7ed2 100644
--- a/drivers/usb/gadget/u_ether.c
+++ b/drivers/usb/gadget/u_ether.c
@@ -175,12 +175,6 @@ static void eth_get_drvinfo(struct net_device *net, struct ethtool_drvinfo *p)
         strlcpy(p->bus_info, dev_name(&dev->gadget->dev), sizeof p->bus_info);
 }
 
-static u32 eth_get_link(struct net_device *net)
-{
-        struct eth_dev  *dev = netdev_priv(net);
-        return dev->gadget->speed != USB_SPEED_UNKNOWN;
-}
-
 /* REVISIT can also support:
  *   - WOL (by tracking suspends and issuing remote wakeup)
  *   - msglevel (implies updated messaging)
@@ -189,7 +183,7 @@ static u32 eth_get_link(struct net_device *net)
 
 static struct ethtool_ops ops = {
         .get_drvinfo = eth_get_drvinfo,
-        .get_link = eth_get_link
+        .get_link = ethtool_op_get_link,
 };
 
 static void defer_kevent(struct eth_dev *dev, int flag)
diff --git a/drivers/usb/host/ehci-sched.c b/drivers/usb/host/ehci-sched.c
index ada5d2ba297b..556d0ec0c1f8 100644
--- a/drivers/usb/host/ehci-sched.c
+++ b/drivers/usb/host/ehci-sched.c
@@ -323,7 +323,7 @@ static int tt_available (
                  * already scheduled transactions
                  */
                 if (125 < usecs) {
-                        int ufs = (usecs / 125) - 1;
+                        int ufs = (usecs / 125);
                         int i;
                         for (i = uframe; i < (uframe + ufs) && i < 8; i++)
                                 if (0 < tt_usecs[i]) {
diff --git a/drivers/usb/host/ohci-at91.c b/drivers/usb/host/ohci-at91.c
index 4ed228a89943..bb5e6f671578 100644
--- a/drivers/usb/host/ohci-at91.c
+++ b/drivers/usb/host/ohci-at91.c
@@ -280,7 +280,7 @@ static int ohci_hcd_at91_drv_probe(struct platform_device *pdev)
                  * are always powered while this driver is active, and use
                  * active-low power switches.
                  */
-                for (i = 0; i < pdata->ports; i++) {
+                for (i = 0; i < ARRAY_SIZE(pdata->vbus_pin); i++) {
                         if (pdata->vbus_pin[i] <= 0)
                                 continue;
                         gpio_request(pdata->vbus_pin[i], "ohci_vbus");
@@ -298,7 +298,7 @@ static int ohci_hcd_at91_drv_remove(struct platform_device *pdev)
         int                     i;
 
         if (pdata) {
-                for (i = 0; i < pdata->ports; i++) {
+                for (i = 0; i < ARRAY_SIZE(pdata->vbus_pin); i++) {
                         if (pdata->vbus_pin[i] <= 0)
                                 continue;
                         gpio_direction_output(pdata->vbus_pin[i], 1);
diff --git a/drivers/usb/host/whci/asl.c b/drivers/usb/host/whci/asl.c
index 958751ccea43..c2050785a819 100644
--- a/drivers/usb/host/whci/asl.c
+++ b/drivers/usb/host/whci/asl.c
@@ -122,7 +122,8 @@ static uint32_t process_qset(struct whc *whc, struct whc_qset *qset)
                 process_inactive_qtd(whc, qset, td);
         }
 
-        update |= qset_add_qtds(whc, qset);
+        if (!qset->remove)
+                update |= qset_add_qtds(whc, qset);
 
 done:
         /*
@@ -254,23 +255,29 @@ int asl_urb_enqueue(struct whc *whc, struct urb *urb, gfp_t mem_flags)
 
         spin_lock_irqsave(&whc->lock, flags);
 
+        err = usb_hcd_link_urb_to_ep(&whc->wusbhc.usb_hcd, urb);
+        if (err < 0) {
+                spin_unlock_irqrestore(&whc->lock, flags);
+                return err;
+        }
+
         qset = get_qset(whc, urb, GFP_ATOMIC);
         if (qset == NULL)
                 err = -ENOMEM;
         else
                 err = qset_add_urb(whc, qset, urb, GFP_ATOMIC);
         if (!err) {
-                usb_hcd_link_urb_to_ep(&whc->wusbhc.usb_hcd, urb);
                 if (!qset->in_sw_list)
                         asl_qset_insert_begin(whc, qset);
-        }
+        } else
+                usb_hcd_unlink_urb_from_ep(&whc->wusbhc.usb_hcd, urb);
 
         spin_unlock_irqrestore(&whc->lock, flags);
 
         if (!err)
                 queue_work(whc->workqueue, &whc->async_work);
 
-        return 0;
+        return err;
 }
 
 /**
diff --git a/drivers/usb/host/whci/hcd.c b/drivers/usb/host/whci/hcd.c
index 1569afd6245b..e019a5058ab8 100644
--- a/drivers/usb/host/whci/hcd.c
+++ b/drivers/usb/host/whci/hcd.c
@@ -186,6 +186,28 @@ static void whc_endpoint_disable(struct usb_hcd *usb_hcd,
         }
 }
 
+static void whc_endpoint_reset(struct usb_hcd *usb_hcd,
+                               struct usb_host_endpoint *ep)
+{
+        struct wusbhc *wusbhc = usb_hcd_to_wusbhc(usb_hcd);
+        struct whc *whc = wusbhc_to_whc(wusbhc);
+        struct whc_qset *qset;
+
+        qset = ep->hcpriv;
+        if (qset) {
+                qset->remove = 1;
+
+                if (usb_endpoint_xfer_bulk(&ep->desc)
+                    || usb_endpoint_xfer_control(&ep->desc))
+                        queue_work(whc->workqueue, &whc->async_work);
+                else
+                        queue_work(whc->workqueue, &whc->periodic_work);
+
+                qset_reset(whc, qset);
+        }
+}
+
+
 static struct hc_driver whc_hc_driver = {
         .description = "whci-hcd",
         .product_desc = "Wireless host controller",
@@ -200,6 +222,7 @@ static struct hc_driver whc_hc_driver = {
         .urb_enqueue = whc_urb_enqueue,
         .urb_dequeue = whc_urb_dequeue,
         .endpoint_disable = whc_endpoint_disable,
+        .endpoint_reset = whc_endpoint_reset,
 
         .hub_status_data = wusbhc_rh_status_data,
         .hub_control = wusbhc_rh_control,
diff --git a/drivers/usb/host/whci/pzl.c b/drivers/usb/host/whci/pzl.c
index df8b85f07092..ff4ef9e910d9 100644
--- a/drivers/usb/host/whci/pzl.c
+++ b/drivers/usb/host/whci/pzl.c
@@ -128,7 +128,8 @@ static enum whc_update pzl_process_qset(struct whc *whc, struct whc_qset *qset)
                 process_inactive_qtd(whc, qset, td);
         }
 
-        update |= qset_add_qtds(whc, qset);
+        if (!qset->remove)
+                update |= qset_add_qtds(whc, qset);
 
 done:
         /*
@@ -282,23 +283,29 @@ int pzl_urb_enqueue(struct whc *whc, struct urb *urb, gfp_t mem_flags)
 
         spin_lock_irqsave(&whc->lock, flags);
 
+        err = usb_hcd_link_urb_to_ep(&whc->wusbhc.usb_hcd, urb);
+        if (err < 0) {
+                spin_unlock_irqrestore(&whc->lock, flags);
+                return err;
+        }
+
         qset = get_qset(whc, urb, GFP_ATOMIC);
         if (qset == NULL)
                 err = -ENOMEM;
         else
                 err = qset_add_urb(whc, qset, urb, GFP_ATOMIC);
         if (!err) {
-                usb_hcd_link_urb_to_ep(&whc->wusbhc.usb_hcd, urb);
                 if (!qset->in_sw_list)
                         qset_insert_in_sw_list(whc, qset);
-        }
+        } else
+                usb_hcd_unlink_urb_from_ep(&whc->wusbhc.usb_hcd, urb);
 
         spin_unlock_irqrestore(&whc->lock, flags);
 
         if (!err)
                 queue_work(whc->workqueue, &whc->periodic_work);
 
-        return 0;
+        return err;
 }
 
 /**
@@ -353,7 +360,6 @@ void pzl_qset_delete(struct whc *whc, struct whc_qset *qset)
         qset_delete(whc, qset);
 }
 
-
 /**
  * pzl_init - initialize the periodic zone list
  * @whc: the WHCI host controller
diff --git a/drivers/usb/host/whci/qset.c b/drivers/usb/host/whci/qset.c
index 7be74314ee12..640b38fbd051 100644
--- a/drivers/usb/host/whci/qset.c
+++ b/drivers/usb/host/whci/qset.c
@@ -89,11 +89,16 @@ static void qset_fill_qh(struct whc_qset *qset, struct urb *urb)
                 QH_INFO3_TX_RATE_53_3
                 | QH_INFO3_TX_PWR(0) /* 0 == max power */
                 );
+
+        qset->qh.cur_window = cpu_to_le32((1 << qset->max_burst) - 1);
 }
 
 /**
  * qset_clear - clear fields in a qset so it may be reinserted into a
- * schedule
+ * schedule.
+ *
+ * The sequence number and current window are not cleared (see
+ * qset_reset()).
  */
 void qset_clear(struct whc *whc, struct whc_qset *qset)
 {
@@ -101,9 +106,8 @@ void qset_clear(struct whc *whc, struct whc_qset *qset)
         qset->remove = 0;
 
         qset->qh.link = cpu_to_le32(QH_LINK_NTDS(8) | QH_LINK_T);
-        qset->qh.status = cpu_to_le16(QH_STATUS_ICUR(qset->td_start));
+        qset->qh.status = qset->qh.status & QH_STATUS_SEQ_MASK;
         qset->qh.err_count = 0;
-        qset->qh.cur_window = cpu_to_le32((1 << qset->max_burst) - 1);
         qset->qh.scratch[0] = 0;
         qset->qh.scratch[1] = 0;
         qset->qh.scratch[2] = 0;
@@ -114,6 +118,20 @@ void qset_clear(struct whc *whc, struct whc_qset *qset)
 }
 
 /**
+ * qset_reset - reset endpoint state in a qset.
+ *
+ * Clears the sequence number and current window.  This qset must not
+ * be in the ASL or PZL.
+ */
+void qset_reset(struct whc *whc, struct whc_qset *qset)
+{
+        wait_for_completion(&qset->remove_complete);
+
+        qset->qh.status &= ~QH_STATUS_SEQ_MASK;
+        qset->qh.cur_window = cpu_to_le32((1 << qset->max_burst) - 1);
+}
+
+/**
  * get_qset - get the qset for an async endpoint
  *
  * A new qset is created if one does not already exist.
diff --git a/drivers/usb/host/whci/whcd.h b/drivers/usb/host/whci/whcd.h
index d3543a181dc9..24e94d983c5e 100644
--- a/drivers/usb/host/whci/whcd.h
+++ b/drivers/usb/host/whci/whcd.h
@@ -184,6 +184,7 @@ void qset_free(struct whc *whc, struct whc_qset *qset);
 struct whc_qset *get_qset(struct whc *whc, struct urb *urb, gfp_t mem_flags);
 void qset_delete(struct whc *whc, struct whc_qset *qset);
 void qset_clear(struct whc *whc, struct whc_qset *qset);
+void qset_reset(struct whc *whc, struct whc_qset *qset);
 int qset_add_urb(struct whc *whc, struct whc_qset *qset, struct urb *urb,
                  gfp_t mem_flags);
 void qset_free_std(struct whc *whc, struct whc_std *std);
diff --git a/drivers/usb/host/whci/whci-hc.h b/drivers/usb/host/whci/whci-hc.h
index 51df7e313b38..794dba0d0f0a 100644
--- a/drivers/usb/host/whci/whci-hc.h
+++ b/drivers/usb/host/whci/whci-hc.h
@@ -185,6 +185,7 @@ struct whc_qhead {
 #define QH_STATUS_FLOW_CTRL      (1 << 15)
 #define QH_STATUS_ICUR(i)        ((i) << 5)
 #define QH_STATUS_TO_ICUR(s)     (((s) >> 5) & 0x7)
+#define QH_STATUS_SEQ_MASK       0x1f
 
 /**
  * usb_pipe_to_qh_type - USB core pipe type to QH transfer type
diff --git a/drivers/usb/musb/cppi_dma.c b/drivers/usb/musb/cppi_dma.c
index 569ef0fed0f6..1976e9b41800 100644
--- a/drivers/usb/musb/cppi_dma.c
+++ b/drivers/usb/musb/cppi_dma.c
@@ -579,6 +579,7 @@ cppi_next_tx_segment(struct musb *musb, struct cppi_channel *tx)
          * trigger the "send a ZLP?" confusion.
          */
         rndis = (maxpacket & 0x3f) == 0
+                && length > maxpacket
                 && length < 0xffff
                 && (length % maxpacket) != 0;
 
@@ -1228,27 +1229,7 @@ void cppi_completion(struct musb *musb, u32 rx, u32 tx)
 
