38 files changed, 353 insertions, 321 deletions
diff --git a/drivers/acpi/apei/apei-base.c b/drivers/acpi/apei/apei-base.c
index db3946e9c66b..216e1e948ff6 100644
--- a/drivers/acpi/apei/apei-base.c
+++ b/drivers/acpi/apei/apei-base.c
@@ -34,6 +34,7 @@
 #include <linux/module.h>
 #include <linux/init.h>
 #include <linux/acpi.h>
+#include <linux/slab.h>
 #include <linux/io.h>
 #include <linux/kref.h>
 #include <linux/rculist.h>
diff --git a/drivers/acpi/atomicio.c b/drivers/acpi/atomicio.c
index 814b19249616..8f8bd736d4ff 100644
--- a/drivers/acpi/atomicio.c
+++ b/drivers/acpi/atomicio.c
@@ -31,6 +31,7 @@
 #include <linux/kref.h>
 #include <linux/rculist.h>
 #include <linux/interrupt.h>
+#include <linux/slab.h>
 #include <acpi/atomicio.h>
 #define ACPI_PFX "ACPI: "
diff --git a/drivers/block/cciss_scsi.c b/drivers/block/cciss_scsi.c
index 3381505c8a6c..72dae92f3cab 100644
--- a/drivers/block/cciss_scsi.c
+++ b/drivers/block/cciss_scsi.c
@@ -861,6 +861,7 @@ cciss_scsi_detect(int ctlr)
        sh->n_io_port = 0;      // I don't think we use these two...
        sh->this_id = SELF_SCSI_ID;  
        sh->sg_tablesize = hba[ctlr]->maxsgentries;
+        sh->max_cmd_len = MAX_COMMAND_SIZE;
        ((struct cciss_scsi_adapter_data_t *) 
                hba[ctlr]->scsi_ctlr)->scsi_host = sh;
diff --git a/drivers/block/cpqarray.c b/drivers/block/cpqarray.c
index 91d11631cec9..abb4ec6690fc 100644
--- a/drivers/block/cpqarray.c
+++ b/drivers/block/cpqarray.c
@@ -386,7 +386,7 @@ static void __devexit cpqarray_remove_one_eisa (int i)
 }
 /* pdev is NULL for eisa */
-static int __init cpqarray_register_ctlr( int i, struct pci_dev *pdev)
+static int __devinit cpqarray_register_ctlr( int i, struct pci_dev *pdev)
 {
        struct request_queue *q;
        int j;
@@ -503,7 +503,7 @@ Enomem4:
        return -1;
 }
-static int __init cpqarray_init_one( struct pci_dev *pdev,
+static int __devinit cpqarray_init_one( struct pci_dev *pdev,
        const struct pci_device_id *ent)
 {
        int i;
@@ -740,7 +740,7 @@ __setup("smart2=", cpqarray_setup);
 /*
 * Find an EISA controller's signature.  Set up an hba if we find it.
 */
-static int __init cpqarray_eisa_detect(void)
+static int __devinit cpqarray_eisa_detect(void)
 {
        int i=0, j;
        __u32 board_id;
diff --git a/drivers/block/drbd/drbd_main.c b/drivers/block/drbd/drbd_main.c
index 6b077f93acc6..7258c95e895e 100644
--- a/drivers/block/drbd/drbd_main.c
+++ b/drivers/block/drbd/drbd_main.c
@@ -1236,8 +1236,6 @@ static void after_state_ch(struct drbd_conf *mdev, union drbd_state os,
        /* Last part of the attaching process ... */
        if (ns.conn >= C_CONNECTED &&
            os.disk == D_ATTACHING && ns.disk == D_NEGOTIATING) {
-                kfree(mdev->p_uuid); /* We expect to receive up-to-date UUIDs soon. */
-                mdev->p_uuid = NULL; /* ...to not use the old ones in the mean time */
                drbd_send_sizes(mdev, 0, 0);  /* to start sync... */
                drbd_send_uuids(mdev);
                drbd_send_state(mdev);
diff --git a/drivers/block/drbd/drbd_nl.c b/drivers/block/drbd/drbd_nl.c
index 632e3245d1bb..2151f18b21de 100644
--- a/drivers/block/drbd/drbd_nl.c
+++ b/drivers/block/drbd/drbd_nl.c
@@ -1114,6 +1114,12 @@ static int drbd_nl_disk_conf(struct drbd_conf *mdev, struct drbd_nl_cfg_req *nlp
                mdev->new_state_tmp.i = ns.i;
                ns.i = os.i;
                ns.disk = D_NEGOTIATING;
+                /* We expect to receive up-to-date UUIDs soon.
+                   To avoid a race in receive_state, free p_uuid while
+                   holding req_lock. I.e. atomic with the state change */
+                kfree(mdev->p_uuid);
+                mdev->p_uuid = NULL;
        }
        rv = _drbd_set_state(mdev, ns, CS_VERBOSE, NULL);
diff --git a/drivers/char/ipmi/ipmi_si_intf.c b/drivers/char/ipmi/ipmi_si_intf.c
index 35603dd4e6c5..094bdc355b1f 100644
--- a/drivers/char/ipmi/ipmi_si_intf.c
+++ b/drivers/char/ipmi/ipmi_si_intf.c
@@ -302,6 +302,12 @@ struct smi_info {
 static int force_kipmid[SI_MAX_PARMS];
 static int num_force_kipmid;
+#ifdef CONFIG_PCI
+static int pci_registered;
+#endif
+#ifdef CONFIG_PPC_OF
+static int of_registered;
+#endif
 static unsigned int kipmid_max_busy_us[SI_MAX_PARMS];
 static int num_max_busy_us;
@@ -1018,7 +1024,7 @@ static int ipmi_thread(void *data)
                else if (smi_result == SI_SM_IDLE)
                        schedule_timeout_interruptible(100);
                else
-                        schedule_timeout_interruptible(0);
+                        schedule_timeout_interruptible(1);
        }
        return 0;
 }
@@ -3314,6 +3320,8 @@ static __devinit int init_ipmi_si(void)
        rv = pci_register_driver(&ipmi_pci_driver);
        if (rv)
                printk(KERN_ERR PFX "Unable to register PCI driver: %d\n", rv);
+        else
+                pci_registered = 1;
 #endif
 #ifdef CONFIG_ACPI
@@ -3330,6 +3338,7 @@ static __devinit int init_ipmi_si(void)
 #ifdef CONFIG_PPC_OF
        of_register_platform_driver(&ipmi_of_platform_driver);
+        of_registered = 1;
 #endif
        /* We prefer devices with interrupts, but in the case of a machine
@@ -3383,11 +3392,13 @@ static __devinit int init_ipmi_si(void)
        if (unload_when_empty && list_empty(&smi_infos)) {
                mutex_unlock(&smi_infos_lock);
 #ifdef CONFIG_PCI
-                pci_unregister_driver(&ipmi_pci_driver);
+                if (pci_registered)
+                        pci_unregister_driver(&ipmi_pci_driver);
 #endif
 #ifdef CONFIG_PPC_OF
-                of_unregister_platform_driver(&ipmi_of_platform_driver);
+                if (of_registered)
+                        of_unregister_platform_driver(&ipmi_of_platform_driver);
 #endif
                driver_unregister(&ipmi_driver.driver);
                printk(KERN_WARNING PFX
@@ -3478,14 +3489,16 @@ static __exit void cleanup_ipmi_si(void)
                return;
 #ifdef CONFIG_PCI
-        pci_unregister_driver(&ipmi_pci_driver);
+        if (pci_registered)
+                pci_unregister_driver(&ipmi_pci_driver);
 #endif
 #ifdef CONFIG_ACPI
        pnp_unregister_driver(&ipmi_pnp_driver);
 #endif
 #ifdef CONFIG_PPC_OF
-        of_unregister_platform_driver(&ipmi_of_platform_driver);
+        if (of_registered)
+                of_unregister_platform_driver(&ipmi_of_platform_driver);
 #endif
        mutex_lock(&smi_infos_lock);
diff --git a/drivers/gpio/Kconfig b/drivers/gpio/Kconfig
index 724038dab4ca..7face915b963 100644
--- a/drivers/gpio/Kconfig
+++ b/drivers/gpio/Kconfig
@@ -1,5 +1,5 @@
 #
-# GPIO infrastructure and expanders
+# platform-neutral GPIO infrastructure and expanders
 #
 config ARCH_WANT_OPTIONAL_GPIOLIB
diff --git a/drivers/gpio/Makefile b/drivers/gpio/Makefile
index 51c3cdd41b5a..e53dcff49b4f 100644
--- a/drivers/gpio/Makefile
+++ b/drivers/gpio/Makefile
@@ -1,4 +1,8 @@
-# gpio support: dedicated expander chips, etc
+# generic gpio support: dedicated expander chips, etc
+#
+# NOTE: platform-specific GPIO drivers don't belong in the
+# drivers/gpio directory; put them with other platform setup
+# code, IRQ controllers, board init, etc.
