Merge branch 'master' of /home/trondmy/kernel/linux-2.6/

Conflicts:

	fs/nfs/inode.c
	fs/super.c

Fix conflicts between patch 'NFS: Split fs/nfs/inode.c' and patch
'VFS: Permit filesystem to override root dentry on mount'

113 files changed, 3799 insertions, 2062 deletions

diff --git a/drivers/usb/Makefile b/drivers/usb/Makefile
index 9b7d9769fdc..c7123bf71c5 100644
--- a/drivers/usb/Makefile
+++ b/drivers/usb/Makefile
@@ -48,6 +48,7 @@ obj-$(CONFIG_USB_MICROTEK)	+= image/
 obj-$(CONFIG_USB_SERIAL)	+= serial/
 
 obj-$(CONFIG_USB_AUERSWALD)	+= misc/
+obj-$(CONFIG_USB_CY7C63)	+= misc/
 obj-$(CONFIG_USB_CYTHERM)	+= misc/
 obj-$(CONFIG_USB_EMI26)		+= misc/
 obj-$(CONFIG_USB_EMI62)		+= misc/
@@ -61,6 +62,7 @@ obj-$(CONFIG_USB_TEST)		+= misc/
 obj-$(CONFIG_USB_USS720)	+= misc/
 obj-$(CONFIG_USB_PHIDGETSERVO)	+= misc/
 obj-$(CONFIG_USB_SISUSBVGA)	+= misc/
+obj-$(CONFIG_USB_APPLEDISPLAY)	+= misc/
 
 obj-$(CONFIG_USB_ATM)		+= atm/
 obj-$(CONFIG_USB_SPEEDTOUCH)	+= atm/
diff --git a/drivers/usb/atm/usbatm.c b/drivers/usb/atm/usbatm.c
index 546249843b8..a38701c742c 100644
--- a/drivers/usb/atm/usbatm.c
+++ b/drivers/usb/atm/usbatm.c
@@ -1039,7 +1039,7 @@ static void usbatm_tasklet_schedule(unsigned long data)
 	tasklet_schedule((struct tasklet_struct *) data);
 }
 
-static inline void usbatm_init_channel(struct usbatm_channel *channel)
+static void usbatm_init_channel(struct usbatm_channel *channel)
 {
 	spin_lock_init(&channel->lock);
 	INIT_LIST_HEAD(&channel->list);
diff --git a/drivers/usb/atm/xusbatm.c b/drivers/usb/atm/xusbatm.c
index 42d6823b82b..70125c6d3be 100644
--- a/drivers/usb/atm/xusbatm.c
+++ b/drivers/usb/atm/xusbatm.c
@@ -20,7 +20,6 @@
  ******************************************************************************/
 
 #include <linux/module.h>
-#include <linux/netdevice.h>		/* FIXME: required by linux/etherdevice.h */
 #include <linux/etherdevice.h>		/* for random_ether_addr() */
 
 #include "usbatm.h"
diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index 6dd339f4c0f..d41dc67ba4c 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -63,7 +63,7 @@
 #include <linux/mutex.h>
 #include <asm/uaccess.h>
 #include <linux/usb.h>
-#include <linux/usb_cdc.h>
+#include <linux/usb/cdc.h>
 #include <asm/byteorder.h>
 #include <asm/unaligned.h>
 #include <linux/list.h>
@@ -127,8 +127,8 @@ static int acm_wb_alloc(struct acm *acm)
 			wb->use = 1;
 			return wbn;
 		}
-		wbn = (wbn + 1) % ACM_NWB;
-		if (++i >= ACM_NWB)
+		wbn = (wbn + 1) % ACM_NW;
+		if (++i >= ACM_NW)
 			return -1;
 	}
 }
@@ -142,10 +142,9 @@ static int acm_wb_is_avail(struct acm *acm)
 {
 	int i, n;
 
-	n = 0;
-	for (i = 0; i < ACM_NWB; i++) {
-		if (!acm->wb[i].use)
-			n++;
+	n = ACM_NW;
+	for (i = 0; i < ACM_NW; i++) {
+		n -= acm->wb[i].use;
 	}
 	return n;
 }
@@ -167,7 +166,7 @@ static void acm_write_done(struct acm *acm)
 	acm->write_ready = 1;
 	wbn = acm->write_current;
 	acm_wb_free(acm, wbn);
-	acm->write_current = (wbn + 1) % ACM_NWB;
+	acm->write_current = (wbn + 1) % ACM_NW;
 	spin_unlock_irqrestore(&acm->write_lock, flags);
 }
 
@@ -291,22 +290,32 @@ static void acm_read_bulk(struct urb *urb, struct pt_regs *regs)
 	struct acm_rb *buf;
 	struct acm_ru *rcv = urb->context;
 	struct acm *acm = rcv->instance;
+	int status = urb->status;
 	dbg("Entering acm_read_bulk with status %d\n", urb->status);
 
 	if (!ACM_READY(acm))
 		return;
 
-	if (urb->status)
-		dev_dbg(&acm->data->dev, "bulk rx status %d\n", urb->status);
+	if (status)
+		dev_dbg(&acm->data->dev, "bulk rx status %d\n", status);
 
 	buf = rcv->buffer;
 	buf->size = urb->actual_length;
 