                                 hw_ep = tx_ch->hw_ep;
 
-                                /* Peripheral role never repurposes the
-                                 * endpoint, so immediate completion is
-                                 * safe.  Host role waits for the fifo
-                                 * to empty (TXPKTRDY irq) before going
-                                 * to the next queued bulk transfer.
-                                 */
-                                if (is_host_active(cppi->musb)) {
-#if 0
-                                        /* WORKAROUND because we may
-                                         * not always get TXKPTRDY ...
-                                         */
-                                        int     csr;
-
-                                        csr = musb_readw(hw_ep->regs,
-                                                MUSB_TXCSR);
-                                        if (csr & MUSB_TXCSR_TXPKTRDY)
-#endif
-                                                completed = false;
-                                }
-                                if (completed)
-                                        musb_dma_completion(musb, index + 1, 1);
+                                musb_dma_completion(musb, index + 1, 1);
 
                         } else {
                                 /* Bigger transfer than we could fit in
diff --git a/drivers/usb/musb/musb_core.c b/drivers/usb/musb/musb_core.c
index 338cd1611ab3..4000cf6d1e81 100644
--- a/drivers/usb/musb/musb_core.c
+++ b/drivers/usb/musb/musb_core.c
@@ -2170,32 +2170,28 @@ static int musb_suspend(struct platform_device *pdev, pm_message_t message)
         return 0;
 }
 
-static int musb_resume(struct platform_device *pdev)
+static int musb_resume_early(struct platform_device *pdev)
 {
-        unsigned long   flags;
         struct musb     *musb = dev_to_musb(&pdev->dev);
 
         if (!musb->clock)
                 return 0;
 
-        spin_lock_irqsave(&musb->lock, flags);
-
         if (musb->set_clock)
                 musb->set_clock(musb->clock, 1);
         else
                 clk_enable(musb->clock);
 
         /* for static cmos like DaVinci, register values were preserved
-         * unless for some reason the whole soc powered down and we're
-         * not treating that as a whole-system restart (e.g. swsusp)
+         * unless for some reason the whole soc powered down or the USB
+         * module got reset through the PSC (vs just being disabled).
          */
-        spin_unlock_irqrestore(&musb->lock, flags);
         return 0;
 }
 
 #else
 #define musb_suspend    NULL
-#define musb_resume     NULL
+#define musb_resume_early       NULL
 #endif
 
 static struct platform_driver musb_driver = {
@@ -2207,7 +2203,7 @@ static struct platform_driver musb_driver = {
         .remove         = __devexit_p(musb_remove),
         .shutdown       = musb_shutdown,
         .suspend        = musb_suspend,
-        .resume         = musb_resume,
+        .resume_early   = musb_resume_early,
 };
 
 /*-------------------------------------------------------------------------*/
diff --git a/drivers/usb/musb/musb_gadget.c b/drivers/usb/musb/musb_gadget.c
index c7ebd0867fcc..f79440cdfe7e 100644
--- a/drivers/usb/musb/musb_gadget.c
+++ b/drivers/usb/musb/musb_gadget.c
@@ -165,9 +165,15 @@ static void nuke(struct musb_ep *ep, const int status)
         if (is_dma_capable() && ep->dma) {
                 struct dma_controller   *c = ep->musb->dma_controller;
                 int value;
+
                 if (ep->is_in) {
+                        /*
+                         * The programming guide says that we must not clear
+                         * the DMAMODE bit before DMAENAB, so we only
+                         * clear it in the second write...
+                         */
                         musb_writew(epio, MUSB_TXCSR,
-                                        0 | MUSB_TXCSR_FLUSHFIFO);
+                                    MUSB_TXCSR_DMAMODE | MUSB_TXCSR_FLUSHFIFO);
                         musb_writew(epio, MUSB_TXCSR,
                                         0 | MUSB_TXCSR_FLUSHFIFO);
                 } else {
@@ -230,7 +236,7 @@ static inline int max_ep_writesize(struct musb *musb, struct musb_ep *ep)
                   |     IN token(s) are recd from Host.
                   |             -> DMA interrupt on completion
                   |                calls TxAvail.
-                  |                   -> stop DMA, ~DmaEenab,
+                  |                   -> stop DMA, ~DMAENAB,
                   |                   -> set TxPktRdy for last short pkt or zlp
                   |                   -> Complete Request
                   |                   -> Continue next request (call txstate)
@@ -315,9 +321,17 @@ static void txstate(struct musb *musb, struct musb_request *req)
                                         request->dma, request_size);
                         if (use_dma) {
                                 if (musb_ep->dma->desired_mode == 0) {
-                                        /* ASSERT: DMAENAB is clear */
-                                        csr &= ~(MUSB_TXCSR_AUTOSET |
-                                                        MUSB_TXCSR_DMAMODE);
+                                        /*
+                                         * We must not clear the DMAMODE bit
+                                         * before the DMAENAB bit -- and the
+                                         * latter doesn't always get cleared
+                                         * before we get here...
+                                         */
+                                        csr &= ~(MUSB_TXCSR_AUTOSET
+                                                | MUSB_TXCSR_DMAENAB);
+                                        musb_writew(epio, MUSB_TXCSR, csr
+                                                | MUSB_TXCSR_P_WZC_BITS);
+                                        csr &= ~MUSB_TXCSR_DMAMODE;
                                         csr |= (MUSB_TXCSR_DMAENAB |
                                                         MUSB_TXCSR_MODE);
                                         /* against programming guide */
@@ -334,10 +348,7 @@ static void txstate(struct musb *musb, struct musb_request *req)
 
 #elif defined(CONFIG_USB_TI_CPPI_DMA)
                 /* program endpoint CSR first, then setup DMA */
-                csr &= ~(MUSB_TXCSR_AUTOSET
-                                | MUSB_TXCSR_DMAMODE
-                                | MUSB_TXCSR_P_UNDERRUN
-                                | MUSB_TXCSR_TXPKTRDY);
+                csr &= ~(MUSB_TXCSR_P_UNDERRUN | MUSB_TXCSR_TXPKTRDY);
                 csr |= MUSB_TXCSR_MODE | MUSB_TXCSR_DMAENAB;
                 musb_writew(epio, MUSB_TXCSR,
                         (MUSB_TXCSR_P_WZC_BITS & ~MUSB_TXCSR_P_UNDERRUN)
@@ -364,8 +375,8 @@ static void txstate(struct musb *musb, struct musb_request *req)
                 if (!use_dma) {
                         c->channel_release(musb_ep->dma);
                         musb_ep->dma = NULL;
-                        /* ASSERT: DMAENAB clear */
-                        csr &= ~(MUSB_TXCSR_DMAMODE | MUSB_TXCSR_MODE);
+                        csr &= ~MUSB_TXCSR_DMAENAB;
+                        musb_writew(epio, MUSB_TXCSR, csr);
                         /* invariant: prequest->buf is non-null */
                 }
 #elif defined(CONFIG_USB_TUSB_OMAP_DMA)
diff --git a/drivers/usb/musb/musb_host.c b/drivers/usb/musb/musb_host.c
index 499c431a6d62..db1b57415ec7 100644
--- a/drivers/usb/musb/musb_host.c
+++ b/drivers/usb/musb/musb_host.c
@@ -4,6 +4,7 @@
  * Copyright 2005 Mentor Graphics Corporation
  * Copyright (C) 2005-2006 by Texas Instruments
  * Copyright (C) 2006-2007 Nokia Corporation
+ * Copyright (C) 2008-2009 MontaVista Software, Inc. <source@mvista.com>
  *
  * This program is free software; you can redistribute it and/or
  * modify it under the terms of the GNU General Public License
@@ -96,8 +97,8 @@
 
 
 static void musb_ep_program(struct musb *musb, u8 epnum,
-                        struct urb *urb, unsigned int nOut,
-                        u8 *buf, u32 len);
+                        struct urb *urb, int is_out,
+                        u8 *buf, u32 offset, u32 len);
 
 /*
  * Clear TX fifo. Needed to avoid BABBLE errors.
@@ -125,6 +126,29 @@ static void musb_h_tx_flush_fifo(struct musb_hw_ep *ep)
         }
 }
 
+static void musb_h_ep0_flush_fifo(struct musb_hw_ep *ep)
+{
+        void __iomem    *epio = ep->regs;
+        u16             csr;
+        int             retries = 5;
+
+        /* scrub any data left in the fifo */
+        do {
+                csr = musb_readw(epio, MUSB_TXCSR);
+                if (!(csr & (MUSB_CSR0_TXPKTRDY | MUSB_CSR0_RXPKTRDY)))
+                        break;
+                musb_writew(epio, MUSB_TXCSR, MUSB_CSR0_FLUSHFIFO);
+                csr = musb_readw(epio, MUSB_TXCSR);
+                udelay(10);
+        } while (--retries);
+
+        WARN(!retries, "Could not flush host TX%d fifo: csr: %04x\n",
+                        ep->epnum, csr);
+
+        /* and reset for the next transfer */
+        musb_writew(epio, MUSB_TXCSR, 0);
+}
+
 /*
  * Start transmit. Caller is responsible for locking shared resources.
  * musb must be locked.
@@ -145,13 +169,15 @@ static inline void musb_h_tx_start(struct musb_hw_ep *ep)
 
 }
 
-static inline void cppi_host_txdma_start(struct musb_hw_ep *ep)
+static inline void musb_h_tx_dma_start(struct musb_hw_ep *ep)
 {
         u16     txcsr;
 
         /* NOTE: no locks here; caller should lock and select EP */
         txcsr = musb_readw(ep->regs, MUSB_TXCSR);
         txcsr |= MUSB_TXCSR_DMAENAB | MUSB_TXCSR_H_WZC_BITS;
+        if (is_cppi_enabled())
+                txcsr |= MUSB_TXCSR_DMAMODE;
         musb_writew(ep->regs, MUSB_TXCSR, txcsr);
 }
 
@@ -166,9 +192,10 @@ musb_start_urb(struct musb *musb, int is_in, struct musb_qh *qh)
 {
         u16                     frame;
         u32                     len;
-        void                    *buf;
         void __iomem            *mbase =  musb->mregs;
         struct urb              *urb = next_urb(qh);
+        void                    *buf = urb->transfer_buffer;
+        u32                     offset = 0;
         struct musb_hw_ep       *hw_ep = qh->hw_ep;
         unsigned                pipe = urb->pipe;
         u8                      address = usb_pipedevice(pipe);
@@ -191,7 +218,7 @@ musb_start_urb(struct musb *musb, int is_in, struct musb_qh *qh)
         case USB_ENDPOINT_XFER_ISOC:
                 qh->iso_idx = 0;
                 qh->frame = 0;
-                buf = urb->transfer_buffer + urb->iso_frame_desc[0].offset;
+                offset = urb->iso_frame_desc[0].offset;
                 len = urb->iso_frame_desc[0].length;
                 break;
         default:                /* bulk, interrupt */
@@ -209,14 +236,14 @@ musb_start_urb(struct musb *musb, int is_in, struct musb_qh *qh)
                         case USB_ENDPOINT_XFER_ISOC:    s = "-iso"; break;
                         default:                        s = "-intr"; break;
                         }; s; }),
-                        epnum, buf, len);
+                        epnum, buf + offset, len);
 
         /* Configure endpoint */
         if (is_in || hw_ep->is_shared_fifo)
                 hw_ep->in_qh = qh;
         else
                 hw_ep->out_qh = qh;
-        musb_ep_program(musb, epnum, urb, !is_in, buf, len);
+        musb_ep_program(musb, epnum, urb, !is_in, buf, offset, len);
 
         /* transmit may have more work: start it when it is time */
         if (is_in)
@@ -227,7 +254,6 @@ musb_start_urb(struct musb *musb, int is_in, struct musb_qh *qh)
         case USB_ENDPOINT_XFER_ISOC:
         case USB_ENDPOINT_XFER_INT:
                 DBG(3, "check whether there's still time for periodic Tx\n");
-                qh->iso_idx = 0;
                 frame = musb_readw(mbase, MUSB_FRAME);
                 /* FIXME this doesn't implement that scheduling policy ...
                  * or handle framecounter wrapping
@@ -256,7 +282,7 @@ start:
                 if (!hw_ep->tx_channel)
                         musb_h_tx_start(hw_ep);
                 else if (is_cppi_enabled() || tusb_dma_omap())
-                        cppi_host_txdma_start(hw_ep);
+                        musb_h_tx_dma_start(hw_ep);
         }
 }
 
@@ -567,10 +593,17 @@ musb_rx_reinit(struct musb *musb, struct musb_qh *qh, struct musb_hw_ep *ep)
                 csr = musb_readw(ep->regs, MUSB_TXCSR);
                 if (csr & MUSB_TXCSR_MODE) {
                         musb_h_tx_flush_fifo(ep);
+                        csr = musb_readw(ep->regs, MUSB_TXCSR);
                         musb_writew(ep->regs, MUSB_TXCSR,
-                                        MUSB_TXCSR_FRCDATATOG);
+                                    csr | MUSB_TXCSR_FRCDATATOG);
                 }
-                /* clear mode (and everything else) to enable Rx */
+
+                /*
+                 * Clear the MODE bit (and everything else) to enable Rx.
+                 * NOTE: we mustn't clear the DMAMODE bit before DMAENAB.
+                 */
+                if (csr & MUSB_TXCSR_DMAMODE)
+                        musb_writew(ep->regs, MUSB_TXCSR, MUSB_TXCSR_DMAMODE);
                 musb_writew(ep->regs, MUSB_TXCSR, 0);
 