 ccflags-$(CONFIG_DEBUG_GPIO)    += -DDEBUG
diff --git a/drivers/rtc/rtc-davinci.c b/drivers/rtc/rtc-davinci.c
index 92a8f6cacda9..34647fc1ee98 100644
--- a/drivers/rtc/rtc-davinci.c
+++ b/drivers/rtc/rtc-davinci.c
@@ -29,6 +29,7 @@
 #include <linux/bcd.h>
 #include <linux/platform_device.h>
 #include <linux/io.h>
+#include <linux/slab.h>
 /*
 * The DaVinci RTC is a simple RTC with the following
diff --git a/drivers/rtc/rtc-ds1307.c b/drivers/rtc/rtc-ds1307.c
index de033b7ac21f..d827ce570a8c 100644
--- a/drivers/rtc/rtc-ds1307.c
+++ b/drivers/rtc/rtc-ds1307.c
@@ -777,7 +777,7 @@ static int __devinit ds1307_probe(struct i2c_client *client,
 read_rtc:
        /* read RTC registers */
-        tmp = ds1307->read_block_data(ds1307->client, 0, 8, buf);
+        tmp = ds1307->read_block_data(ds1307->client, ds1307->offset, 8, buf);
        if (tmp != 8) {
                pr_debug("read error %d\n", tmp);
                err = -EIO;
@@ -862,7 +862,7 @@ read_rtc:
                if (ds1307->regs[DS1307_REG_HOUR] & DS1307_BIT_PM)
                        tmp += 12;
                i2c_smbus_write_byte_data(client,
-                                DS1307_REG_HOUR,
+                                ds1307->offset + DS1307_REG_HOUR,
                                bin2bcd(tmp));
        }
diff --git a/drivers/serial/cpm_uart/cpm_uart_core.c b/drivers/serial/cpm_uart/cpm_uart_core.c
index 9eb62a256e9a..cd6cf575902e 100644
--- a/drivers/serial/cpm_uart/cpm_uart_core.c
+++ b/drivers/serial/cpm_uart/cpm_uart_core.c
@@ -930,6 +930,83 @@ static void cpm_uart_config_port(struct uart_port *port, int flags)
        }
 }
+#if defined(CONFIG_CONSOLE_POLL) || defined(CONFIG_SERIAL_CPM_CONSOLE)
+/*
+ * Write a string to the serial port
+ * Note that this is called with interrupts already disabled
+ */
+static void cpm_uart_early_write(struct uart_cpm_port *pinfo,
+                const char *string, u_int count)
+{
+        unsigned int i;
+        cbd_t __iomem *bdp, *bdbase;
+        unsigned char *cpm_outp_addr;
+        /* Get the address of the host memory buffer.
+         */
+        bdp = pinfo->tx_cur;
+        bdbase = pinfo->tx_bd_base;
+        /*
+         * Now, do each character.  This is not as bad as it looks
+         * since this is a holding FIFO and not a transmitting FIFO.
+         * We could add the complexity of filling the entire transmit
+         * buffer, but we would just wait longer between accesses......
+         */
+        for (i = 0; i < count; i++, string++) {
+                /* Wait for transmitter fifo to empty.
+                 * Ready indicates output is ready, and xmt is doing
+                 * that, not that it is ready for us to send.
+                 */
+                while ((in_be16(&bdp->cbd_sc) & BD_SC_READY) != 0)
+                        ;
+                /* Send the character out.
+                 * If the buffer address is in the CPM DPRAM, don't
+                 * convert it.
+                 */
+                cpm_outp_addr = cpm2cpu_addr(in_be32(&bdp->cbd_bufaddr),
+                                        pinfo);
+                *cpm_outp_addr = *string;
+                out_be16(&bdp->cbd_datlen, 1);
+                setbits16(&bdp->cbd_sc, BD_SC_READY);
+                if (in_be16(&bdp->cbd_sc) & BD_SC_WRAP)
+                        bdp = bdbase;
+                else
+                        bdp++;
+                /* if a LF, also do CR... */
+                if (*string == 10) {
+                        while ((in_be16(&bdp->cbd_sc) & BD_SC_READY) != 0)
+                                ;
+                        cpm_outp_addr = cpm2cpu_addr(in_be32(&bdp->cbd_bufaddr),
+                                                pinfo);
+                        *cpm_outp_addr = 13;
+                        out_be16(&bdp->cbd_datlen, 1);
+                        setbits16(&bdp->cbd_sc, BD_SC_READY);
+                        if (in_be16(&bdp->cbd_sc) & BD_SC_WRAP)
+                                bdp = bdbase;
+                        else
+                                bdp++;
+                }
+        }
+        /*
+         * Finally, Wait for transmitter & holding register to empty
+         *  and restore the IER
+         */
+        while ((in_be16(&bdp->cbd_sc) & BD_SC_READY) != 0)
+                ;
+        pinfo->tx_cur = bdp;
+}
+#endif
 #ifdef CONFIG_CONSOLE_POLL
 /* Serial polling routines for writing and reading from the uart while
 * in an interrupt or debug context.
@@ -999,7 +1076,7 @@ static void cpm_put_poll_char(struct uart_port *port,
        static char ch[2];
        ch[0] = (char)c;
-        cpm_uart_early_write(pinfo->port.line, ch, 1);
+        cpm_uart_early_write(pinfo, ch, 1);
 }
 #endif /* CONFIG_CONSOLE_POLL */
@@ -1130,9 +1207,6 @@ static void cpm_uart_console_write(struct console *co, const char *s,
                                   u_int count)
 {
        struct uart_cpm_port *pinfo = &cpm_uart_ports[co->index];
-        unsigned int i;
-        cbd_t __iomem *bdp, *bdbase;
-        unsigned char *cp;
        unsigned long flags;
        int nolock = oops_in_progress;
@@ -1142,66 +1216,7 @@ static void cpm_uart_console_write(struct console *co, const char *s,
                spin_lock_irqsave(&pinfo->port.lock, flags);
        }
-        /* Get the address of the host memory buffer.
+        cpm_uart_early_write(pinfo, s, count);
-         */
-        bdp = pinfo->tx_cur;
-        bdbase = pinfo->tx_bd_base;
-        /*
-         * Now, do each character.  This is not as bad as it looks
-         * since this is a holding FIFO and not a transmitting FIFO.
-         * We could add the complexity of filling the entire transmit
-         * buffer, but we would just wait longer between accesses......
-         */
-        for (i = 0; i < count; i++, s++) {
-                /* Wait for transmitter fifo to empty.
-                 * Ready indicates output is ready, and xmt is doing
-                 * that, not that it is ready for us to send.
-                 */
-                while ((in_be16(&bdp->cbd_sc) & BD_SC_READY) != 0)
-                        ;
-                /* Send the character out.
-                 * If the buffer address is in the CPM DPRAM, don't
-                 * convert it.
-                 */
-                cp = cpm2cpu_addr(in_be32(&bdp->cbd_bufaddr), pinfo);
-                *cp = *s;
-                out_be16(&bdp->cbd_datlen, 1);
-                setbits16(&bdp->cbd_sc, BD_SC_READY);
-                if (in_be16(&bdp->cbd_sc) & BD_SC_WRAP)
-                        bdp = bdbase;
-                else
-                        bdp++;
-                /* if a LF, also do CR... */
-                if (*s == 10) {
-                        while ((in_be16(&bdp->cbd_sc) & BD_SC_READY) != 0)
-                                ;
-                        cp = cpm2cpu_addr(in_be32(&bdp->cbd_bufaddr), pinfo);
-                        *cp = 13;
-                        out_be16(&bdp->cbd_datlen, 1);
-                        setbits16(&bdp->cbd_sc, BD_SC_READY);
-                        if (in_be16(&bdp->cbd_sc) & BD_SC_WRAP)
-                                bdp = bdbase;
-                        else
-                                bdp++;
-                }
-        }
-        /*
-         * Finally, Wait for transmitter & holding register to empty
-         *  and restore the IER
-         */
-        while ((in_be16(&bdp->cbd_sc) & BD_SC_READY) != 0)
-                ;
-        pinfo->tx_cur = bdp;
        if (unlikely(nolock)) {
                local_irq_restore(flags);
diff --git a/drivers/staging/tm6000/tm6000-alsa.c b/drivers/staging/tm6000/tm6000-alsa.c
index ce081cd44ad4..273e26ede650 100644
--- a/drivers/staging/tm6000/tm6000-alsa.c
+++ b/drivers/staging/tm6000/tm6000-alsa.c
@@ -15,6 +15,7 @@
 #include <linux/device.h>
 #include <linux/interrupt.h>
 #include <linux/usb.h>
+#include <linux/slab.h>
 #include <asm/delay.h>
 #include <sound/core.h>
diff --git a/drivers/staging/tm6000/tm6000-cards.c b/drivers/staging/tm6000/tm6000-cards.c
index cedd9044022f..6a9ae40c7c6d 100644
--- a/drivers/staging/tm6000/tm6000-cards.c
+++ b/drivers/staging/tm6000/tm6000-cards.c
@@ -24,6 +24,7 @@
 #include <linux/i2c.h>
 #include <linux/usb.h>
 #include <linux/version.h>
+#include <linux/slab.h>
 #include <media/v4l2-common.h>
 #include <media/tuner.h>
 #include <media/tvaudio.h>
diff --git a/drivers/staging/tm6000/tm6000-core.c b/drivers/staging/tm6000/tm6000-core.c
index 27f3f551b545..c3690e3580da 100644
--- a/drivers/staging/tm6000/tm6000-core.c
+++ b/drivers/staging/tm6000/tm6000-core.c
@@ -22,6 +22,7 @@
 #include <linux/module.h>
 #include <linux/kernel.h>
+#include <linux/slab.h>
 #include <linux/usb.h>
 #include <linux/i2c.h>
 #include "tm6000.h"
diff --git a/drivers/staging/tm6000/tm6000-dvb.c b/drivers/staging/tm6000/tm6000-dvb.c
index 261e66acbe46..86c1c8b5f25a 100644
--- a/drivers/staging/tm6000/tm6000-dvb.c
+++ b/drivers/staging/tm6000/tm6000-dvb.c
@@ -18,6 +18,7 @@
 */
 #include <linux/kernel.h>
+#include <linux/slab.h>
 #include <linux/usb.h>
 #include "tm6000.h"
diff --git a/drivers/usb/core/driver.c b/drivers/usb/core/driver.c
index de98a94d1853..a6bd53ace035 100644
--- a/drivers/usb/core/driver.c
+++ b/drivers/usb/core/driver.c
@@ -1272,8 +1272,7 @@ static int usb_resume_both(struct usb_device *udev, pm_message_t msg)
 static void choose_wakeup(struct usb_device *udev, pm_message_t msg)
 {
-        int                     w, i;
+        int     w;
-        struct usb_interface    *intf;
        /* Remote wakeup is needed only when we actually go to sleep.