         /* scrub all previous state, clearing toggle */
@@ -601,14 +634,68 @@ musb_rx_reinit(struct musb *musb, struct musb_qh *qh, struct musb_hw_ep *ep)
         ep->rx_reinit = 0;
 }
 
+static bool musb_tx_dma_program(struct dma_controller *dma,
+                struct musb_hw_ep *hw_ep, struct musb_qh *qh,
+                struct urb *urb, u32 offset, u32 length)
+{
+        struct dma_channel      *channel = hw_ep->tx_channel;
+        void __iomem            *epio = hw_ep->regs;
+        u16                     pkt_size = qh->maxpacket;
+        u16                     csr;
+        u8                      mode;
+
+#ifdef  CONFIG_USB_INVENTRA_DMA
+        if (length > channel->max_len)
+                length = channel->max_len;
+
+        csr = musb_readw(epio, MUSB_TXCSR);
+        if (length > pkt_size) {
+                mode = 1;
+                csr |= MUSB_TXCSR_AUTOSET
+                        | MUSB_TXCSR_DMAMODE
+                        | MUSB_TXCSR_DMAENAB;
+        } else {
+                mode = 0;
+                csr &= ~(MUSB_TXCSR_AUTOSET | MUSB_TXCSR_DMAMODE);
+                csr |= MUSB_TXCSR_DMAENAB; /* against programmer's guide */
+        }
+        channel->desired_mode = mode;
+        musb_writew(epio, MUSB_TXCSR, csr);
+#else
+        if (!is_cppi_enabled() && !tusb_dma_omap())
+                return false;
+
+        channel->actual_len = 0;
+
+        /*
+         * TX uses "RNDIS" mode automatically but needs help
+         * to identify the zero-length-final-packet case.
+         */
+        mode = (urb->transfer_flags & URB_ZERO_PACKET) ? 1 : 0;
+#endif
+
+        qh->segsize = length;
+
+        if (!dma->channel_program(channel, pkt_size, mode,
+                        urb->transfer_dma + offset, length)) {
+                dma->channel_release(channel);
+                hw_ep->tx_channel = NULL;
+
+                csr = musb_readw(epio, MUSB_TXCSR);
+                csr &= ~(MUSB_TXCSR_AUTOSET | MUSB_TXCSR_DMAENAB);
+                musb_writew(epio, MUSB_TXCSR, csr | MUSB_TXCSR_H_WZC_BITS);
+                return false;
+        }
+        return true;
+}
 
 /*
  * Program an HDRC endpoint as per the given URB
  * Context: irqs blocked, controller lock held
  */
 static void musb_ep_program(struct musb *musb, u8 epnum,
-                        struct urb *urb, unsigned int is_out,
-                        u8 *buf, u32 len)
+                        struct urb *urb, int is_out,
+                        u8 *buf, u32 offset, u32 len)
 {
         struct dma_controller   *dma_controller;
         struct dma_channel      *dma_channel;
@@ -667,12 +754,17 @@ static void musb_ep_program(struct musb *musb, u8 epnum,
 
                 /* general endpoint setup */
                 if (epnum) {
-                        /* ASSERT:  TXCSR_DMAENAB was already cleared */
-
                         /* flush all old state, set default */
                         musb_h_tx_flush_fifo(hw_ep);
+
+                        /*
+                         * We must not clear the DMAMODE bit before or in
+                         * the same cycle with the DMAENAB bit, so we clear
+                         * the latter first...
+                         */
                         csr &= ~(MUSB_TXCSR_H_NAKTIMEOUT
-                                        | MUSB_TXCSR_DMAMODE
+                                        | MUSB_TXCSR_AUTOSET
+                                        | MUSB_TXCSR_DMAENAB
                                         | MUSB_TXCSR_FRCDATATOG
                                         | MUSB_TXCSR_H_RXSTALL
                                         | MUSB_TXCSR_H_ERROR
@@ -680,24 +772,20 @@ static void musb_ep_program(struct musb *musb, u8 epnum,
                                         );
                         csr |= MUSB_TXCSR_MODE;
 
-                        if (usb_gettoggle(urb->dev,
-                                        qh->epnum, 1))
+                        if (usb_gettoggle(urb->dev, qh->epnum, 1))
                                 csr |= MUSB_TXCSR_H_WR_DATATOGGLE
                                         | MUSB_TXCSR_H_DATATOGGLE;
                         else
                                 csr |= MUSB_TXCSR_CLRDATATOG;
 
-                        /* twice in case of double packet buffering */
                         musb_writew(epio, MUSB_TXCSR, csr);
                         /* REVISIT may need to clear FLUSHFIFO ... */
+                        csr &= ~MUSB_TXCSR_DMAMODE;
                         musb_writew(epio, MUSB_TXCSR, csr);
                         csr = musb_readw(epio, MUSB_TXCSR);
                 } else {
                         /* endpoint 0: just flush */
-                        musb_writew(epio, MUSB_CSR0,
-                                csr | MUSB_CSR0_FLUSHFIFO);
-                        musb_writew(epio, MUSB_CSR0,
-                                csr | MUSB_CSR0_FLUSHFIFO);
+                        musb_h_ep0_flush_fifo(hw_ep);
                 }
 
                 /* target addr and (for multipoint) hub addr/port */
@@ -734,113 +822,14 @@ static void musb_ep_program(struct musb *musb, u8 epnum,
                 else
                         load_count = min((u32) packet_sz, len);
 
-#ifdef CONFIG_USB_INVENTRA_DMA
-                if (dma_channel) {
-
-                        /* clear previous state */
-                        csr = musb_readw(epio, MUSB_TXCSR);
-                        csr &= ~(MUSB_TXCSR_AUTOSET
-                                | MUSB_TXCSR_DMAMODE
-                                | MUSB_TXCSR_DMAENAB);
-                        csr |= MUSB_TXCSR_MODE;
-                        musb_writew(epio, MUSB_TXCSR,
-                                csr | MUSB_TXCSR_MODE);
-
-                        qh->segsize = min(len, dma_channel->max_len);
-
-                        if (qh->segsize <= packet_sz)
-                                dma_channel->desired_mode = 0;
-                        else
-                                dma_channel->desired_mode = 1;
-
-
-                        if (dma_channel->desired_mode == 0) {
-                                csr &= ~(MUSB_TXCSR_AUTOSET
-                                        | MUSB_TXCSR_DMAMODE);
-                                csr |= (MUSB_TXCSR_DMAENAB);
-                                        /* against programming guide */
-                        } else
-                                csr |= (MUSB_TXCSR_AUTOSET
-                                        | MUSB_TXCSR_DMAENAB
-                                        | MUSB_TXCSR_DMAMODE);
-
-                        musb_writew(epio, MUSB_TXCSR, csr);
-
-                        dma_ok = dma_controller->channel_program(
-                                        dma_channel, packet_sz,
-                                        dma_channel->desired_mode,
-                                        urb->transfer_dma,
-                                        qh->segsize);
-                        if (dma_ok) {
-                                load_count = 0;
-                        } else {
-                                dma_controller->channel_release(dma_channel);
-                                if (is_out)
-                                        hw_ep->tx_channel = NULL;
-                                else
-                                        hw_ep->rx_channel = NULL;
-                                dma_channel = NULL;
-                        }
-                }
-#endif
-
-                /* candidate for DMA */
-                if ((is_cppi_enabled() || tusb_dma_omap()) && dma_channel) {
-
-                        /* program endpoint CSRs first, then setup DMA.
-                         * assume CPPI setup succeeds.
-                         * defer enabling dma.
-                         */
-                        csr = musb_readw(epio, MUSB_TXCSR);
-                        csr &= ~(MUSB_TXCSR_AUTOSET
-                                        | MUSB_TXCSR_DMAMODE
-                                        | MUSB_TXCSR_DMAENAB);
-                        csr |= MUSB_TXCSR_MODE;
-                        musb_writew(epio, MUSB_TXCSR,
-                                csr | MUSB_TXCSR_MODE);
-
-                        dma_channel->actual_len = 0L;
-                        qh->segsize = len;
-
-                        /* TX uses "rndis" mode automatically, but needs help
-                         * to identify the zero-length-final-packet case.
-                         */
-                        dma_ok = dma_controller->channel_program(
-                                        dma_channel, packet_sz,
-                                        (urb->transfer_flags
-                                                        & URB_ZERO_PACKET)
-                                                == URB_ZERO_PACKET,
-                                        urb->transfer_dma,
-                                        qh->segsize);
-                        if (dma_ok) {
-                                load_count = 0;
-                        } else {
-                                dma_controller->channel_release(dma_channel);
-                                hw_ep->tx_channel = NULL;
-                                dma_channel = NULL;
-
-                                /* REVISIT there's an error path here that
-                                 * needs handling:  can't do dma, but
-                                 * there's no pio buffer address...
-                                 */
-                        }
-                }
+                if (dma_channel && musb_tx_dma_program(dma_controller,
+                                        hw_ep, qh, urb, offset, len))
+                        load_count = 0;
 
                 if (load_count) {
-                        /* ASSERT:  TXCSR_DMAENAB was already cleared */
-
                         /* PIO to load FIFO */
                         qh->segsize = load_count;
                         musb_write_fifo(hw_ep, load_count, buf);
-                        csr = musb_readw(epio, MUSB_TXCSR);
-                        csr &= ~(MUSB_TXCSR_DMAENAB
-                                | MUSB_TXCSR_DMAMODE
-                                | MUSB_TXCSR_AUTOSET);
-                        /* write CSR */
-                        csr |= MUSB_TXCSR_MODE;
-
-                        if (epnum)
-                                musb_writew(epio, MUSB_TXCSR, csr);
                 }
 
                 /* re-enable interrupt */
@@ -895,7 +884,7 @@ static void musb_ep_program(struct musb *musb, u8 epnum,
                                                 dma_channel, packet_sz,
                                                 !(urb->transfer_flags
                                                         & URB_SHORT_NOT_OK),
-                                                urb->transfer_dma,
+                                                urb->transfer_dma + offset,
                                                 qh->segsize);
                                 if (!dma_ok) {
                                         dma_controller->channel_release(
@@ -1063,11 +1052,7 @@ irqreturn_t musb_h_ep0_irq(struct musb *musb)
                         csr &= ~MUSB_CSR0_H_NAKTIMEOUT;
                         musb_writew(epio, MUSB_CSR0, csr);
                 } else {
-                        csr |= MUSB_CSR0_FLUSHFIFO;
-                        musb_writew(epio, MUSB_CSR0, csr);
-                        musb_writew(epio, MUSB_CSR0, csr);
-                        csr &= ~MUSB_CSR0_H_NAKTIMEOUT;
-                        musb_writew(epio, MUSB_CSR0, csr);
+                        musb_h_ep0_flush_fifo(hw_ep);
                 }
 
                 musb_writeb(epio, MUSB_NAKLIMIT0, 0);
@@ -1081,10 +1066,7 @@ irqreturn_t musb_h_ep0_irq(struct musb *musb)
                  * SHOULD NEVER HAPPEN! */
                 ERR("no URB for end 0\n");
 
-                musb_writew(epio, MUSB_CSR0, MUSB_CSR0_FLUSHFIFO);
-                musb_writew(epio, MUSB_CSR0, MUSB_CSR0_FLUSHFIFO);
-                musb_writew(epio, MUSB_CSR0, 0);
-
+                musb_h_ep0_flush_fifo(hw_ep);
                 goto done;
         }
 
@@ -1145,8 +1127,8 @@ void musb_host_tx(struct musb *musb, u8 epnum)
         int                     pipe;
         bool                    done = false;
         u16                     tx_csr;
-        size_t                  wLength = 0;
-        u8                      *buf = NULL;
+        size_t                  length = 0;
+        size_t                  offset = 0;
         struct urb              *urb;
         struct musb_hw_ep       *hw_ep = musb->endpoints + epnum;
         void __iomem            *epio = hw_ep->regs;
@@ -1164,7 +1146,7 @@ void musb_host_tx(struct musb *musb, u8 epnum)
         /* with CPPI, DMA sometimes triggers "extra" irqs */
         if (!urb) {
                 DBG(4, "extra TX%d ready, csr %04x\n", epnum, tx_csr);
-                goto finish;
+                return;
         }
 
         pipe = urb->pipe;
@@ -1201,7 +1183,7 @@ void musb_host_tx(struct musb *musb, u8 epnum)
                 musb_writew(epio, MUSB_TXCSR,
                                 MUSB_TXCSR_H_WZC_BITS
                                 | MUSB_TXCSR_TXPKTRDY);
-                goto finish;
+                return;
         }
 
         if (status) {
@@ -1233,29 +1215,89 @@ void musb_host_tx(struct musb *musb, u8 epnum)
         /* second cppi case */
         if (dma_channel_status(dma) == MUSB_DMA_STATUS_BUSY) {
                 DBG(4, "extra TX%d ready, csr %04x\n", epnum, tx_csr);
-                goto finish;
+                return;
+        }
+
+        if (is_dma_capable() && dma && !status) {
+                /*
+                 * DMA has completed.  But if we're using DMA mode 1 (multi
+                 * packet DMA), we need a terminal TXPKTRDY interrupt before
+                 * we can consider this transfer completed, lest we trash
+                 * its last packet when writing the next URB's data.  So we
+                 * switch back to mode 0 to get that interrupt; we'll come
+                 * back here once it happens.
+                 */
+                if (tx_csr & MUSB_TXCSR_DMAMODE) {
+                        /*
+                         * We shouldn't clear DMAMODE with DMAENAB set; so
+                         * clear them in a safe order.  That should be OK
+                         * once TXPKTRDY has been set (and I've never seen
+                         * it being 0 at this moment -- DMA interrupt latency
+                         * is significant) but if it hasn't been then we have
+                         * no choice but to stop being polite and ignore the
+                         * programmer's guide... :-)
+                         *
+                         * Note that we must write TXCSR with TXPKTRDY cleared
+                         * in order not to re-trigger the packet send (this bit
+                         * can't be cleared by CPU), and there's another caveat:
+                         * TXPKTRDY may be set shortly and then cleared in the
+                         * double-buffered FIFO mode, so we do an extra TXCSR
+                         * read for debouncing...
+                         */
+                        tx_csr &= musb_readw(epio, MUSB_TXCSR);
+                        if (tx_csr & MUSB_TXCSR_TXPKTRDY) {
+                                tx_csr &= ~(MUSB_TXCSR_DMAENAB |
+                                            MUSB_TXCSR_TXPKTRDY);
+                                musb_writew(epio, MUSB_TXCSR,
+                                            tx_csr | MUSB_TXCSR_H_WZC_BITS);
+                        }
+                        tx_csr &= ~(MUSB_TXCSR_DMAMODE |
+                                    MUSB_TXCSR_TXPKTRDY);
+                        musb_writew(epio, MUSB_TXCSR,
+                                    tx_csr | MUSB_TXCSR_H_WZC_BITS);
+
+                        /*
+                         * There is no guarantee that we'll get an interrupt
+                         * after clearing DMAMODE as we might have done this
+                         * too late (after TXPKTRDY was cleared by controller).
+                         * Re-read TXCSR as we have spoiled its previous value.
+                         */
+                        tx_csr = musb_readw(epio, MUSB_TXCSR);
+                }
 
+                /*
+                 * We may get here from a DMA completion or TXPKTRDY interrupt.
+                 * In any case, we must check the FIFO status here and bail out
+                 * only if the FIFO still has data -- that should prevent the
+                 * "missed" TXPKTRDY interrupts and deal with double-buffered
+                 * FIFO mode too...
+                 */
+                if (tx_csr & (MUSB_TXCSR_FIFONOTEMPTY | MUSB_TXCSR_TXPKTRDY)) {
+                        DBG(2, "DMA complete but packet still in FIFO, "
+                            "CSR %04x\n", tx_csr);
+                        return;
+                }
         }
 
-        /* REVISIT this looks wrong... */
         if (!status || dma || usb_pipeisoc(pipe)) {
                 if (dma)
-                        wLength = dma->actual_len;
+                        length = dma->actual_len;
                 else
-                        wLength = qh->segsize;
-                qh->offset += wLength;
+                        length = qh->segsize;
+                qh->offset += length;
 
                 if (usb_pipeisoc(pipe)) {
                         struct usb_iso_packet_descriptor        *d;
 
                         d = urb->iso_frame_desc + qh->iso_idx;
-                        d->actual_length = qh->segsize;
+                        d->actual_length = length;
+                        d->status = status;
                         if (++qh->iso_idx >= urb->number_of_packets) {
                                 done = true;
                         } else {
                                 d++;
-                                buf = urb->transfer_buffer + d->offset;
-                                wLength = d->length;
+                                offset = d->offset;
+                                length = d->length;
                         }
                 } else if (dma) {
                         done = true;
@@ -1268,10 +1310,8 @@ void musb_host_tx(struct musb *musb, u8 epnum)
                                                 & URB_ZERO_PACKET))
                                 done = true;
                         if (!done) {
-                                buf = urb->transfer_buffer
-                                                + qh->offset;
-                                wLength = urb->transfer_buffer_length
-                                                - qh->offset;
+                                offset = qh->offset;
+                                length = urb->transfer_buffer_length - offset;
                         }
                 }
         }
@@ -1290,28 +1330,31 @@ void musb_host_tx(struct musb *musb, u8 epnum)
                 urb->status = status;
                 urb->actual_length = qh->offset;
                 musb_advance_schedule(musb, urb, hw_ep, USB_DIR_OUT);
+                return;
+        } else  if (usb_pipeisoc(pipe) && dma) {
+                if (musb_tx_dma_program(musb->dma_controller, hw_ep, qh, urb,
+                                offset, length))
+                        return;
+        } else  if (tx_csr & MUSB_TXCSR_DMAENAB) {
+                DBG(1, "not complete, but DMA enabled?\n");
+                return;
+        }
 
-        } else if (!(tx_csr & MUSB_TXCSR_DMAENAB)) {
-                /* WARN_ON(!buf); */
-
-                /* REVISIT:  some docs say that when hw_ep->tx_double_buffered,
-                 * (and presumably, fifo is not half-full) we should write TWO
-                 * packets before updating TXCSR ... other docs disagree ...
-                 */
-                /* PIO:  start next packet in this URB */
-                if (wLength > qh->maxpacket)
-                        wLength = qh->maxpacket;
-                musb_write_fifo(hw_ep, wLength, buf);
-                qh->segsize = wLength;
-
-                musb_ep_select(mbase, epnum);
-                musb_writew(epio, MUSB_TXCSR,
-                                MUSB_TXCSR_H_WZC_BITS | MUSB_TXCSR_TXPKTRDY);
-        } else
-                DBG(1, "not complete, but dma enabled?\n");
+        /*
+         * PIO: start next packet in this URB.
+         *
+         * REVISIT: some docs say that when hw_ep->tx_double_buffered,
+         * (and presumably, FIFO is not half-full) we should write *two*
+         * packets before updating TXCSR; other docs disagree...
+         */
+        if (length > qh->maxpacket)
+                length = qh->maxpacket;
+        musb_write_fifo(hw_ep, length, urb->transfer_buffer + offset);
+        qh->segsize = length;
 
-finish:
-        return;
+        musb_ep_select(mbase, epnum);
+        musb_writew(epio, MUSB_TXCSR,
+                        MUSB_TXCSR_H_WZC_BITS | MUSB_TXCSR_TXPKTRDY);
 }
 
 
@@ -1841,7 +1884,7 @@ static int musb_urb_enqueue(
         unsigned long                   flags;
         struct musb                     *musb = hcd_to_musb(hcd);
         struct usb_host_endpoint        *hep = urb->ep;
-        struct musb_qh                  *qh = hep->hcpriv;
+        struct musb_qh                  *qh;
         struct usb_endpoint_descriptor  *epd = &hep->desc;
         int                             ret;
         unsigned                        type_reg;
@@ -1853,22 +1896,21 @@ static int musb_urb_enqueue(
 
         spin_lock_irqsave(&musb->lock, flags);
         ret = usb_hcd_link_urb_to_ep(hcd, urb);
+        qh = ret ? NULL : hep->hcpriv;
+        if (qh)
+                urb->hcpriv = qh;
         spin_unlock_irqrestore(&musb->lock, flags);
-        if (ret)
-                return ret;
 
         /* DMA mapping was already done, if needed, and this urb is on
-         * hep->urb_list ... so there's little to do unless hep wasn't
-         * yet scheduled onto a live qh.
+         * hep->urb_list now ... so we're done, unless hep wasn't yet
+         * scheduled onto a live qh.
          *
          * REVISIT best to keep hep->hcpriv valid until the endpoint gets
          * disabled, testing for empty qh->ring and avoiding qh setup costs
          * except for the first urb queued after a config change.
          */
-        if (qh) {
-                urb->hcpriv = qh;
-                return 0;
-        }
+        if (qh || ret)
+                return ret;
 
         /* Allocate and initialize qh, minimizing the work done each time
          * hw_ep gets reprogrammed, or with irqs blocked.  Then schedule it.
@@ -2044,7 +2086,7 @@ static int musb_cleanup_urb(struct urb *urb, struct musb_qh *qh, int is_in)
                  * endpoint's irq status here to avoid bogus irqs.
                  * clearing that status is platform-specific...
                  */
-        } else {
+        } else if (ep->epnum) {
                 musb_h_tx_flush_fifo(ep);
                 csr = musb_readw(epio, MUSB_TXCSR);
                 csr &= ~(MUSB_TXCSR_AUTOSET
@@ -2058,6 +2100,8 @@ static int musb_cleanup_urb(struct urb *urb, struct musb_qh *qh, int is_in)
                 musb_writew(epio, MUSB_TXCSR, csr);
                 /* flush cpu writebuffer */
                 csr = musb_readw(epio, MUSB_TXCSR);
+        } else  {
+                musb_h_ep0_flush_fifo(ep);
         }
         if (status == 0)
                 musb_advance_schedule(ep->musb, urb, ep, is_in);
diff --git a/drivers/usb/musb/musbhsdma.c b/drivers/usb/musb/musbhsdma.c
index 8662e9e159c3..5e83f96d6b77 100644
--- a/drivers/usb/musb/musbhsdma.c
+++ b/drivers/usb/musb/musbhsdma.c
@@ -195,30 +195,32 @@ static int dma_channel_abort(struct dma_channel *channel)
         void __iomem *mbase = musb_channel->controller->base;
 
         u8 bchannel = musb_channel->idx;
+        int offset;
         u16 csr;
 
         if (channel->status == MUSB_DMA_STATUS_BUSY) {
                 if (musb_channel->transmit) {
-
-                        csr = musb_readw(mbase,
-                                MUSB_EP_OFFSET(musb_channel->epnum,
-                                                MUSB_TXCSR));
-                        csr &= ~(MUSB_TXCSR_AUTOSET |
-                                 MUSB_TXCSR_DMAENAB |
-                                 MUSB_TXCSR_DMAMODE);
-                        musb_writew(mbase,
-                                MUSB_EP_OFFSET(musb_channel->epnum, MUSB_TXCSR),
-                                csr);
+                        offset = MUSB_EP_OFFSET(musb_channel->epnum,
+                                                MUSB_TXCSR);
+
+                        /*
+                         * The programming guide says that we must clear
+                         * the DMAENAB bit before the DMAMODE bit...
+                         */
+                        csr = musb_readw(mbase, offset);
+                        csr &= ~(MUSB_TXCSR_AUTOSET | MUSB_TXCSR_DMAENAB);
+                        musb_writew(mbase, offset, csr);
+                        csr &= ~MUSB_TXCSR_DMAMODE;
+                        musb_writew(mbase, offset, csr);
                 } else {
-                        csr = musb_readw(mbase,
-                                MUSB_EP_OFFSET(musb_channel->epnum,
-                                                MUSB_RXCSR));
+                        offset = MUSB_EP_OFFSET(musb_channel->epnum,
+                                                MUSB_RXCSR);
+
+                        csr = musb_readw(mbase, offset);
                         csr &= ~(MUSB_RXCSR_AUTOCLEAR |
                                  MUSB_RXCSR_DMAENAB |
                                  MUSB_RXCSR_DMAMODE);
-                        musb_writew(mbase,
-                                MUSB_EP_OFFSET(musb_channel->epnum, MUSB_RXCSR),
-                                csr);
+                        musb_writew(mbase, offset, csr);
                 }
 