         * For things like FREEZE and QUIESCE, if the device is already
@@ -1285,16 +1284,10 @@ static void choose_wakeup(struct usb_device *udev, pm_message_t msg)
                return;
        }
-        /* If remote wakeup is permitted, see whether any interface drivers
+        /* Enable remote wakeup if it is allowed, even if no interface drivers
         * actually want it.
         */
-        w = 0;
+        w = device_may_wakeup(&udev->dev);
-        if (device_may_wakeup(&udev->dev) && udev->actconfig) {
-                for (i = 0; i < udev->actconfig->desc.bNumInterfaces; i++) {
-                        intf = udev->actconfig->interface[i];
-                        w |= intf->needs_remote_wakeup;
-                }
-        }
        /* If the device is autosuspended with the wrong wakeup setting,
         * autoresume now so the setting can be changed.
diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c
index a73e08fdab36..fd4c36ea5e46 100644
--- a/drivers/usb/core/message.c
+++ b/drivers/usb/core/message.c
@@ -416,8 +416,11 @@ int usb_sg_init(struct usb_sg_request *io, struct usb_device *dev,
                        /* A length of zero means transfer the whole sg list */
                        len = length;
                        if (len == 0) {
-                                for_each_sg(sg, sg, nents, i)
+                                struct scatterlist      *sg2;
-                                        len += sg->length;
+                                int                     j;
+                                for_each_sg(sg, sg2, nents, j)
+                                        len += sg2->length;
                        }
                } else {
                        /*
diff --git a/drivers/usb/gadget/f_eem.c b/drivers/usb/gadget/f_eem.c
index 38226e9a371d..95dd4662d6a8 100644
--- a/drivers/usb/gadget/f_eem.c
+++ b/drivers/usb/gadget/f_eem.c
@@ -469,8 +469,7 @@ static int eem_unwrap(struct gether *port,
                                crc = get_unaligned_le32(skb->data + len
                                                        - ETH_FCS_LEN);
                                crc2 = ~crc32_le(~0,
-                                                skb->data,
+                                                skb->data, len - ETH_FCS_LEN);
-                                                skb->len - ETH_FCS_LEN);
                        } else {
                                crc = get_unaligned_be32(skb->data + len
                                                        - ETH_FCS_LEN);
diff --git a/drivers/usb/gadget/f_mass_storage.c b/drivers/usb/gadget/f_mass_storage.c
index 7d05a0be5c60..4ce899c9b165 100644
--- a/drivers/usb/gadget/f_mass_storage.c
+++ b/drivers/usb/gadget/f_mass_storage.c
@@ -321,8 +321,8 @@ struct fsg_dev;
 /* Data shared by all the FSG instances. */
 struct fsg_common {
        struct usb_gadget       *gadget;
-        struct fsg_dev          *fsg;
+        struct fsg_dev          *fsg, *new_fsg;
-        struct fsg_dev          *prev_fsg;
+        wait_queue_head_t       fsg_wait;
        /* filesem protects: backing files in use */
        struct rw_semaphore     filesem;
@@ -351,7 +351,6 @@ struct fsg_common {
        enum fsg_state          state;          /* For exception handling */
        unsigned int            exception_req_tag;
-        u8                      config, new_config;
        enum data_direction     data_dir;
        u32                     data_size;
        u32                     data_size_from_cmnd;
@@ -595,7 +594,7 @@ static int fsg_setup(struct usb_function *f,
        u16                     w_value = le16_to_cpu(ctrl->wValue);
        u16                     w_length = le16_to_cpu(ctrl->wLength);
-        if (!fsg->common->config)
+        if (!fsg_is_set(fsg->common))
                return -EOPNOTSUPP;
        switch (ctrl->bRequest) {
@@ -2303,24 +2302,20 @@ static int alloc_request(struct fsg_common *common, struct usb_ep *ep,
        return -ENOMEM;
 }
-/*
+/* Reset interface setting and re-init endpoint state (toggle etc). */
- * Reset interface setting and re-init endpoint state (toggle etc).
+static int do_set_interface(struct fsg_common *common, struct fsg_dev *new_fsg)
- * Call with altsetting < 0 to disable the interface.  The only other
- * available altsetting is 0, which enables the interface.
- */
-static int do_set_interface(struct fsg_common *common, int altsetting)
 {
-        int     rc = 0;
+        const struct usb_endpoint_descriptor *d;
-        int     i;
+        struct fsg_dev *fsg;
-        const struct usb_endpoint_descriptor    *d;
+        int i, rc = 0;
        if (common->running)
                DBG(common, "reset interface\n");
 reset:
        /* Deallocate the requests */
-        if (common->prev_fsg) {
+        if (common->fsg) {
-                struct fsg_dev *fsg = common->prev_fsg;
+                fsg = common->fsg;
                for (i = 0; i < FSG_NUM_BUFFERS; ++i) {
                        struct fsg_buffhd *bh = &common->buffhds[i];
@@ -2345,88 +2340,53 @@ reset:
                        fsg->bulk_out_enabled = 0;
                }
-                common->prev_fsg = 0;
+                common->fsg = NULL;
+                wake_up(&common->fsg_wait);
        }
        common->running = 0;
-        if (altsetting < 0 || rc != 0)
+        if (!new_fsg || rc)
                return rc;
-        DBG(common, "set interface %d\n", altsetting);
+        common->fsg = new_fsg;
+        fsg = common->fsg;
-        if (fsg_is_set(common)) {
+        /* Enable the endpoints */
-                struct fsg_dev *fsg = common->fsg;
+        d = fsg_ep_desc(common->gadget,
-                common->prev_fsg = common->fsg;
+                        &fsg_fs_bulk_in_desc, &fsg_hs_bulk_in_desc);
+        rc = enable_endpoint(common, fsg->bulk_in, d);
+        if (rc)
+                goto reset;
+        fsg->bulk_in_enabled = 1;
+        d = fsg_ep_desc(common->gadget,
+                        &fsg_fs_bulk_out_desc, &fsg_hs_bulk_out_desc);
+        rc = enable_endpoint(common, fsg->bulk_out, d);
+        if (rc)
+                goto reset;
+        fsg->bulk_out_enabled = 1;
+        common->bulk_out_maxpacket = le16_to_cpu(d->wMaxPacketSize);
+        clear_bit(IGNORE_BULK_OUT, &fsg->atomic_bitflags);
-                /* Enable the endpoints */
+        /* Allocate the requests */
-                d = fsg_ep_desc(common->gadget,
+        for (i = 0; i < FSG_NUM_BUFFERS; ++i) {
-                                &fsg_fs_bulk_in_desc, &fsg_hs_bulk_in_desc);
+                struct fsg_buffhd       *bh = &common->buffhds[i];
-                rc = enable_endpoint(common, fsg->bulk_in, d);
+                rc = alloc_request(common, fsg->bulk_in, &bh->inreq);
                if (rc)
                        goto reset;
-                fsg->bulk_in_enabled = 1;
+                rc = alloc_request(common, fsg->bulk_out, &bh->outreq);
-                d = fsg_ep_desc(common->gadget,
-                                &fsg_fs_bulk_out_desc, &fsg_hs_bulk_out_desc);
-                rc = enable_endpoint(common, fsg->bulk_out, d);
                if (rc)
                        goto reset;
-                fsg->bulk_out_enabled = 1;
+                bh->inreq->buf = bh->outreq->buf = bh->buf;
-                common->bulk_out_maxpacket = le16_to_cpu(d->wMaxPacketSize);
+                bh->inreq->context = bh->outreq->context = bh;
-                clear_bit(IGNORE_BULK_OUT, &fsg->atomic_bitflags);
+                bh->inreq->complete = bulk_in_complete;
+                bh->outreq->complete = bulk_out_complete;
-                /* Allocate the requests */
-                for (i = 0; i < FSG_NUM_BUFFERS; ++i) {
-                        struct fsg_buffhd       *bh = &common->buffhds[i];
-                        rc = alloc_request(common, fsg->bulk_in, &bh->inreq);
-                        if (rc)
-                                goto reset;
-                        rc = alloc_request(common, fsg->bulk_out, &bh->outreq);
-                        if (rc)
-                                goto reset;
-                        bh->inreq->buf = bh->outreq->buf = bh->buf;
-                        bh->inreq->context = bh->outreq->context = bh;
-                        bh->inreq->complete = bulk_in_complete;
-                        bh->outreq->complete = bulk_out_complete;
-                }
-                common->running = 1;
-                for (i = 0; i < common->nluns; ++i)
-                        common->luns[i].unit_attention_data = SS_RESET_OCCURRED;
-                return rc;
-        } else {
-                return -EIO;
-        }
-}
-/*
- * Change our operational configuration.  This code must agree with the code
- * that returns config descriptors, and with interface altsetting code.