                 musb_writew(mbase,
@@ -296,20 +298,28 @@ static irqreturn_t dma_controller_irq(int irq, void *private_data)
                                         && ((channel->desired_mode == 0)
                                             || (channel->actual_len &
                                             (musb_channel->max_packet_sz - 1)))
-                                         ) {
+                                    ) {
+                                        u8  epnum  = musb_channel->epnum;
+                                        int offset = MUSB_EP_OFFSET(epnum,
+                                                                    MUSB_TXCSR);
+                                        u16 txcsr;
+
+                                        /*
+                                         * The programming guide says that we
+                                         * must clear DMAENAB before DMAMODE.
+                                         */
+                                        musb_ep_select(mbase, epnum);
+                                        txcsr = musb_readw(mbase, offset);
+                                        txcsr &= ~(MUSB_TXCSR_DMAENAB
+                                                        | MUSB_TXCSR_AUTOSET);
+                                        musb_writew(mbase, offset, txcsr);
                                         /* Send out the packet */
-                                        musb_ep_select(mbase,
-                                                musb_channel->epnum);
-                                        musb_writew(mbase, MUSB_EP_OFFSET(
-                                                        musb_channel->epnum,
-                                                        MUSB_TXCSR),
-                                                MUSB_TXCSR_TXPKTRDY);
-                                } else {
-                                        musb_dma_completion(
-                                                musb,
-                                                musb_channel->epnum,
-                                                musb_channel->transmit);
+                                        txcsr &= ~MUSB_TXCSR_DMAMODE;
+                                        txcsr |=  MUSB_TXCSR_TXPKTRDY;
+                                        musb_writew(mbase, offset, txcsr);
                                 }
+                                musb_dma_completion(musb, musb_channel->epnum,
+                                                    musb_channel->transmit);
                         }
                 }
         }
diff --git a/drivers/usb/musb/omap2430.c b/drivers/usb/musb/omap2430.c
index 901dffdf23b1..60924ce08493 100644
--- a/drivers/usb/musb/omap2430.c
+++ b/drivers/usb/musb/omap2430.c
@@ -3,7 +3,6 @@
  * Some code has been taken from tusb6010.c
  * Copyrights for that are attributable to:
  * Copyright (C) 2006 Nokia Corporation
- * Jarkko Nikula <jarkko.nikula@nokia.com>
  * Tony Lindgren <tony@atomide.com>
  *
  * This file is part of the Inventra Controller Driver for Linux.
diff --git a/drivers/usb/musb/tusb6010.c b/drivers/usb/musb/tusb6010.c
index 9e20fd070d71..4ac1477d3569 100644
--- a/drivers/usb/musb/tusb6010.c
+++ b/drivers/usb/musb/tusb6010.c
@@ -2,7 +2,6 @@
  * TUSB6010 USB 2.0 OTG Dual Role controller
  *
  * Copyright (C) 2006 Nokia Corporation
- * Jarkko Nikula <jarkko.nikula@nokia.com>
  * Tony Lindgren <tony@atomide.com>
  *
  * This program is free software; you can redistribute it and/or modify
diff --git a/drivers/usb/musb/tusb6010.h b/drivers/usb/musb/tusb6010.h
index ab8c96286ce6..35c933a5d991 100644
--- a/drivers/usb/musb/tusb6010.h
+++ b/drivers/usb/musb/tusb6010.h
@@ -2,7 +2,6 @@
  * Definitions for TUSB6010 USB 2.0 OTG Dual Role controller
  *
  * Copyright (C) 2006 Nokia Corporation
- * Jarkko Nikula <jarkko.nikula@nokia.com>
  * Tony Lindgren <tony@atomide.com>
  *
  * This program is free software; you can redistribute it and/or modify
diff --git a/drivers/usb/otg/nop-usb-xceiv.c b/drivers/usb/otg/nop-usb-xceiv.c
index 4b933f646f2e..c567168f89af 100644
--- a/drivers/usb/otg/nop-usb-xceiv.c
+++ b/drivers/usb/otg/nop-usb-xceiv.c
@@ -36,14 +36,14 @@ struct nop_usb_xceiv {
         struct device           *dev;
 };
 
-static u64 nop_xceiv_dmamask = DMA_32BIT_MASK;
+static u64 nop_xceiv_dmamask = DMA_BIT_MASK(32);
 
 static struct platform_device nop_xceiv_device = {
         .name           = "nop_usb_xceiv",
         .id             = -1,
         .dev = {
                 .dma_mask               = &nop_xceiv_dmamask,
-                .coherent_dma_mask      = DMA_32BIT_MASK,
+                .coherent_dma_mask      = DMA_BIT_MASK(32),
                 .platform_data          = NULL,
         },
 };
diff --git a/drivers/usb/otg/otg.c b/drivers/usb/otg/otg.c
index ff318fae7d4d..0a43a7db750f 100644
--- a/drivers/usb/otg/otg.c
+++ b/drivers/usb/otg/otg.c
@@ -43,7 +43,8 @@ EXPORT_SYMBOL(otg_get_transceiver);
  */
 void otg_put_transceiver(struct otg_transceiver *x)
 {
-        put_device(x->dev);
+        if (x)
+                put_device(x->dev);
 }
 EXPORT_SYMBOL(otg_put_transceiver);
 
diff --git a/drivers/usb/serial/cyberjack.c b/drivers/usb/serial/cyberjack.c
index 858bdd038fbc..dd501bb63ed6 100644
--- a/drivers/usb/serial/cyberjack.c
+++ b/drivers/usb/serial/cyberjack.c
@@ -175,13 +175,6 @@ static int  cyberjack_open(struct tty_struct *tty,
         dbg("%s - usb_clear_halt", __func__);
         usb_clear_halt(port->serial->dev, port->write_urb->pipe);
 
-        /* force low_latency on so that our tty_push actually forces
-         * the data through, otherwise it is scheduled, and with high
-         * data rates (like with OHCI) data can get lost.
-         */
-        if (tty)
-                tty->low_latency = 1;
-
         priv = usb_get_serial_port_data(port);
         spin_lock_irqsave(&priv->lock, flags);
         priv->rdtodo = 0;
diff --git a/drivers/usb/serial/cypress_m8.c b/drivers/usb/serial/cypress_m8.c
index eae4740d448c..e568710b263f 100644
--- a/drivers/usb/serial/cypress_m8.c
+++ b/drivers/usb/serial/cypress_m8.c
@@ -656,10 +656,6 @@ static int cypress_open(struct tty_struct *tty,
         priv->rx_flags = 0;
         spin_unlock_irqrestore(&priv->lock, flags);
 
-        /* setting to zero could cause data loss */
-        if (tty)
-                tty->low_latency = 1;
-
         /* raise both lines and set termios */
         spin_lock_irqsave(&priv->lock, flags);
         priv->line_control = CONTROL_DTR | CONTROL_RTS;
diff --git a/drivers/usb/serial/empeg.c b/drivers/usb/serial/empeg.c
index 8a69cce40b6d..c709ec474a80 100644
--- a/drivers/usb/serial/empeg.c
+++ b/drivers/usb/serial/empeg.c
@@ -478,12 +478,6 @@ static void empeg_set_termios(struct tty_struct *tty,
         termios->c_cflag
                 |= CS8;         /* character size 8 bits */
 
-        /*
-         * Force low_latency on; otherwise the pushes are scheduled;
-         * this is bad as it opens up the possibility of dropping bytes
-         * on the floor.  We don't want to drop bytes on the floor. :)
-         */
-        tty->low_latency = 1;
         tty_encode_baud_rate(tty, 115200, 115200);
 }
 
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index dcc87aaa8628..8100f1d25904 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -668,6 +668,7 @@ static struct usb_device_id id_table_combined [] = {
         { USB_DEVICE(DE_VID, WHT_PID) },
         { USB_DEVICE(ADI_VID, ADI_GNICE_PID),
                 .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
+        { USB_DEVICE(JETI_VID, JETI_SPC1201_PID) },
         { },                                    /* Optional parameter entry */
         { }                                     /* Terminating entry */
 };
diff --git a/drivers/usb/serial/ftdi_sio.h b/drivers/usb/serial/ftdi_sio.h
index daaf63db0b50..c09f658a448b 100644
--- a/drivers/usb/serial/ftdi_sio.h
+++ b/drivers/usb/serial/ftdi_sio.h
@@ -913,6 +913,13 @@
 #define ADI_GNICE_PID           0xF000
 
 /*
+ * JETI SPECTROMETER SPECBOS 1201
+ * http://www.jeti.com/products/sys/scb/scb1201.php
+ */
+#define JETI_VID                0x0c6c
+#define JETI_SPC1201_PID        0x04b2
+
+/*
  *   BmRequestType:  1100 0000b
  *   bRequest:       FTDI_E2_READ
  *   wValue:         0
diff --git a/drivers/usb/serial/garmin_gps.c b/drivers/usb/serial/garmin_gps.c
index a26a0e2cdb4a..586d30ff450b 100644
--- a/drivers/usb/serial/garmin_gps.c
+++ b/drivers/usb/serial/garmin_gps.c
@@ -973,14 +973,6 @@ static int garmin_open(struct tty_struct *tty,
 
         dbg("%s - port %d", __func__, port->number);
 
-        /*
-         * Force low_latency on so that our tty_push actually forces the data
-         * through, otherwise it is scheduled, and with high data rates (like
-         * with OHCI) data can get lost.
-         */
-        if (tty)
-                tty->low_latency = 1;
-
         spin_lock_irqsave(&garmin_data_p->lock, flags);
         garmin_data_p->mode  = initial_mode;
         garmin_data_p->count = 0;
diff --git a/drivers/usb/serial/generic.c b/drivers/usb/serial/generic.c
index 9d57cace3731..4cec9906ccf3 100644
--- a/drivers/usb/serial/generic.c
+++ b/drivers/usb/serial/generic.c
@@ -122,12 +122,6 @@ int usb_serial_generic_open(struct tty_struct *tty,
 
         dbg("%s - port %d", __func__, port->number);
 
-        /* force low_latency on so that our tty_push actually forces the data
-           through, otherwise it is scheduled, and with high data rates (like
-           with OHCI) data can get lost. */
-        if (tty)
-                tty->low_latency = 1;
-
         /* clear the throttle flags */
         spin_lock_irqsave(&port->lock, flags);
         port->throttled = 0;
diff --git a/drivers/usb/serial/io_edgeport.c b/drivers/usb/serial/io_edgeport.c
index e85c8c0d1ad9..fb4a73d090f6 100644
--- a/drivers/usb/serial/io_edgeport.c
+++ b/drivers/usb/serial/io_edgeport.c
@@ -193,8 +193,6 @@ static const struct divisor_table_entry divisor_table[] = {
 /* local variables */
 static int debug;
 
-static int low_latency = 1;     /* tty low latency flag, on by default */
-
 static atomic_t CmdUrbs;        /* Number of outstanding Command Write Urbs */
 
 
@@ -867,9 +865,6 @@ static int edge_open(struct tty_struct *tty,
         if (edge_port == NULL)
                 return -ENODEV;
 
-        if (tty)
-                tty->low_latency = low_latency;
-
         /* see if we've set up our endpoint info yet (can't set it up
            in edge_startup as the structures were not set up at that time.) */
         serial = port->serial;
@@ -3299,6 +3294,3 @@ MODULE_FIRMWARE("edgeport/down2.fw");
 
 module_param(debug, bool, S_IRUGO | S_IWUSR);
 MODULE_PARM_DESC(debug, "Debug enabled or not");
-
-module_param(low_latency, bool, S_IRUGO | S_IWUSR);
-MODULE_PARM_DESC(low_latency, "Low latency enabled or not");
diff --git a/drivers/usb/serial/io_ti.c b/drivers/usb/serial/io_ti.c
index c3cdd00ddc41..513b25e044c1 100644
--- a/drivers/usb/serial/io_ti.c
+++ b/drivers/usb/serial/io_ti.c
@@ -76,7 +76,6 @@ struct edgeport_uart_buf_desc {
 #define EDGE_READ_URB_STOPPING  1
 #define EDGE_READ_URB_STOPPED   2
 
-#define EDGE_LOW_LATENCY        1
 #define EDGE_CLOSING_WAIT       4000    /* in .01 sec */
 
 #define EDGE_OUT_BUF_SIZE       1024
@@ -232,7 +231,6 @@ static unsigned short OperationalBuildNumber;
 
 static int debug;
 
-static int low_latency = EDGE_LOW_LATENCY;
 static int closing_wait = EDGE_CLOSING_WAIT;
 static int ignore_cpu_rev;
 static int default_uart_mode;           /* RS232 */
@@ -1850,9 +1848,6 @@ static int edge_open(struct tty_struct *tty,
         if (edge_port == NULL)
                 return -ENODEV;
 
-        if (tty)
-                tty->low_latency = low_latency;
-
         port_number = port->number - port->serial->minor;
         switch (port_number) {
         case 0:
@@ -3008,9 +3003,6 @@ MODULE_FIRMWARE("edgeport/down3.bin");
 module_param(debug, bool, S_IRUGO | S_IWUSR);
 MODULE_PARM_DESC(debug, "Debug enabled or not");
 
-module_param(low_latency, bool, S_IRUGO | S_IWUSR);
-MODULE_PARM_DESC(low_latency, "Low latency enabled or not");
-
 module_param(closing_wait, int, S_IRUGO | S_IWUSR);
 MODULE_PARM_DESC(closing_wait, "Maximum wait for data to drain, in .01 secs");
 
diff --git a/drivers/usb/serial/ipaq.c b/drivers/usb/serial/ipaq.c
index ef92095b0732..cd62825a9ac3 100644
--- a/drivers/usb/serial/ipaq.c
+++ b/drivers/usb/serial/ipaq.c
@@ -631,13 +631,7 @@ static int ipaq_open(struct tty_struct *tty,
                 priv->free_len += PACKET_SIZE;
         }
 
-        /*
-         * Force low latency on. This will immediately push data to the line
-         * discipline instead of queueing.
-         */
-
         if (tty) {
-                tty->low_latency = 1;
                 /* FIXME: These two are bogus */
                 tty->raw = 1;
                 tty->real_raw = 1;
diff --git a/drivers/usb/serial/ipw.c b/drivers/usb/serial/ipw.c
index f530032ed93d..da2a2b46644a 100644
--- a/drivers/usb/serial/ipw.c
+++ b/drivers/usb/serial/ipw.c
@@ -207,9 +207,6 @@ static int ipw_open(struct tty_struct *tty,
         if (!buf_flow_init)
                 return -ENOMEM;
 
-        if (tty)
-                tty->low_latency = 1;
-
         /* --1: Tell the modem to initialize (we think) From sniffs this is
          *      always the first thing that gets sent to the modem during
          *      opening of the device */
diff --git a/drivers/usb/serial/iuu_phoenix.c b/drivers/usb/serial/iuu_phoenix.c
index 2314c6ae4fc2..4473d442b2aa 100644
--- a/drivers/usb/serial/iuu_phoenix.c
+++ b/drivers/usb/serial/iuu_phoenix.c
@@ -1051,7 +1051,6 @@ static int iuu_open(struct tty_struct *tty,
                 tty->termios->c_oflag = 0;
                 tty->termios->c_iflag = 0;
                 priv->termios_initialized = 1;
-                tty->low_latency = 1;
                 priv->poll = 0;
          }
         spin_unlock_irqrestore(&priv->lock, flags);
diff --git a/drivers/usb/serial/kobil_sct.c b/drivers/usb/serial/kobil_sct.c
index 6286baad9392..c148544953b3 100644
--- a/drivers/usb/serial/kobil_sct.c
+++ b/drivers/usb/serial/kobil_sct.c
@@ -231,13 +231,7 @@ static int kobil_open(struct tty_struct *tty,
         /* someone sets the dev to 0 if the close method has been called */
         port->interrupt_in_urb->dev = port->serial->dev;
 
-
-        /* force low_latency on so that our tty_push actually forces
-         * the data through, otherwise it is scheduled, and with high
-         * data rates (like with OHCI) data can get lost.
-         */
         if (tty) {
-                tty->low_latency = 1;
 
                 /* Default to echo off and other sane device settings */
                 tty->termios->c_lflag = 0;
diff --git a/drivers/usb/serial/mos7720.c b/drivers/usb/serial/mos7720.c
index e772cc0a97fd..24e3b5d4b4d4 100644
--- a/drivers/usb/serial/mos7720.c
+++ b/drivers/usb/serial/mos7720.c
@@ -446,13 +446,6 @@ static int mos7720_open(struct tty_struct *tty,
         data = 0x0c;
         send_mos_cmd(serial, MOS_WRITE, port_number, 0x01, &data);
 
-        /* force low_latency on so that our tty_push actually forces *
-         * the data through,otherwise it is scheduled, and with      *
-         * high data rates (like with OHCI) data can get lost.       */
-
-        if (tty)
-                tty->low_latency = 1;
-
         /* see if we've set up our endpoint info yet   *
          * (can't set it up in mos7720_startup as the  *
          * structures were not set up at that time.)   */
diff --git a/drivers/usb/serial/mos7840.c b/drivers/usb/serial/mos7840.c
index 2c20e88a91b3..84fb1dcd30dc 100644
--- a/drivers/usb/serial/mos7840.c
+++ b/drivers/usb/serial/mos7840.c
@@ -38,7 +38,7 @@
 /*
  * Version Information
  */
-#define DRIVER_VERSION "1.3.1"
+#define DRIVER_VERSION "1.3.2"
 #define DRIVER_DESC "Moschip 7840/7820 USB Serial Driver"
 
 /*
@@ -123,6 +123,11 @@
 #define BANDB_DEVICE_ID_USOPTL4_4       0xAC44
 #define BANDB_DEVICE_ID_USOPTL4_2       0xAC42
 
+/* This driver also supports the ATEN UC2324 device since it is mos7840 based
+ *  - if I knew the device id it would also support the ATEN UC2322 */
+#define USB_VENDOR_ID_ATENINTL          0x0557
+#define ATENINTL_DEVICE_ID_UC2324       0x2011
+
 /* Interrupt Routine Defines    */
 
 #define SERIAL_IIR_RLS      0x06
@@ -170,6 +175,7 @@ static struct usb_device_id moschip_port_id_table[] = {
         {USB_DEVICE(USB_VENDOR_ID_MOSCHIP, MOSCHIP_DEVICE_ID_7820)},
         {USB_DEVICE(USB_VENDOR_ID_BANDB, BANDB_DEVICE_ID_USOPTL4_4)},
         {USB_DEVICE(USB_VENDOR_ID_BANDB, BANDB_DEVICE_ID_USOPTL4_2)},
+        {USB_DEVICE(USB_VENDOR_ID_ATENINTL, ATENINTL_DEVICE_ID_UC2324)},
         {}                      /* terminating entry */
 };
 
@@ -178,6 +184,7 @@ static __devinitdata struct usb_device_id moschip_id_table_combined[] = {
         {USB_DEVICE(USB_VENDOR_ID_MOSCHIP, MOSCHIP_DEVICE_ID_7820)},
         {USB_DEVICE(USB_VENDOR_ID_BANDB, BANDB_DEVICE_ID_USOPTL4_4)},
         {USB_DEVICE(USB_VENDOR_ID_BANDB, BANDB_DEVICE_ID_USOPTL4_2)},
+        {USB_DEVICE(USB_VENDOR_ID_ATENINTL, ATENINTL_DEVICE_ID_UC2324)},
         {}                      /* terminating entry */
 };
 
@@ -1000,12 +1007,6 @@ static int mos7840_open(struct tty_struct *tty,
         status = mos7840_set_reg_sync(port, mos7840_port->ControlRegOffset,
                                                                         Data);
 
-        /* force low_latency on so that our tty_push actually forces *
-         * the data through,otherwise it is scheduled, and with      *
-         * high data rates (like with OHCI) data can get lost.       */
-        if (tty)
-                tty->low_latency = 1;
-
         /* Check to see if we've set up our endpoint info yet    *
          * (can't set it up in mos7840_startup as the structures *
          * were not set up at that time.)                        */
@@ -2477,9 +2478,14 @@ static int mos7840_startup(struct usb_serial *serial)
                 mos7840_set_port_private(serial->port[i], mos7840_port);
                 spin_lock_init(&mos7840_port->pool_lock);
 
-                mos7840_port->port_num = ((serial->port[i]->number -
-                                           (serial->port[i]->serial->minor)) +
-                                          1);
+                /* minor is not initialised until later by
+                 * usb-serial.c:get_free_serial() and cannot therefore be used
+                 * to index device instances */
+                mos7840_port->port_num = i + 1;
+                dbg ("serial->port[i]->number = %d", serial->port[i]->number);
+                dbg ("serial->port[i]->serial->minor = %d", serial->port[i]->serial->minor);
+                dbg ("mos7840_port->port_num = %d", mos7840_port->port_num);
+                dbg ("serial->minor = %d", serial->minor);
 
                 if (mos7840_port->port_num == 1) {
                         mos7840_port->SpRegOffset = 0x0;
@@ -2690,13 +2696,16 @@ static void mos7840_shutdown(struct usb_serial *serial)
 
         for (i = 0; i < serial->num_ports; ++i) {
                 mos7840_port = mos7840_get_port_private(serial->port[i]);
-                spin_lock_irqsave(&mos7840_port->pool_lock, flags);
-                mos7840_port->zombie = 1;
-                spin_unlock_irqrestore(&mos7840_port->pool_lock, flags);
-                usb_kill_urb(mos7840_port->control_urb);
-                kfree(mos7840_port->ctrl_buf);
-                kfree(mos7840_port->dr);
-                kfree(mos7840_port);
+                dbg ("mos7840_port %d = %p", i, mos7840_port);
+                if (mos7840_port) {
+                        spin_lock_irqsave(&mos7840_port->pool_lock, flags);
+                        mos7840_port->zombie = 1;
+                        spin_unlock_irqrestore(&mos7840_port->pool_lock, flags);
+                        usb_kill_urb(mos7840_port->control_urb);
+                        kfree(mos7840_port->ctrl_buf);
+                        kfree(mos7840_port->dr);
+                        kfree(mos7840_port);
+                }
                 mos7840_set_port_private(serial->port[i], NULL);
         }
 
diff --git a/drivers/usb/serial/moto_modem.c b/drivers/usb/serial/moto_modem.c
index 2e8e05462ef7..b66b71ccd12b 100644
--- a/drivers/usb/serial/moto_modem.c
+++ b/drivers/usb/serial/moto_modem.c
@@ -25,6 +25,7 @@ static struct usb_device_id id_table [] = {
         { USB_DEVICE(0x05c6, 0x3197) }, /* unknown Motorola phone */
         { USB_DEVICE(0x0c44, 0x0022) }, /* unknown Mororola phone */
         { USB_DEVICE(0x22b8, 0x2a64) }, /* Motorola KRZR K1m */
+        { USB_DEVICE(0x22b8, 0x2c64) }, /* Motorola V950 phone */
         { },
 };
 MODULE_DEVICE_TABLE(usb, id_table);
diff --git a/drivers/usb/serial/opticon.c b/drivers/usb/serial/opticon.c
index 839583dc8b6a..b500ad10b758 100644
--- a/drivers/usb/serial/opticon.c
+++ b/drivers/usb/serial/opticon.c
@@ -159,14 +159,6 @@ static int opticon_open(struct tty_struct *tty, struct usb_serial_port *port,
         priv->port = port;
         spin_unlock_irqrestore(&priv->lock, flags);
 
-        /*
-         * Force low_latency on so that our tty_push actually forces the data
-         * through, otherwise it is scheduled, and with high data rates (like
-         * with OHCI) data can get lost.
-         */
-        if (tty)
-                tty->low_latency = 1;
-
         /* Start reading from the device */
         usb_fill_bulk_urb(priv->bulk_read_urb, priv->udev,
                           usb_rcvbulkpipe(priv->udev,
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index d560c0b54e6e..7817b82889ca 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -300,6 +300,10 @@ static int  option_resume(struct usb_serial *serial);
 #define BENQ_VENDOR_ID                          0x04a5
 #define BENQ_PRODUCT_H10                        0x4068
 
+#define DLINK_VENDOR_ID                         0x1186
+#define DLINK_PRODUCT_DWM_652                   0x3e04
+
+
 static struct usb_device_id option_ids[] = {
         { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_COLT) },
         { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_RICOLA) },
@@ -516,6 +520,7 @@ static struct usb_device_id option_ids[] = {
         { USB_DEVICE(ZTE_VENDOR_ID, ZTE_PRODUCT_MF628) },
         { USB_DEVICE(ZTE_VENDOR_ID, ZTE_PRODUCT_CDMA_TECH) },
         { USB_DEVICE(BENQ_VENDOR_ID, BENQ_PRODUCT_H10) },
+        { USB_DEVICE(DLINK_VENDOR_ID, DLINK_PRODUCT_DWM_652) },
         { USB_DEVICE(0x1da5, 0x4515) }, /* BenQ H20 */
         { } /* Terminating entry */
 };
@@ -931,9 +936,6 @@ static int option_open(struct tty_struct *tty,
                                 usb_pipeout(urb->pipe), 0); */
         }
 
-        if (tty)
-                tty->low_latency = 1;
-
         option_send_setup(tty, port);
 
         return 0;
diff --git a/drivers/usb/serial/qcserial.c b/drivers/usb/serial/qcserial.c
index e6d6b0c17fd9..7528b8d57f1c 100644
--- a/drivers/usb/serial/qcserial.c
+++ b/drivers/usb/serial/qcserial.c
@@ -26,6 +26,27 @@ static struct usb_device_id id_table[] = {
         {USB_DEVICE(0x05c6, 0x9212)},   /* Acer Gobi Modem Device */
         {USB_DEVICE(0x03f0, 0x1f1d)},   /* HP un2400 Gobi Modem Device */
         {USB_DEVICE(0x03f0, 0x201d)},   /* HP un2400 Gobi QDL Device */
+        {USB_DEVICE(0x04da, 0x250d)},   /* Panasonic Gobi Modem device */
+        {USB_DEVICE(0x04da, 0x250c)},   /* Panasonic Gobi QDL device */
+        {USB_DEVICE(0x413c, 0x8172)},   /* Dell Gobi Modem device */
+        {USB_DEVICE(0x413c, 0x8171)},   /* Dell Gobi QDL device */
+        {USB_DEVICE(0x1410, 0xa001)},   /* Novatel Gobi Modem device */
+        {USB_DEVICE(0x1410, 0xa008)},   /* Novatel Gobi QDL device */
+        {USB_DEVICE(0x0b05, 0x1776)},   /* Asus Gobi Modem device */
+        {USB_DEVICE(0x0b05, 0x1774)},   /* Asus Gobi QDL device */
+        {USB_DEVICE(0x19d2, 0xfff3)},   /* ONDA Gobi Modem device */
+        {USB_DEVICE(0x19d2, 0xfff2)},   /* ONDA Gobi QDL device */
+        {USB_DEVICE(0x1557, 0x0a80)},   /* OQO Gobi QDL device */
+        {USB_DEVICE(0x05c6, 0x9001)},   /* Generic Gobi Modem device */
+        {USB_DEVICE(0x05c6, 0x9002)},   /* Generic Gobi Modem device */
+        {USB_DEVICE(0x05c6, 0x9202)},   /* Generic Gobi Modem device */
+        {USB_DEVICE(0x05c6, 0x9203)},   /* Generic Gobi Modem device */
+        {USB_DEVICE(0x05c6, 0x9222)},   /* Generic Gobi Modem device */
+        {USB_DEVICE(0x05c6, 0x9008)},   /* Generic Gobi QDL device */
+        {USB_DEVICE(0x05c6, 0x9201)},   /* Generic Gobi QDL device */
+        {USB_DEVICE(0x05c6, 0x9221)},   /* Generic Gobi QDL device */
+        {USB_DEVICE(0x05c6, 0x9231)},   /* Generic Gobi QDL device */
+        {USB_DEVICE(0x1f45, 0x0001)},   /* Unknown Gobi QDL device */
         { }                             /* Terminating entry */
 };
 MODULE_DEVICE_TABLE(usb, id_table);
diff --git a/drivers/usb/serial/sierra.c b/drivers/usb/serial/sierra.c
index d9bf9a5c20ec..913225c61610 100644
--- a/drivers/usb/serial/sierra.c
+++ b/drivers/usb/serial/sierra.c
@@ -14,7 +14,7 @@
   Whom based his on the Keyspan driver by Hugh Blemings <hugh@blemings.org>
 */
 