- *
- * It's also responsible for power management interactions.  Some
- * configurations might not work with our current power sources.
- * For now we just assume the gadget is always self-powered.
- */
-static int do_set_config(struct fsg_common *common, u8 new_config)
-{
-        int     rc = 0;
-        /* Disable the single interface */
-        if (common->config != 0) {
-                DBG(common, "reset config\n");
-                common->config = 0;
-                rc = do_set_interface(common, -1);
        }
-        /* Enable the interface */
+        common->running = 1;
-        if (new_config != 0) {
+        for (i = 0; i < common->nluns; ++i)
-                common->config = new_config;
+                common->luns[i].unit_attention_data = SS_RESET_OCCURRED;
-                rc = do_set_interface(common, 0);
-                if (rc != 0)
-                        common->config = 0;     /* Reset on errors */
-        }
        return rc;
 }
@@ -2437,9 +2397,7 @@ static int do_set_config(struct fsg_common *common, u8 new_config)
 static int fsg_set_alt(struct usb_function *f, unsigned intf, unsigned alt)
 {
        struct fsg_dev *fsg = fsg_from_func(f);
-        fsg->common->prev_fsg = fsg->common->fsg;
+        fsg->common->new_fsg = fsg;
-        fsg->common->fsg = fsg;
-        fsg->common->new_config = 1;
        raise_exception(fsg->common, FSG_STATE_CONFIG_CHANGE);
        return 0;
 }
@@ -2447,9 +2405,7 @@ static int fsg_set_alt(struct usb_function *f, unsigned intf, unsigned alt)
 static void fsg_disable(struct usb_function *f)
 {
        struct fsg_dev *fsg = fsg_from_func(f);
-        fsg->common->prev_fsg = fsg->common->fsg;
+        fsg->common->new_fsg = NULL;
-        fsg->common->fsg = fsg;
-        fsg->common->new_config = 0;
        raise_exception(fsg->common, FSG_STATE_CONFIG_CHANGE);
 }
@@ -2459,19 +2415,17 @@ static void fsg_disable(struct usb_function *f)
 static void handle_exception(struct fsg_common *common)
 {
        siginfo_t               info;
-        int                     sig;
        int                     i;
        struct fsg_buffhd       *bh;
        enum fsg_state          old_state;
-        u8                      new_config;
        struct fsg_lun          *curlun;
        unsigned int            exception_req_tag;
-        int                     rc;
        /* Clear the existing signals.  Anything but SIGUSR1 is converted
         * into a high-priority EXIT exception. */
        for (;;) {
-                sig = dequeue_signal_lock(current, &current->blocked, &info);
+                int sig =
+                        dequeue_signal_lock(current, &current->blocked, &info);
                if (!sig)
                        break;
                if (sig != SIGUSR1) {
@@ -2482,7 +2436,7 @@ static void handle_exception(struct fsg_common *common)
        }
        /* Cancel all the pending transfers */
-        if (fsg_is_set(common)) {
+        if (likely(common->fsg)) {
                for (i = 0; i < FSG_NUM_BUFFERS; ++i) {
                        bh = &common->buffhds[i];
                        if (bh->inreq_busy)
@@ -2523,7 +2477,6 @@ static void handle_exception(struct fsg_common *common)
        common->next_buffhd_to_fill = &common->buffhds[0];
        common->next_buffhd_to_drain = &common->buffhds[0];
        exception_req_tag = common->exception_req_tag;
-        new_config = common->new_config;
        old_state = common->state;
        if (old_state == FSG_STATE_ABORT_BULK_OUT)
@@ -2573,12 +2526,12 @@ static void handle_exception(struct fsg_common *common)
                break;
        case FSG_STATE_CONFIG_CHANGE:
-                rc = do_set_config(common, new_config);
+                do_set_interface(common, common->new_fsg);
                break;
        case FSG_STATE_EXIT:
        case FSG_STATE_TERMINATED:
-                do_set_config(common, 0);               /* Free resources */
+                do_set_interface(common, NULL);         /* Free resources */
                spin_lock_irq(&common->lock);
                common->state = FSG_STATE_TERMINATED;   /* Stop the thread */
                spin_unlock_irq(&common->lock);
@@ -2863,6 +2816,7 @@ buffhds_first_it:
                goto error_release;
        }
        init_completion(&common->thread_notifier);
+        init_waitqueue_head(&common->fsg_wait);
 #undef OR
@@ -2957,9 +2911,17 @@ static void fsg_common_release(struct kref *ref)
 static void fsg_unbind(struct usb_configuration *c, struct usb_function *f)
 {
        struct fsg_dev          *fsg = fsg_from_func(f);
+        struct fsg_common       *common = fsg->common;
        DBG(fsg, "unbind\n");
-        fsg_common_put(fsg->common);
+        if (fsg->common->fsg == fsg) {
+                fsg->common->new_fsg = NULL;
+                raise_exception(fsg->common, FSG_STATE_CONFIG_CHANGE);
+                /* FIXME: make interruptible or killable somehow? */
+                wait_event(common->fsg_wait, common->fsg != fsg);
+        }
+        fsg_common_put(common);
        usb_free_descriptors(fsg->function.descriptors);
        usb_free_descriptors(fsg->function.hs_descriptors);
        kfree(fsg);
@@ -2970,7 +2932,6 @@ static int fsg_bind(struct usb_configuration *c, struct usb_function *f)
 {
        struct fsg_dev          *fsg = fsg_from_func(f);
        struct usb_gadget       *gadget = c->cdev->gadget;
-        int                     rc;
        int                     i;
        struct usb_ep           *ep;
@@ -2996,6 +2957,11 @@ static int fsg_bind(struct usb_configuration *c, struct usb_function *f)
        ep->driver_data = fsg->common;  /* claim the endpoint */
        fsg->bulk_out = ep;
+        /* Copy descriptors */
+        f->descriptors = usb_copy_descriptors(fsg_fs_function);
+        if (unlikely(!f->descriptors))
+                return -ENOMEM;
        if (gadget_is_dualspeed(gadget)) {
                /* Assume endpoint addresses are the same for both speeds */
                fsg_hs_bulk_in_desc.bEndpointAddress =
@@ -3003,16 +2969,17 @@ static int fsg_bind(struct usb_configuration *c, struct usb_function *f)
                fsg_hs_bulk_out_desc.bEndpointAddress =
                        fsg_fs_bulk_out_desc.bEndpointAddress;
                f->hs_descriptors = usb_copy_descriptors(fsg_hs_function);
-                if (unlikely(!f->hs_descriptors))
+                if (unlikely(!f->hs_descriptors)) {
+                        usb_free_descriptors(f->descriptors);
                        return -ENOMEM;
+                }
        }
        return 0;
 autoconf_fail:
        ERROR(fsg, "unable to autoconfigure all endpoints\n");
-        rc = -ENOTSUPP;
+        return -ENOTSUPP;
-        return rc;
 }
@@ -3036,11 +3003,6 @@ static int fsg_add(struct usb_composite_dev *cdev,
        fsg->function.name        = FSG_DRIVER_DESC;
        fsg->function.strings     = fsg_strings_array;
-        fsg->function.descriptors = usb_copy_descriptors(fsg_fs_function);
-        if (unlikely(!fsg->function.descriptors)) {
-                rc = -ENOMEM;
-                goto error_free_fsg;
-        }
        fsg->function.bind        = fsg_bind;
        fsg->function.unbind      = fsg_unbind;
        fsg->function.setup       = fsg_setup;
@@ -3056,19 +3018,9 @@ static int fsg_add(struct usb_composite_dev *cdev,
        rc = usb_add_function(c, &fsg->function);
        if (unlikely(rc))
-                goto error_free_all;
+                kfree(fsg);
+        else
-        fsg_common_get(fsg->common);
+                fsg_common_get(fsg->common);
-        return 0;
-error_free_all:
-        usb_free_descriptors(fsg->function.descriptors);
-        /* fsg_bind() might have copied those; or maybe not? who cares
-         * -- free it just in case. */
-        usb_free_descriptors(fsg->function.hs_descriptors);
-error_free_fsg:
-        kfree(fsg);
        return rc;
 }
diff --git a/drivers/usb/gadget/g_ffs.c b/drivers/usb/gadget/g_ffs.c
index 4b0e4a040d6f..d1af253a9105 100644
--- a/drivers/usb/gadget/g_ffs.c
+++ b/drivers/usb/gadget/g_ffs.c
@@ -392,6 +392,17 @@ static int __gfs_do_config(struct usb_configuration *c,
        if (unlikely(ret < 0))
                return ret;
+        /* After previous do_configs there may be some invalid
+         * pointers in c->interface array.  This happens every time
+         * a user space function with fewer interfaces than a user
+         * space function that was run before the new one is run.  The
+         * compasit's set_config() assumes that if there is no more
+         * then MAX_CONFIG_INTERFACES interfaces in a configuration
+         * then there is a NULL pointer after the last interface in
+         * c->interface array.  We need to make sure this is true. */
+        if (c->next_interface_id < ARRAY_SIZE(c->interface))
+                c->interface[c->next_interface_id] = NULL;
        return 0;
 }
diff --git a/drivers/usb/gadget/printer.c b/drivers/usb/gadget/printer.c
index 43abf55d8c60..4c3ac5c42237 100644
--- a/drivers/usb/gadget/printer.c
+++ b/drivers/usb/gadget/printer.c
@@ -82,7 +82,7 @@ static struct class *usb_gadget_class;
 struct printer_dev {
        spinlock_t              lock;           /* lock this structure */
        /* lock buffer lists during read/write calls */
-        spinlock_t              lock_printer_io;
+        struct mutex            lock_printer_io;
        struct usb_gadget       *gadget;
        struct usb_request      *req;           /* for control responses */
        u8                      config;
@@ -567,7 +567,7 @@ printer_read(struct file *fd, char __user *buf, size_t len, loff_t *ptr)
        DBG(dev, "printer_read trying to read %d bytes\n", (int)len);
-        spin_lock(&dev->lock_printer_io);
+        mutex_lock(&dev->lock_printer_io);
        spin_lock_irqsave(&dev->lock, flags);
        /* We will use this flag later to check if a printer reset happened
@@ -601,7 +601,7 @@ printer_read(struct file *fd, char __user *buf, size_t len, loff_t *ptr)
                 * call or not.