-#define DRIVER_VERSION "v.1.3.2"
+#define DRIVER_VERSION "v.1.3.3"
 #define DRIVER_AUTHOR "Kevin Lloyd <klloyd@sierrawireless.com>"
 #define DRIVER_DESC "USB Driver for Sierra Wireless USB modems"
 
@@ -259,9 +259,21 @@ static int sierra_send_setup(struct tty_struct *tty,
                         val |= 0x02;
 
                 /* If composite device then properly report interface */
-                if (serial->num_ports == 1)
+                if (serial->num_ports == 1) {
                         interface = sierra_calc_interface(serial);
 
+                        /* Control message is sent only to interfaces with
+                         * interrupt_in endpoints
+                         */
+                        if (port->interrupt_in_urb) {
+                                /* send control message */
+                                return usb_control_msg(serial->dev,
+                                        usb_rcvctrlpipe(serial->dev, 0),
+                                        0x22, 0x21, val, interface,
+                                        NULL, 0, USB_CTRL_SET_TIMEOUT);
+                        }
+                }
+
                 /* Otherwise the need to do non-composite mapping */
                 else {
                         if (port->bulk_out_endpointAddress == 2)
@@ -270,12 +282,13 @@ static int sierra_send_setup(struct tty_struct *tty,
                                 interface = 1;
                         else if (port->bulk_out_endpointAddress == 5)
                                 interface = 2;
-                }
 
-                return usb_control_msg(serial->dev,
+                        return usb_control_msg(serial->dev,
                                 usb_rcvctrlpipe(serial->dev, 0),
                                 0x22, 0x21, val, interface,
                                 NULL, 0, USB_CTRL_SET_TIMEOUT);
+
+                }
         }
 
         return 0;
@@ -585,9 +598,6 @@ static int sierra_open(struct tty_struct *tty,
                 }
         }
 
-        if (tty)
-                tty->low_latency = 1;
-
         sierra_send_setup(tty, port);
 
         /* start up the interrupt endpoint if we have one */
diff --git a/drivers/usb/serial/ti_usb_3410_5052.c b/drivers/usb/serial/ti_usb_3410_5052.c
index 2620bf6fe5e1..0a64bac306ee 100644
--- a/drivers/usb/serial/ti_usb_3410_5052.c
+++ b/drivers/usb/serial/ti_usb_3410_5052.c
@@ -50,11 +50,10 @@
 
 #define TI_TRANSFER_TIMEOUT     2
 
-#define TI_DEFAULT_LOW_LATENCY  0
 #define TI_DEFAULT_CLOSING_WAIT 4000            /* in .01 secs */
 
 /* supported setserial flags */
-#define TI_SET_SERIAL_FLAGS     (ASYNC_LOW_LATENCY)
+#define TI_SET_SERIAL_FLAGS     0
 
 /* read urb states */
 #define TI_READ_URB_RUNNING     0
@@ -161,7 +160,6 @@ static int ti_buf_get(struct circ_buf *cb, char *buf, int count);
 
 /* module parameters */
 static int debug;
-static int low_latency = TI_DEFAULT_LOW_LATENCY;
 static int closing_wait = TI_DEFAULT_CLOSING_WAIT;
 static ushort vendor_3410[TI_EXTRA_VID_PID_COUNT];
 static unsigned int vendor_3410_count;
@@ -296,10 +294,6 @@ MODULE_FIRMWARE("mts_edge.fw");
 module_param(debug, bool, S_IRUGO | S_IWUSR);
 MODULE_PARM_DESC(debug, "Enable debugging, 0=no, 1=yes");
 
-module_param(low_latency, bool, S_IRUGO | S_IWUSR);
-MODULE_PARM_DESC(low_latency,
-                "TTY low_latency flag, 0=off, 1=on, default is off");
-
 module_param(closing_wait, int, S_IRUGO | S_IWUSR);
 MODULE_PARM_DESC(closing_wait,
     "Maximum wait for data to drain in close, in .01 secs, default is 4000");
@@ -448,7 +442,6 @@ static int ti_startup(struct usb_serial *serial)
                 spin_lock_init(&tport->tp_lock);
                 tport->tp_uart_base_addr = (i == 0 ?
                                 TI_UART1_BASE_ADDR : TI_UART2_BASE_ADDR);
-                tport->tp_flags = low_latency ? ASYNC_LOW_LATENCY : 0;
                 tport->tp_closing_wait = closing_wait;
                 init_waitqueue_head(&tport->tp_msr_wait);
                 init_waitqueue_head(&tport->tp_write_wait);
@@ -528,10 +521,6 @@ static int ti_open(struct tty_struct *tty,
         if (mutex_lock_interruptible(&tdev->td_open_close_lock))
                 return -ERESTARTSYS;
 
-        if (tty)
-                tty->low_latency =
-                                (tport->tp_flags & ASYNC_LOW_LATENCY) ? 1 : 0;
-
         port_number = port->number - port->serial->minor;
 
         memset(&(tport->tp_icount), 0x00, sizeof(tport->tp_icount));
@@ -1215,20 +1204,22 @@ static void ti_bulk_in_callback(struct urb *urb)
         }
 
         tty = tty_port_tty_get(&port->port);
-        if (tty && urb->actual_length) {
-                usb_serial_debug_data(debug, dev, __func__,
-                        urb->actual_length, urb->transfer_buffer);
-
-                if (!tport->tp_is_open)
-                        dbg("%s - port closed, dropping data", __func__);
-                else
-                        ti_recv(&urb->dev->dev, tty,
+        if (tty) {
+                if (urb->actual_length) {
+                        usb_serial_debug_data(debug, dev, __func__,
+                                urb->actual_length, urb->transfer_buffer);
+
+                        if (!tport->tp_is_open)
+                                dbg("%s - port closed, dropping data",
+                                        __func__);
+                        else
+                                ti_recv(&urb->dev->dev, tty,
                                                 urb->transfer_buffer,
                                                 urb->actual_length);
-
-                spin_lock(&tport->tp_lock);
-                tport->tp_icount.rx += urb->actual_length;
-                spin_unlock(&tport->tp_lock);
+                        spin_lock(&tport->tp_lock);
+                        tport->tp_icount.rx += urb->actual_length;
+                        spin_unlock(&tport->tp_lock);
+                }
                 tty_kref_put(tty);
         }
 
@@ -1452,7 +1443,6 @@ static int ti_set_serial_info(struct tty_struct *tty, struct ti_port *tport,
                 return -EFAULT;
 
         tport->tp_flags = new_serial.flags & TI_SET_SERIAL_FLAGS;
-        tty->low_latency = (tport->tp_flags & ASYNC_LOW_LATENCY) ? 1 : 0;
         tport->tp_closing_wait = new_serial.closing_wait;
 
         return 0;
diff --git a/drivers/usb/serial/usb-serial.c b/drivers/usb/serial/usb-serial.c
index 2a70563bbee1..0a566eea49c0 100644
--- a/drivers/usb/serial/usb-serial.c
+++ b/drivers/usb/serial/usb-serial.c
@@ -137,22 +137,10 @@ static void destroy_serial(struct kref *kref)
 
         dbg("%s - %s", __func__, serial->type->description);
 
-        serial->type->shutdown(serial);
-
         /* return the minor range that this device had */
         if (serial->minor != SERIAL_TTY_NO_MINOR)
                 return_serial(serial);
 
-        for (i = 0; i < serial->num_ports; ++i)
-                serial->port[i]->port.count = 0;
-
-        /* the ports are cleaned up and released in port_release() */
-        for (i = 0; i < serial->num_ports; ++i)
-                if (serial->port[i]->dev.parent != NULL) {
-                        device_unregister(&serial->port[i]->dev);
-                        serial->port[i] = NULL;
-                }
-
         /* If this is a "fake" port, we have to clean it up here, as it will
          * not get cleaned up in port_release() as it was never registered with
          * the driver core */
@@ -187,7 +175,7 @@ static int serial_open (struct tty_struct *tty, struct file *filp)
         struct usb_serial *serial;
         struct usb_serial_port *port;
         unsigned int portNumber;
-        int retval;
+        int retval = 0;
 
         dbg("%s", __func__);
 
@@ -198,21 +186,24 @@ static int serial_open (struct tty_struct *tty, struct file *filp)
                 return -ENODEV;
         }
 
+        mutex_lock(&serial->disc_mutex);
         portNumber = tty->index - serial->minor;
         port = serial->port[portNumber];
-        if (!port) {
-                retval = -ENODEV;
-                goto bailout_kref_put;
-        }
-
-        if (port->serial->disconnected) {
+        if (!port || serial->disconnected)
                 retval = -ENODEV;
-                goto bailout_kref_put;
-        }
+        else
+                get_device(&port->dev);
+        /*
+         * Note: Our locking order requirement does not allow port->mutex
+         * to be acquired while serial->disc_mutex is held.
+         */
+        mutex_unlock(&serial->disc_mutex);
+        if (retval)
+                goto bailout_serial_put;
 
         if (mutex_lock_interruptible(&port->mutex)) {
                 retval = -ERESTARTSYS;
-                goto bailout_kref_put;
+                goto bailout_port_put;
         }
 
         ++port->port.count;
@@ -232,14 +223,20 @@ static int serial_open (struct tty_struct *tty, struct file *filp)
                         goto bailout_mutex_unlock;
                 }
 
-                retval = usb_autopm_get_interface(serial->interface);
+                mutex_lock(&serial->disc_mutex);
+                if (serial->disconnected)
+                        retval = -ENODEV;
+                else
+                        retval = usb_autopm_get_interface(serial->interface);
                 if (retval)
                         goto bailout_module_put;
+
                 /* only call the device specific open if this
                  * is the first time the port is opened */
                 retval = serial->type->open(tty, port, filp);
                 if (retval)
                         goto bailout_interface_put;
+                mutex_unlock(&serial->disc_mutex);
         }
 
         mutex_unlock(&port->mutex);
@@ -248,13 +245,16 @@ static int serial_open (struct tty_struct *tty, struct file *filp)
 bailout_interface_put:
         usb_autopm_put_interface(serial->interface);
 bailout_module_put:
+        mutex_unlock(&serial->disc_mutex);
         module_put(serial->type->driver.owner);
 bailout_mutex_unlock:
         port->port.count = 0;
         tty->driver_data = NULL;
         tty_port_tty_set(&port->port, NULL);
         mutex_unlock(&port->mutex);
-bailout_kref_put:
+bailout_port_put:
+        put_device(&port->dev);
+bailout_serial_put:
         usb_serial_put(serial);
         return retval;
 }
@@ -262,6 +262,9 @@ bailout_kref_put:
 static void serial_close(struct tty_struct *tty, struct file *filp)
 {
         struct usb_serial_port *port = tty->driver_data;
+        struct usb_serial *serial;
+        struct module *owner;
+        int count;
 
         if (!port)
                 return;
@@ -269,6 +272,8 @@ static void serial_close(struct tty_struct *tty, struct file *filp)
         dbg("%s - port %d", __func__, port->number);
 
         mutex_lock(&port->mutex);
+        serial = port->serial;
+        owner = serial->type->driver.owner;
 
         if (port->port.count == 0) {
                 mutex_unlock(&port->mutex);
@@ -281,7 +286,7 @@ static void serial_close(struct tty_struct *tty, struct file *filp)
                  * this before we drop the port count. The call is protected
                  * by the port mutex
                  */
-                port->serial->type->close(tty, port, filp);
+                serial->type->close(tty, port, filp);
 
         if (port->port.count == (port->console ? 2 : 1)) {
                 struct tty_struct *tty = tty_port_tty_get(&port->port);
@@ -295,17 +300,23 @@ static void serial_close(struct tty_struct *tty, struct file *filp)
                 }
         }
 