                 */
                if (fd->f_flags & (O_NONBLOCK|O_NDELAY)) {
-                        spin_unlock(&dev->lock_printer_io);
+                        mutex_unlock(&dev->lock_printer_io);
                        return -EAGAIN;
                }
@@ -648,7 +648,7 @@ printer_read(struct file *fd, char __user *buf, size_t len, loff_t *ptr)
                if (dev->reset_printer) {
                        list_add(&current_rx_req->list, &dev->rx_reqs);
                        spin_unlock_irqrestore(&dev->lock, flags);
-                        spin_unlock(&dev->lock_printer_io);
+                        mutex_unlock(&dev->lock_printer_io);
                        return -EAGAIN;
                }
@@ -673,7 +673,7 @@ printer_read(struct file *fd, char __user *buf, size_t len, loff_t *ptr)
        dev->current_rx_buf = current_rx_buf;
        spin_unlock_irqrestore(&dev->lock, flags);
-        spin_unlock(&dev->lock_printer_io);
+        mutex_unlock(&dev->lock_printer_io);
        DBG(dev, "printer_read returned %d bytes\n", (int)bytes_copied);
@@ -697,7 +697,7 @@ printer_write(struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
        if (len == 0)
                return -EINVAL;
-        spin_lock(&dev->lock_printer_io);
+        mutex_lock(&dev->lock_printer_io);
        spin_lock_irqsave(&dev->lock, flags);
        /* Check if a printer reset happens while we have interrupts on */
@@ -713,7 +713,7 @@ printer_write(struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
                 * a NON-Blocking call or not.
                 */
                if (fd->f_flags & (O_NONBLOCK|O_NDELAY)) {
-                        spin_unlock(&dev->lock_printer_io);
+                        mutex_unlock(&dev->lock_printer_io);
                        return -EAGAIN;
                }
@@ -752,7 +752,7 @@ printer_write(struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
                if (copy_from_user(req->buf, buf, size)) {
                        list_add(&req->list, &dev->tx_reqs);
-                        spin_unlock(&dev->lock_printer_io);
+                        mutex_unlock(&dev->lock_printer_io);
                        return bytes_copied;
                }
@@ -766,14 +766,14 @@ printer_write(struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
                if (dev->reset_printer) {
                        list_add(&req->list, &dev->tx_reqs);
                        spin_unlock_irqrestore(&dev->lock, flags);
-                        spin_unlock(&dev->lock_printer_io);
+                        mutex_unlock(&dev->lock_printer_io);
                        return -EAGAIN;
                }
                if (usb_ep_queue(dev->in_ep, req, GFP_ATOMIC)) {
                        list_add(&req->list, &dev->tx_reqs);
                        spin_unlock_irqrestore(&dev->lock, flags);
-                        spin_unlock(&dev->lock_printer_io);
+                        mutex_unlock(&dev->lock_printer_io);
                        return -EAGAIN;
                }
@@ -782,7 +782,7 @@ printer_write(struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
        }
        spin_unlock_irqrestore(&dev->lock, flags);
-        spin_unlock(&dev->lock_printer_io);
+        mutex_unlock(&dev->lock_printer_io);
        DBG(dev, "printer_write sent %d bytes\n", (int)bytes_copied);
@@ -820,11 +820,11 @@ printer_poll(struct file *fd, poll_table *wait)
        unsigned long           flags;
        int                     status = 0;
-        spin_lock(&dev->lock_printer_io);
+        mutex_lock(&dev->lock_printer_io);
        spin_lock_irqsave(&dev->lock, flags);
        setup_rx_reqs(dev);
        spin_unlock_irqrestore(&dev->lock, flags);
-        spin_unlock(&dev->lock_printer_io);
+        mutex_unlock(&dev->lock_printer_io);
        poll_wait(fd, &dev->rx_wait, wait);
        poll_wait(fd, &dev->tx_wait, wait);
@@ -1461,7 +1461,7 @@ autoconf_fail:
        }
        spin_lock_init(&dev->lock);
-        spin_lock_init(&dev->lock_printer_io);
+        mutex_init(&dev->lock_printer_io);
        INIT_LIST_HEAD(&dev->tx_reqs);
        INIT_LIST_HEAD(&dev->tx_reqs_active);
        INIT_LIST_HEAD(&dev->rx_reqs);
@@ -1594,7 +1594,7 @@ cleanup(void)
 {
        int status;
-        spin_lock(&usb_printer_gadget.lock_printer_io);
+        mutex_lock(&usb_printer_gadget.lock_printer_io);
        class_destroy(usb_gadget_class);
        unregister_chrdev_region(g_printer_devno, 2);
@@ -1602,6 +1602,6 @@ cleanup(void)
        if (status)
                ERROR(dev, "usb_gadget_unregister_driver %x\n", status);
-        spin_unlock(&usb_printer_gadget.lock_printer_io);
+        mutex_unlock(&usb_printer_gadget.lock_printer_io);
 }
 module_exit(cleanup);
diff --git a/drivers/usb/gadget/s3c2410_udc.c b/drivers/usb/gadget/s3c2410_udc.c
index d5f4c1d45c97..e724a051bfdd 100644
--- a/drivers/usb/gadget/s3c2410_udc.c
+++ b/drivers/usb/gadget/s3c2410_udc.c
@@ -1700,9 +1700,13 @@ int usb_gadget_unregister_driver(struct usb_gadget_driver *driver)
        if (!driver || driver != udc->driver || !driver->unbind)
                return -EINVAL;
-        dprintk(DEBUG_NORMAL,"usb_gadget_register_driver() '%s'\n",
+        dprintk(DEBUG_NORMAL, "usb_gadget_unregister_driver() '%s'\n",
                driver->driver.name);
+        /* report disconnect */
+        if (driver->disconnect)
+                driver->disconnect(&udc->gadget);
        driver->unbind(&udc->gadget);
        device_del(&udc->gadget.dev);
diff --git a/drivers/usb/gadget/u_serial.c b/drivers/usb/gadget/u_serial.c
index 16bdf77f582a..3e8dcb5455e3 100644
--- a/drivers/usb/gadget/u_serial.c
+++ b/drivers/usb/gadget/u_serial.c
@@ -536,17 +536,11 @@ recycle:
                list_move(&req->list, &port->read_pool);
        }
-        /* Push from tty to ldisc; this is immediate with low_latency, and
+        /* Push from tty to ldisc; without low_latency set this is handled by
-         * may trigger callbacks to this driver ... so drop the spinlock.
+         * a workqueue, so we won't get callbacks and can hold port_lock
         */
        if (tty && do_push) {
-                spin_unlock_irq(&port->port_lock);
                tty_flip_buffer_push(tty);
-                wake_up_interruptible(&tty->read_wait);
-                spin_lock_irq(&port->port_lock);
-                /* tty may have been closed */
-                tty = port->port_tty;
        }
@@ -784,11 +778,6 @@ static int gs_open(struct tty_struct *tty, struct file *file)
        port->open_count = 1;
        port->openclose = false;
-        /* low_latency means ldiscs work in tasklet context, without
-         * needing a workqueue schedule ... easier to keep up.
-         */
-        tty->low_latency = 1;
        /* if connected, start the I/O stream */
        if (port->port_usb) {
                struct gserial  *gser = port->port_usb;
@@ -1195,6 +1184,7 @@ void gserial_cleanup(void)
        n_ports = 0;
        tty_unregister_driver(gs_tty_driver);
+        put_tty_driver(gs_tty_driver);
        gs_tty_driver = NULL;
        pr_debug("%s: cleaned up ttyGS* support\n", __func__);
diff --git a/drivers/usb/host/ehci-mxc.c b/drivers/usb/host/ehci-mxc.c
index 544ccfd7056e..bd4027745aa7 100644
--- a/drivers/usb/host/ehci-mxc.c
+++ b/drivers/usb/host/ehci-mxc.c
@@ -207,10 +207,17 @@ static int ehci_mxc_drv_probe(struct platform_device *pdev)
        /* Initialize the transceiver */
        if (pdata->otg) {
                pdata->otg->io_priv = hcd->regs + ULPI_VIEWPORT_OFFSET;
-                if (otg_init(pdata->otg) != 0)
+                ret = otg_init(pdata->otg);
-                        dev_err(dev, "unable to init transceiver\n");
+                if (ret) {
-                else if (otg_set_vbus(pdata->otg, 1) != 0)
+                        dev_err(dev, "unable to init transceiver, probably missing\n");
+                        ret = -ENODEV;
+                        goto err_add;
+                }
+                ret = otg_set_vbus(pdata->otg, 1);
+                if (ret) {
                        dev_err(dev, "unable to enable vbus on transceiver\n");
+                        goto err_add;
+                }
        }
        priv->hcd = hcd;
diff --git a/drivers/usb/host/isp1362-hcd.c b/drivers/usb/host/isp1362-hcd.c
index 20a0dfe0fe36..0587ad4ce5c2 100644
--- a/drivers/usb/host/isp1362-hcd.c
+++ b/drivers/usb/host/isp1362-hcd.c
@@ -2224,12 +2224,9 @@ static void remove_debug_file(struct isp1362_hcd *isp1362_hcd)
 /*-------------------------------------------------------------------------*/
-static void isp1362_sw_reset(struct isp1362_hcd *isp1362_hcd)
+static void __isp1362_sw_reset(struct isp1362_hcd *isp1362_hcd)
 {
        int tmp = 20;
-        unsigned long flags;
-        spin_lock_irqsave(&isp1362_hcd->lock, flags);
        isp1362_write_reg16(isp1362_hcd, HCSWRES, HCSWRES_MAGIC);
        isp1362_write_reg32(isp1362_hcd, HCCMDSTAT, OHCI_HCR);
@@ -2240,6 +2237,14 @@ static void isp1362_sw_reset(struct isp1362_hcd *isp1362_hcd)
        }
        if (!tmp)
                pr_err("Software reset timeout\n");
+}
+static void isp1362_sw_reset(struct isp1362_hcd *isp1362_hcd)
+{
+        unsigned long flags;
+        spin_lock_irqsave(&isp1362_hcd->lock, flags);
+        __isp1362_sw_reset(isp1362_hcd);
        spin_unlock_irqrestore(&isp1362_hcd->lock, flags);
 }
@@ -2418,7 +2423,7 @@ static void isp1362_hc_stop(struct usb_hcd *hcd)
        if (isp1362_hcd->board && isp1362_hcd->board->reset)
                isp1362_hcd->board->reset(hcd->self.controller, 1);
        else
-                isp1362_sw_reset(isp1362_hcd);
+                __isp1362_sw_reset(isp1362_hcd);
        if (isp1362_hcd->board && isp1362_hcd->board->clock)
                isp1362_hcd->board->clock(hcd->self.controller, 0);
diff --git a/drivers/usb/host/r8a66597-hcd.c b/drivers/usb/host/r8a66597-hcd.c
index 1a2bb4ce638f..77be3c24a427 100644
--- a/drivers/usb/host/r8a66597-hcd.c
+++ b/drivers/usb/host/r8a66597-hcd.c
@@ -1065,7 +1065,7 @@ static void r8a66597_usb_connect(struct r8a66597 *r8a66597, int port)
        else if (speed == LSMODE)
                rh->port |= USB_PORT_STAT_LOW_SPEED;
-        rh->port &= USB_PORT_STAT_RESET;
+        rh->port &= ~USB_PORT_STAT_RESET;
        rh->port |= USB_PORT_STAT_ENABLE;
 }
diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index 9012098add6b..94e6934edb09 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -182,8 +182,12 @@ static void inc_deq(struct xhci_hcd *xhci, struct xhci_ring *ring, bool consumer
 * set, but other sections talk about dealing with the chain bit set.  This was
 * fixed in the 0.96 specification errata, but we have to assume that all 0.95
 * xHCI hardware can't handle the chain bit being cleared on a link TRB.
+ *
+ * @more_trbs_coming:   Will you enqueue more TRBs before calling
+ *                      prepare_transfer()?
 */
-static void inc_enq(struct xhci_hcd *xhci, struct xhci_ring *ring, bool consumer)
+static void inc_enq(struct xhci_hcd *xhci, struct xhci_ring *ring,
+                bool consumer, bool more_trbs_coming)
 {
        u32 chain;
        union xhci_trb *next;
@@ -199,15 +203,28 @@ static void inc_enq(struct xhci_hcd *xhci, struct xhci_ring *ring, bool consumer
        while (last_trb(xhci, ring, ring->enq_seg, next)) {
                if (!consumer) {
                        if (ring != xhci->event_ring) {
-                                if (chain) {
+                                /*
-                                        next->link.control |= TRB_CHAIN;
+                                 * If the caller doesn't plan on enqueueing more
+                                 * TDs before ringing the doorbell, then we
-                                        /* Give this link TRB to the hardware */
+                                 * don't want to give the link TRB to the
-                                        wmb();
+                                 * hardware just yet.  We'll give the link TRB
-                                        next->link.control ^= TRB_CYCLE;
+                                 * back in prepare_ring() just before we enqueue
-                                } else {
+                                 * the TD at the top of the ring.
+                                 */
+                                if (!chain && !more_trbs_coming)
                                        break;
+                                /* If we're not dealing with 0.95 hardware,
+                                 * carry over the chain bit of the previous TRB
+                                 * (which may mean the chain bit is cleared).
+                                 */
+                                if (!xhci_link_trb_quirk(xhci)) {
+                                        next->link.control &= ~TRB_CHAIN;
+                                        next->link.control |= chain;
                                }
+                                /* Give this link TRB to the hardware */
+                                wmb();
+                                next->link.control ^= TRB_CYCLE;
                        }
                        /* Toggle the cycle bit after the last ring segment. */
                        if (last_trb_on_last_seg(xhci, ring, ring->enq_seg, next)) {
@@ -1707,9 +1724,12 @@ void xhci_handle_event(struct xhci_hcd *xhci)
 /*
 * Generic function for queueing a TRB on a ring.
 * The caller must have checked to make sure there's room on the ring.
+ *
+ * @more_trbs_coming:   Will you enqueue more TRBs before calling
+ *                      prepare_transfer()?