-        if (port->port.count == 1) {
-                mutex_lock(&port->serial->disc_mutex);
-                if (!port->serial->disconnected)
-                        usb_autopm_put_interface(port->serial->interface);
-                mutex_unlock(&port->serial->disc_mutex);
-                module_put(port->serial->type->driver.owner);
-        }
         --port->port.count;
-
+        count = port->port.count;
         mutex_unlock(&port->mutex);
-        usb_serial_put(port->serial);
+        put_device(&port->dev);
+
+        /* Mustn't dereference port any more */
+        if (count == 0) {
+                mutex_lock(&serial->disc_mutex);
+                if (!serial->disconnected)
+                        usb_autopm_put_interface(serial->interface);
+                mutex_unlock(&serial->disc_mutex);
+        }
+        usb_serial_put(serial);
+
+        /* Mustn't dereference serial any more */
+        if (count == 0)
+                module_put(owner);
 }
 
 static int serial_write(struct tty_struct *tty, const unsigned char *buf,
@@ -549,7 +560,13 @@ static void kill_traffic(struct usb_serial_port *port)
 
 static void port_free(struct usb_serial_port *port)
 {
+        /*
+         * Stop all the traffic before cancelling the work, so that
+         * nobody will restart it by calling usb_serial_port_softint.
+         */
         kill_traffic(port);
+        cancel_work_sync(&port->work);
+
         usb_free_urb(port->read_urb);
         usb_free_urb(port->write_urb);
         usb_free_urb(port->interrupt_in_urb);
@@ -558,7 +575,6 @@ static void port_free(struct usb_serial_port *port)
         kfree(port->bulk_out_buffer);
         kfree(port->interrupt_in_buffer);
         kfree(port->interrupt_out_buffer);
-        flush_scheduled_work();         /* port->work */
         kfree(port);
 }
 
@@ -1043,6 +1059,12 @@ void usb_serial_disconnect(struct usb_interface *interface)
         usb_set_intfdata(interface, NULL);
         /* must set a flag, to signal subdrivers */
         serial->disconnected = 1;
+        mutex_unlock(&serial->disc_mutex);
+
+        /* Unfortunately, many of the sub-drivers expect the port structures
+         * to exist when their shutdown method is called, so we have to go
+         * through this awkward two-step unregistration procedure.
+         */
         for (i = 0; i < serial->num_ports; ++i) {
                 port = serial->port[i];
                 if (port) {
@@ -1052,11 +1074,21 @@ void usb_serial_disconnect(struct usb_interface *interface)
                                 tty_kref_put(tty);
                         }
                         kill_traffic(port);
+                        cancel_work_sync(&port->work);
+                        device_del(&port->dev);
+                }
+        }
+        serial->type->shutdown(serial);
+        for (i = 0; i < serial->num_ports; ++i) {
+                port = serial->port[i];
+                if (port) {
+                        put_device(&port->dev);
+                        serial->port[i] = NULL;
                 }
         }
+
         /* let the last holder of this object
          * cause it to be cleaned up */
-        mutex_unlock(&serial->disc_mutex);
         usb_serial_put(serial);
         dev_info(dev, "device disconnected\n");
 }
diff --git a/drivers/usb/serial/visor.c b/drivers/usb/serial/visor.c
index 4facce3d9364..5ac414bda718 100644
--- a/drivers/usb/serial/visor.c
+++ b/drivers/usb/serial/visor.c
@@ -296,14 +296,6 @@ static int visor_open(struct tty_struct *tty, struct usb_serial_port *port,
         priv->throttled = 0;
         spin_unlock_irqrestore(&priv->lock, flags);
 
-        /*
-         * Force low_latency on so that our tty_push actually forces the data
-         * through, otherwise it is scheduled, and with high data rates (like
-         * with OHCI) data can get lost.
-         */
-        if (tty)
-                tty->low_latency = 1;
-
         /* Start reading from the device */
         usb_fill_bulk_urb(port->read_urb, serial->dev,
                            usb_rcvbulkpipe(serial->dev,
diff --git a/drivers/usb/storage/Makefile b/drivers/usb/storage/Makefile
index 5be54c019662..ef7e5a8ceab5 100644
--- a/drivers/usb/storage/Makefile
+++ b/drivers/usb/storage/Makefile
@@ -17,7 +17,8 @@ usb-storage-objs :=	scsiglue.o protocol.o transport.o usb.o \
 ifeq ($(CONFIG_USB_LIBUSUAL),)
         usb-storage-objs        += usual-tables.o
 else
-        obj-$(CONFIG_USB)       += libusual.o usual-tables.o
+        obj-$(CONFIG_USB)       += usb-libusual.o
+        usb-libusual-objs       := libusual.o usual-tables.o
 endif
 
 obj-$(CONFIG_USB_STORAGE_ALAUDA)        += ums-alauda.o
diff --git a/drivers/usb/storage/transport.c b/drivers/usb/storage/transport.c
index 49aedb36dc19..fcb320217218 100644
--- a/drivers/usb/storage/transport.c
+++ b/drivers/usb/storage/transport.c
@@ -247,10 +247,8 @@ int usb_stor_clear_halt(struct us_data *us, unsigned int pipe)
                 USB_ENDPOINT_HALT, endp,
                 NULL, 0, 3*HZ);
 
-        /* reset the endpoint toggle */
         if (result >= 0)
-                usb_settoggle(us->pusb_dev, usb_pipeendpoint(pipe),
-                                usb_pipeout(pipe), 0);
+                usb_reset_endpoint(us->pusb_dev, endp);
 
         US_DEBUGP("%s: result = %d\n", __func__, result);
         return result;
diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
index 1c1f643e8a78..fa65a3b08601 100644
--- a/drivers/usb/storage/unusual_devs.h
+++ b/drivers/usb/storage/unusual_devs.h
@@ -975,12 +975,14 @@ UNUSUAL_DEV(  0x07c4, 0xa400, 0x0000, 0xffff,
                 US_SC_DEVICE, US_PR_DEVICE, NULL,
                 US_FL_FIX_INQUIRY | US_FL_FIX_CAPACITY ),
 
-/* Reported by Rauch Wolke <rauchwolke@gmx.net> */
+/* Reported by Rauch Wolke <rauchwolke@gmx.net>
+ * and augmented by binbin <binbinsh@gmail.com> (Bugzilla #12882)
+ */
 UNUSUAL_DEV(  0x07c4, 0xa4a5, 0x0000, 0xffff,
                 "Simple Tech/Datafab",
                 "CF+SM Reader",
                 US_SC_DEVICE, US_PR_DEVICE, NULL,
-                US_FL_IGNORE_RESIDUE ),
+                US_FL_IGNORE_RESIDUE | US_FL_MAX_SECTORS_64 ),
 
 /* Casio QV 2x00/3x00/4000/8000 digital still cameras are not conformant
  * to the USB storage specification in two ways:
@@ -1376,6 +1378,14 @@ UNUSUAL_DEV(  0x10d6, 0x2200, 0x0100, 0x0100,
                 US_SC_DEVICE, US_PR_DEVICE, NULL,
                 0),
 
+/* Reported by Pascal Terjan <pterjan@mandriva.com>
+ * Ignore driver CD mode and force into modem mode by default.
+ */
+UNUSUAL_DEV(  0x1186, 0x3e04, 0x0000, 0x0000,
+           "D-Link",
+           "USB Mass Storage",
+           US_SC_DEVICE, US_PR_DEVICE, option_ms_init, 0),
+
 /* Reported by Kevin Lloyd <linux@sierrawireless.com>
  * Entry is needed for the initializer function override,
  * which instructs the device to load as a modem
@@ -1841,6 +1851,12 @@ UNUSUAL_DEV(  0xed06, 0x4500, 0x0001, 0x0001,
                 US_SC_DEVICE, US_PR_DEVICE, NULL,
                 US_FL_CAPACITY_HEURISTICS),
 
+/* Reported by Alessio Treglia <quadrispro@ubuntu.com> */
+UNUSUAL_DEV( 0xed10, 0x7636, 0x0001, 0x0001,
+                "TGE",
+                "Digital MP3 Audio Player",
+                US_SC_DEVICE, US_PR_DEVICE, NULL, US_FL_NOT_LOCKABLE ),
+
 /* Control/Bulk transport for all SubClass values */
 USUAL_DEV(US_SC_RBC, US_PR_CB, USB_US_TYPE_STOR),
 USUAL_DEV(US_SC_8020, US_PR_CB, USB_US_TYPE_STOR),
diff --git a/drivers/usb/wusbcore/devconnect.c b/drivers/usb/wusbcore/devconnect.c
index 386eaa22d215..4ac4300a3f9a 100644
--- a/drivers/usb/wusbcore/devconnect.c
+++ b/drivers/usb/wusbcore/devconnect.c
@@ -267,6 +267,8 @@ static void wusbhc_devconnect_acked_work(struct work_struct *work)
         mutex_lock(&wusbhc->mutex);
         wusbhc_devconnect_acked(wusbhc, wusb_dev);
         mutex_unlock(&wusbhc->mutex);
+
+        wusb_dev_put(wusb_dev);
 }
 
 /*
@@ -396,7 +398,8 @@ static void __wusbhc_dev_disconnect(struct wusbhc *wusbhc,
 
         /* After a device disconnects, change the GTK (see [WUSB]
          * section 6.2.11.2). */
-        wusbhc_gtk_rekey(wusbhc);
+        if (wusbhc->active)
+                wusbhc_gtk_rekey(wusbhc);
 
         /* The Wireless USB part has forgotten about the device already; now
          * khubd's timer will pick up the disconnection and remove the USB
@@ -1084,15 +1087,21 @@ error_mmcie_set:
  * wusbhc_devconnect_stop - stop managing connected devices
  * @wusbhc: the WUSB HC
  *
- * Removes the Host Info IE and stops the keep alives.
- *
- * FIXME: should this disconnect all devices?
+ * Disconnects any devices still connected, stops the keep alives and
+ * removes the Host Info IE.
  */
 void wusbhc_devconnect_stop(struct wusbhc *wusbhc)
 {
-        cancel_delayed_work_sync(&wusbhc->keep_alive_timer);
-        WARN_ON(!list_empty(&wusbhc->cack_list));
+        int i;
 
+        mutex_lock(&wusbhc->mutex);
+        for (i = 0; i < wusbhc->ports_max; i++) {
+                if (wusbhc->port[i].wusb_dev)
+                        __wusbhc_dev_disconnect(wusbhc, &wusbhc->port[i]);
+        }
+        mutex_unlock(&wusbhc->mutex);
+
+        cancel_delayed_work_sync(&wusbhc->keep_alive_timer);
         wusbhc_mmcie_rm(wusbhc, &wusbhc->wuie_host_info->hdr);
         kfree(wusbhc->wuie_host_info);
         wusbhc->wuie_host_info = NULL;
diff --git a/drivers/usb/wusbcore/wusbhc.c b/drivers/usb/wusbcore/wusbhc.c
index 07c63a31c799..ee6256f23636 100644
--- a/drivers/usb/wusbcore/wusbhc.c
+++ b/drivers/usb/wusbcore/wusbhc.c
@@ -88,33 +88,31 @@ static DEVICE_ATTR(wusb_trust_timeout, 0644, wusb_trust_timeout_show,
                                              wusb_trust_timeout_store);
 
 /*
- * Show & store the current WUSB CHID
+ * Show the current WUSB CHID.
  */
 static ssize_t wusb_chid_show(struct device *dev,
                               struct device_attribute *attr, char *buf)
 {
         struct wusbhc *wusbhc = usbhc_dev_to_wusbhc(dev);
+        const struct wusb_ckhdid *chid;
         ssize_t result = 0;
 
         if (wusbhc->wuie_host_info != NULL)
-                result += ckhdid_printf(buf, PAGE_SIZE,
-                                        &wusbhc->wuie_host_info->CHID);
+                chid = &wusbhc->wuie_host_info->CHID;
+        else
+                chid = &wusb_ckhdid_zero;
+
+        result += ckhdid_printf(buf, PAGE_SIZE, chid);
+        result += sprintf(buf + result, "\n");
+
         return result;
 }
 
 /*
- * Store a new CHID
- *
- * This will (FIXME) trigger many changes.
- *
- * - Send an all zeros CHID and it will stop the controller
- * - Send a non-zero CHID and it will start it
- *   (unless it was started, it will just change the CHID,
- *   diconnecting all devices first).
+ * Store a new CHID.
  *
- * So first we scan the MMC we are sent and then we act on it.  We
- * read it in the same format as we print it, an ASCII string of 16
- * hex bytes.
+ * - Write an all zeros CHID and it will stop the controller
+ * - Write a non-zero CHID and it will start it.
  *
  * See wusbhc_chid_set() for more info.
  */
@@ -339,13 +337,15 @@ void wusbhc_giveback_urb(struct wusbhc *wusbhc, struct urb *urb, int status)
 {
         struct wusb_dev *wusb_dev = __wusb_dev_get_by_usb_dev(wusbhc, urb->dev);
 
-        if (status == 0) {
+        if (status == 0 && wusb_dev) {
                 wusb_dev->entry_ts = jiffies;
 
-                /* wusbhc_devconnect_acked() can't be called from from
+                /* wusbhc_devconnect_acked() can't be called from
                    atomic context so defer it to a work queue. */
                 if (!list_empty(&wusb_dev->cack_node))
                         queue_work(wusbd, &wusb_dev->devconnect_acked_work);
+                else
+                        wusb_dev_put(wusb_dev);
         }
 
         usb_hcd_giveback_urb(&wusbhc->usb_hcd, urb, status);