 */
 static void queue_trb(struct xhci_hcd *xhci, struct xhci_ring *ring,
-                bool consumer,
+                bool consumer, bool more_trbs_coming,
                u32 field1, u32 field2, u32 field3, u32 field4)
 {
        struct xhci_generic_trb *trb;
@@ -1719,7 +1739,7 @@ static void queue_trb(struct xhci_hcd *xhci, struct xhci_ring *ring,
        trb->field[1] = field2;
        trb->field[2] = field3;
        trb->field[3] = field4;
-        inc_enq(xhci, ring, consumer);
+        inc_enq(xhci, ring, consumer, more_trbs_coming);
 }
 /*
@@ -1988,6 +2008,7 @@ static int queue_bulk_sg_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
        int trb_buff_len, this_sg_len, running_total;
        bool first_trb;
        u64 addr;
+        bool more_trbs_coming;
        struct xhci_generic_trb *start_trb;
        int start_cycle;
@@ -2073,7 +2094,11 @@ static int queue_bulk_sg_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
                length_field = TRB_LEN(trb_buff_len) |
                        remainder |
                        TRB_INTR_TARGET(0);
-                queue_trb(xhci, ep_ring, false,
+                if (num_trbs > 1)
+                        more_trbs_coming = true;
+                else
+                        more_trbs_coming = false;
+                queue_trb(xhci, ep_ring, false, more_trbs_coming,
                                lower_32_bits(addr),
                                upper_32_bits(addr),
                                length_field,
@@ -2124,6 +2149,7 @@ int xhci_queue_bulk_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
        int num_trbs;
        struct xhci_generic_trb *start_trb;
        bool first_trb;
+        bool more_trbs_coming;
        int start_cycle;
        u32 field, length_field;
@@ -2212,7 +2238,11 @@ int xhci_queue_bulk_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
                length_field = TRB_LEN(trb_buff_len) |
                        remainder |
                        TRB_INTR_TARGET(0);
-                queue_trb(xhci, ep_ring, false,
+                if (num_trbs > 1)
+                        more_trbs_coming = true;
+                else
+                        more_trbs_coming = false;
+                queue_trb(xhci, ep_ring, false, more_trbs_coming,
                                lower_32_bits(addr),
                                upper_32_bits(addr),
                                length_field,
@@ -2291,7 +2321,7 @@ int xhci_queue_ctrl_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
        /* Queue setup TRB - see section 6.4.1.2.1 */
        /* FIXME better way to translate setup_packet into two u32 fields? */
        setup = (struct usb_ctrlrequest *) urb->setup_packet;
-        queue_trb(xhci, ep_ring, false,
+        queue_trb(xhci, ep_ring, false, true,
                        /* FIXME endianness is probably going to bite my ass here. */
                        setup->bRequestType | setup->bRequest << 8 | setup->wValue << 16,
                        setup->wIndex | setup->wLength << 16,
@@ -2307,7 +2337,7 @@ int xhci_queue_ctrl_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
        if (urb->transfer_buffer_length > 0) {
                if (setup->bRequestType & USB_DIR_IN)
                        field |= TRB_DIR_IN;
-                queue_trb(xhci, ep_ring, false,
+                queue_trb(xhci, ep_ring, false, true,
                                lower_32_bits(urb->transfer_dma),
                                upper_32_bits(urb->transfer_dma),
                                length_field,
@@ -2324,7 +2354,7 @@ int xhci_queue_ctrl_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
                field = 0;
        else
                field = TRB_DIR_IN;
-        queue_trb(xhci, ep_ring, false,
+        queue_trb(xhci, ep_ring, false, false,
                        0,
                        0,
                        TRB_INTR_TARGET(0),
@@ -2361,7 +2391,7 @@ static int queue_command(struct xhci_hcd *xhci, u32 field1, u32 field2,
                                        "unfailable commands failed.\n");
                return -ENOMEM;
        }
-        queue_trb(xhci, xhci->cmd_ring, false, field1, field2, field3,
+        queue_trb(xhci, xhci->cmd_ring, false, false, field1, field2, field3,
                        field4 | xhci->cmd_ring->cycle_state);
        return 0;
 }
diff --git a/drivers/usb/musb/musb_core.c b/drivers/usb/musb/musb_core.c
index fad70bc83555..3b795c56221f 100644
--- a/drivers/usb/musb/musb_core.c
+++ b/drivers/usb/musb/musb_core.c
@@ -219,8 +219,8 @@ static int musb_ulpi_write(struct otg_transceiver *otg,
        return 0;
 }
 #else
-#define musb_ulpi_read(a, b)            NULL
+#define musb_ulpi_read          NULL
-#define musb_ulpi_write(a, b, c)        NULL
+#define musb_ulpi_write         NULL
 #endif
 static struct otg_io_access_ops musb_ulpi_access = {
@@ -451,10 +451,6 @@ void musb_hnp_stop(struct musb *musb)
 * @param power
 */
-#define STAGE0_MASK (MUSB_INTR_RESUME | MUSB_INTR_SESSREQ \
-                | MUSB_INTR_VBUSERROR | MUSB_INTR_CONNECT \
-                | MUSB_INTR_RESET)
 static irqreturn_t musb_stage0_irq(struct musb *musb, u8 int_usb,
                                u8 devctl, u8 power)
 {
@@ -642,7 +638,7 @@ static irqreturn_t musb_stage0_irq(struct musb *musb, u8 int_usb,
                handled = IRQ_HANDLED;
        }
+#endif
        if (int_usb & MUSB_INTR_SUSPEND) {
                DBG(1, "SUSPEND (%s) devctl %02x power %02x\n",
                                otg_state_string(musb), devctl, power);
@@ -705,6 +701,7 @@ static irqreturn_t musb_stage0_irq(struct musb *musb, u8 int_usb,
                }
        }
+#ifdef CONFIG_USB_MUSB_HDRC_HCD
        if (int_usb & MUSB_INTR_CONNECT) {
                struct usb_hcd *hcd = musb_to_hcd(musb);
                void __iomem *mbase = musb->mregs;
@@ -1597,7 +1594,7 @@ irqreturn_t musb_interrupt(struct musb *musb)
        /* the core can interrupt us for multiple reasons; docs have
         * a generic interrupt flowchart to follow
         */
-        if (musb->int_usb & STAGE0_MASK)
+        if (musb->int_usb)
                retval |= musb_stage0_irq(musb, musb->int_usb,
                                devctl, power);
diff --git a/drivers/usb/musb/musb_core.h b/drivers/usb/musb/musb_core.h
index b22d02dea7d3..91d67794e350 100644
--- a/drivers/usb/musb/musb_core.h
+++ b/drivers/usb/musb/musb_core.h
@@ -470,7 +470,8 @@ struct musb_csr_regs {
 struct musb_context_registers {
-#ifdef CONFIG_PM
+#if defined(CONFIG_ARCH_OMAP2430) || defined(CONFIG_ARCH_OMAP3) || \
+    defined(CONFIG_ARCH_OMAP4)
        u32 otg_sysconfig, otg_forcestandby;
 #endif
        u8 power;
@@ -484,7 +485,8 @@ struct musb_context_registers {
        struct musb_csr_regs index_regs[MUSB_C_NUM_EPS];
 };
-#ifdef CONFIG_PM
+#if defined(CONFIG_ARCH_OMAP2430) || defined(CONFIG_ARCH_OMAP3) || \
+    defined(CONFIG_ARCH_OMAP4)
 extern void musb_platform_save_context(struct musb *musb,
                struct musb_context_registers *musb_context);
 extern void musb_platform_restore_context(struct musb *musb,
diff --git a/drivers/usb/musb/musbhsdma.c b/drivers/usb/musb/musbhsdma.c
index 1008044a3bbc..dc66e4376d49 100644
--- a/drivers/usb/musb/musbhsdma.c
+++ b/drivers/usb/musb/musbhsdma.c
@@ -132,18 +132,9 @@ static void configure_channel(struct dma_channel *channel,
        if (mode) {
                csr |= 1 << MUSB_HSDMA_MODE1_SHIFT;
                BUG_ON(len < packet_sz);
-                if (packet_sz >= 64) {
-                        csr |= MUSB_HSDMA_BURSTMODE_INCR16
-                                        << MUSB_HSDMA_BURSTMODE_SHIFT;
-                } else if (packet_sz >= 32) {
-                        csr |= MUSB_HSDMA_BURSTMODE_INCR8
-                                        << MUSB_HSDMA_BURSTMODE_SHIFT;
-                } else if (packet_sz >= 16) {
-                        csr |= MUSB_HSDMA_BURSTMODE_INCR4
-                                        << MUSB_HSDMA_BURSTMODE_SHIFT;
-                }
        }
+        csr |= MUSB_HSDMA_BURSTMODE_INCR16
+                                << MUSB_HSDMA_BURSTMODE_SHIFT;
        csr |= (musb_channel->epnum << MUSB_HSDMA_ENDPOINT_SHIFT)
                | (1 << MUSB_HSDMA_ENABLE_SHIFT)
diff --git a/drivers/usb/otg/ulpi.c b/drivers/usb/otg/ulpi.c
index b1b346932946..d331b222ad21 100644
--- a/drivers/usb/otg/ulpi.c
+++ b/drivers/usb/otg/ulpi.c
@@ -59,12 +59,17 @@ static int ulpi_set_flags(struct otg_transceiver *otg)
 static int ulpi_init(struct otg_transceiver *otg)
 {
-        int i, vid, pid;
+        int i, vid, pid, ret;
+        u32 ulpi_id = 0;
-        vid = (otg_io_read(otg, ULPI_VENDOR_ID_HIGH) << 8) |
-               otg_io_read(otg, ULPI_VENDOR_ID_LOW);
+        for (i = 0; i < 4; i++) {
-        pid = (otg_io_read(otg, ULPI_PRODUCT_ID_HIGH) << 8) |
+                ret = otg_io_read(otg, ULPI_PRODUCT_ID_HIGH - i);
-               otg_io_read(otg, ULPI_PRODUCT_ID_LOW);
+                if (ret < 0)
+                        return ret;
+                ulpi_id = (ulpi_id << 8) | ret;
+        }
+        vid = ulpi_id & 0xffff;
+        pid = ulpi_id >> 16;
        pr_info("ULPI transceiver vendor/product ID 0x%04x/0x%04x\n", vid, pid);
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index 79dd1ae195e5..da7e334b0407 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -653,7 +653,6 @@ static struct usb_device_id id_table_combined [] = {
        { USB_DEVICE(EVOLUTION_VID, EVOLUTION_ER1_PID) },
        { USB_DEVICE(EVOLUTION_VID, EVO_HYBRID_PID) },
        { USB_DEVICE(EVOLUTION_VID, EVO_RCM4_PID) },
-        { USB_DEVICE(CONTEC_VID, CONTEC_COM1USBH_PID) },
        { USB_DEVICE(FTDI_VID, FTDI_ARTEMIS_PID) },
        { USB_DEVICE(FTDI_VID, FTDI_ATIK_ATK16_PID) },
        { USB_DEVICE(FTDI_VID, FTDI_ATIK_ATK16C_PID) },
diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
index 94d86c3febcb..bbc159a1df45 100644
--- a/drivers/usb/serial/ftdi_sio_ids.h
+++ b/drivers/usb/serial/ftdi_sio_ids.h
@@ -501,13 +501,6 @@
 #define CONTEC_COM1USBH_PID     0x8311  /* COM-1(USB)H */
 /*
- * Contec products (http://www.contec.com)
- * Submitted by Daniel Sangorrin
- */
-#define CONTEC_VID              0x06CE  /* Vendor ID */
-#define CONTEC_COM1USBH_PID     0x8311  /* COM-1(USB)H */
-/*
 * Definitions for B&B Electronics products.
 */
 #define BANDB_VID               0x0856  /* B&B Electronics Vendor ID */
diff --git a/drivers/usb/serial/qcserial.c b/drivers/usb/serial/qcserial.c
index 04bb759536bb..93d72eb8cafc 100644
--- a/drivers/usb/serial/qcserial.c
+++ b/drivers/usb/serial/qcserial.c
@@ -139,6 +139,7 @@ static int qcprobe(struct usb_serial *serial, const struct usb_device_id *id)
                                        "Could not set interface, error %d\n",
                                        retval);
                                retval = -ENODEV;
+                                kfree(data);
                        }
                        return retval;
                }
@@ -155,6 +156,7 @@ static int qcprobe(struct usb_serial *serial, const struct usb_device_id *id)
                                        "Could not set interface, error %d\n",
                                        retval);
                                retval = -ENODEV;
+                                kfree(data);
                        }
                        return retval;
                }
@@ -163,6 +165,7 @@ static int qcprobe(struct usb_serial *serial, const struct usb_device_id *id)
        default:
                dev_err(&serial->dev->dev,
                        "unknown number of interfaces: %d\n", nintf);
+                kfree(data);
                return -ENODEV;
        }
diff --git a/drivers/video/geode/gxfb_core.c b/drivers/video/geode/gxfb_core.c
index 76e7dac6f259..70b1d9d51c96 100644
--- a/drivers/video/geode/gxfb_core.c
+++ b/drivers/video/geode/gxfb_core.c
@@ -40,7 +40,7 @@ static int vram;
 static int vt_switch;
 /* Modes relevant to the GX (taken from modedb.c) */
-static struct fb_videomode gx_modedb[] __initdata = {
+static struct fb_videomode gx_modedb[] __devinitdata = {
        /* 640x480-60 VESA */
        { NULL, 60, 640, 480, 39682,  48, 16, 33, 10, 96, 2,
          0, FB_VMODE_NONINTERLACED, FB_MODE_IS_VESA },
@@ -110,14 +110,15 @@ static struct fb_videomode gx_modedb[] __initdata = {
 #ifdef CONFIG_OLPC
 #include <asm/olpc.h>
-static struct fb_videomode gx_dcon_modedb[] __initdata = {
+static struct fb_videomode gx_dcon_modedb[] __devinitdata = {
        /* The only mode the DCON has is 1200x900 */
        { NULL, 50, 1200, 900, 17460, 24, 8, 4, 5, 8, 3,
          FB_SYNC_HOR_HIGH_ACT | FB_SYNC_VERT_HIGH_ACT,
          FB_VMODE_NONINTERLACED, 0 }
 };
-static void __init get_modedb(struct fb_videomode **modedb, unsigned int *size)
+static void __devinit get_modedb(struct fb_videomode **modedb,
+                unsigned int *size)
 {
        if (olpc_has_dcon()) {
                *modedb = (struct fb_videomode *) gx_dcon_modedb;
@@ -129,7 +130,8 @@ static void __init get_modedb(struct fb_videomode **modedb, unsigned int *size)
 }
 #else
-static void __init get_modedb(struct fb_videomode **modedb, unsigned int *size)
+static void __devinit get_modedb(struct fb_videomode **modedb,
+                unsigned int *size)
 {
        *modedb = (struct fb_videomode *) gx_modedb;
        *size = ARRAY_SIZE(gx_modedb);
@@ -226,7 +228,8 @@ static int gxfb_blank(int blank_mode, struct fb_info *info)
        return gx_blank_display(info, blank_mode);
 }
-static int __init gxfb_map_video_memory(struct fb_info *info, struct pci_dev *dev)
+static int __devinit gxfb_map_video_memory(struct fb_info *info,
+                struct pci_dev *dev)
 {
        struct gxfb_par *par = info->par;
        int ret;
@@ -290,7 +293,7 @@ static struct fb_ops gxfb_ops = {
        .fb_imageblit   = cfb_imageblit,
 };
-static struct fb_info * __init gxfb_init_fbinfo(struct device *dev)
+static struct fb_info *__devinit gxfb_init_fbinfo(struct device *dev)
 {
        struct gxfb_par *par;
        struct fb_info *info;
@@ -371,7 +374,8 @@ static int gxfb_resume(struct pci_dev *pdev)
 }
 #endif
-static int __init gxfb_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+static int __devinit gxfb_probe(struct pci_dev *pdev,
+                const struct pci_device_id *id)
 {
        struct gxfb_par *par;
        struct fb_info *info;
@@ -451,7 +455,7 @@ static int __init gxfb_probe(struct pci_dev *pdev, const struct pci_device_id *i
        return ret;
 }
-static void gxfb_remove(struct pci_dev *pdev)
+static void __devexit gxfb_remove(struct pci_dev *pdev)
 {
        struct fb_info *info = pci_get_drvdata(pdev);
        struct gxfb_par *par = info->par;
diff --git a/drivers/video/geode/lxfb_core.c b/drivers/video/geode/lxfb_core.c
index 1a18da86d3fa..39bdbedf43b4 100644
--- a/drivers/video/geode/lxfb_core.c
+++ b/drivers/video/geode/lxfb_core.c
@@ -35,7 +35,7 @@ static int vt_switch;
 * we try to make it something sane - 640x480-60 is sane
 */
-static struct fb_videomode geode_modedb[] __initdata = {
+static struct fb_videomode geode_modedb[] __devinitdata = {
        /* 640x480-60 */
        { NULL, 60, 640, 480, 39682, 48, 8, 25, 2, 88, 2,
          FB_SYNC_HOR_HIGH_ACT | FB_SYNC_VERT_HIGH_ACT,
@@ -219,14 +219,15 @@ static struct fb_videomode geode_modedb[] __initdata = {
 #ifdef CONFIG_OLPC
 #include <asm/olpc.h>
-static struct fb_videomode olpc_dcon_modedb[] __initdata = {
+static struct fb_videomode olpc_dcon_modedb[] __devinitdata = {
        /* The only mode the DCON has is 1200x900 */
        { NULL, 50, 1200, 900, 17460, 24, 8, 4, 5, 8, 3,
          FB_SYNC_HOR_HIGH_ACT | FB_SYNC_VERT_HIGH_ACT,
          FB_VMODE_NONINTERLACED, 0 }
 };
-static void __init get_modedb(struct fb_videomode **modedb, unsigned int *size)
+static void __devinit get_modedb(struct fb_videomode **modedb,
+                unsigned int *size)
 {
        if (olpc_has_dcon()) {
                *modedb = (struct fb_videomode *) olpc_dcon_modedb;
@@ -238,7 +239,8 @@ static void __init get_modedb(struct fb_videomode **modedb, unsigned int *size)
 }
 #else
-static void __init get_modedb(struct fb_videomode **modedb, unsigned int *size)
+static void __devinit get_modedb(struct fb_videomode **modedb,
+                unsigned int *size)
 {
        *modedb = (struct fb_videomode *) geode_modedb;
        *size = ARRAY_SIZE(geode_modedb);
@@ -334,7 +336,7 @@ static int lxfb_blank(int blank_mode, struct fb_info *info)
 }
-static int __init lxfb_map_video_memory(struct fb_info *info,
+static int __devinit lxfb_map_video_memory(struct fb_info *info,
                                        struct pci_dev *dev)
 {
        struct lxfb_par *par = info->par;
@@ -412,7 +414,7 @@ static struct fb_ops lxfb_ops = {
        .fb_imageblit   = cfb_imageblit,
 };
-static struct fb_info * __init lxfb_init_fbinfo(struct device *dev)
+static struct fb_info * __devinit lxfb_init_fbinfo(struct device *dev)
 {
        struct lxfb_par *par;
        struct fb_info *info;
@@ -496,7 +498,7 @@ static int lxfb_resume(struct pci_dev *pdev)
 #define lxfb_resume NULL
 #endif
-static int __init lxfb_probe(struct pci_dev *pdev,
+static int __devinit lxfb_probe(struct pci_dev *pdev,
                             const struct pci_device_id *id)
 {
        struct lxfb_par *par;
@@ -588,7 +590,7 @@ err:
        return ret;
 }
-static void lxfb_remove(struct pci_dev *pdev)
+static void __devexit lxfb_remove(struct pci_dev *pdev)
 {
        struct fb_info *info = pci_get_drvdata(pdev);
        struct lxfb_par *par = info->par;
diff --git a/drivers/video/nuc900fb.c b/drivers/video/nuc900fb.c
index d4cde79ea15e..81687ed26ba9 100644
--- a/drivers/video/nuc900fb.c
+++ b/drivers/video/nuc900fb.c
@@ -596,8 +596,6 @@ static int __devinit nuc900fb_probe(struct platform_device *pdev)
                goto release_regs;
        }
-        nuc900_driver_clksrc_div(&pdev->dev, "ext", 0x2);
        fbi->clk = clk_get(&pdev->dev, NULL);
        if (!fbi->clk || IS_ERR(fbi->clk)) {
                printk(KERN_ERR "nuc900-lcd:failed to get lcd clock source\n");