-	spin_lock(&acm->read_lock);
-	list_add_tail(&rcv->list, &acm->spare_read_urbs);
-	list_add_tail(&buf->list, &acm->filled_read_bufs);
-	spin_unlock(&acm->read_lock);
-
+	if (likely(status == 0)) {
+		spin_lock(&acm->read_lock);
+		list_add_tail(&rcv->list, &acm->spare_read_urbs);
+		list_add_tail(&buf->list, &acm->filled_read_bufs);
+		spin_unlock(&acm->read_lock);
+	} else {
+		/* we drop the buffer due to an error */
+		spin_lock(&acm->read_lock);
+		list_add_tail(&rcv->list, &acm->spare_read_urbs);
+		list_add(&buf->list, &acm->spare_read_bufs);
+		spin_unlock(&acm->read_lock);
+		/* nevertheless the tasklet must be kicked unconditionally
+		so the queue cannot dry up */
+	}
 	tasklet_schedule(&acm->urb_task);
 }
 
@@ -464,10 +473,10 @@ static int acm_tty_open(struct tty_struct *tty, struct file *filp)
 	INIT_LIST_HEAD(&acm->spare_read_urbs);
 	INIT_LIST_HEAD(&acm->spare_read_bufs);
 	INIT_LIST_HEAD(&acm->filled_read_bufs);
-	for (i = 0; i < ACM_NRU; i++) {
+	for (i = 0; i < acm->rx_buflimit; i++) {
 		list_add(&(acm->ru[i].list), &acm->spare_read_urbs);
 	}
-	for (i = 0; i < ACM_NRB; i++) {
+	for (i = 0; i < acm->rx_buflimit; i++) {
 		list_add(&(acm->rb[i].list), &acm->spare_read_bufs);
 	}
 
@@ -488,14 +497,15 @@ bail_out:
 
 static void acm_tty_unregister(struct acm *acm)
 {
-	int i;
+	int i,nr;
 
+	nr = acm->rx_buflimit;
 	tty_unregister_device(acm_tty_driver, acm->minor);
 	usb_put_intf(acm->control);
 	acm_table[acm->minor] = NULL;
 	usb_free_urb(acm->ctrlurb);
 	usb_free_urb(acm->writeurb);
-	for (i = 0; i < ACM_NRU; i++)
+	for (i = 0; i < nr; i++)
 		usb_free_urb(acm->ru[i].urb);
 	kfree(acm);
 }
@@ -503,18 +513,19 @@ static void acm_tty_unregister(struct acm *acm)
 static void acm_tty_close(struct tty_struct *tty, struct file *filp)
 {
 	struct acm *acm = tty->driver_data;
-	int i;
+	int i,nr;
 
 	if (!acm || !acm->used)
 		return;
 
+	nr = acm->rx_buflimit;
 	mutex_lock(&open_mutex);
 	if (!--acm->used) {
 		if (acm->dev) {
 			acm_set_control(acm, acm->ctrlout = 0);
 			usb_kill_urb(acm->ctrlurb);
 			usb_kill_urb(acm->writeurb);
-			for (i = 0; i < ACM_NRU; i++)
+			for (i = 0; i < nr; i++)
 				usb_kill_urb(acm->ru[i].urb);
 		} else
 			acm_tty_unregister(acm);
@@ -576,7 +587,7 @@ static int acm_tty_chars_in_buffer(struct tty_struct *tty)
 	/*
 	 * This is inaccurate (overcounts), but it works.
 	 */
-	return (ACM_NWB - acm_wb_is_avail(acm)) * acm->writesize;
+	return (ACM_NW - acm_wb_is_avail(acm)) * acm->writesize;
 }
 
 static void acm_tty_throttle(struct tty_struct *tty)
@@ -712,7 +723,7 @@ static void acm_write_buffers_free(struct acm *acm)
 	int i;
 	struct acm_wb *wb;
 
-	for (wb = &acm->wb[0], i = 0; i < ACM_NWB; i++, wb++) {
+	for (wb = &acm->wb[0], i = 0; i < ACM_NW; i++, wb++) {
 		usb_buffer_free(acm->dev, acm->writesize, wb->buf, wb->dmah);
 	}
 }
@@ -723,7 +734,7 @@ static int acm_write_buffers_alloc(struct acm *acm)
 	int i;
 	struct acm_wb *wb;
 
-	for (wb = &acm->wb[0], i = 0; i < ACM_NWB; i++, wb++) {
+	for (wb = &acm->wb[0], i = 0; i < ACM_NW; i++, wb++) {
 		wb->buf = usb_buffer_alloc(acm->dev, acm->writesize, GFP_KERNEL,
 		    &wb->dmah);
 		if (!wb->buf) {
@@ -760,10 +771,14 @@ static int acm_probe (struct usb_interface *intf,
 	int call_interface_num = -1;
 	int data_interface_num;
 	unsigned long quirks;
+	int num_rx_buf;
 	int i;
 
-	/* handle quirks deadly to normal probing*/
+	/* normal quirks */
 	quirks = (unsigned long)id->driver_info;
+	num_rx_buf = (quirks == SINGLE_RX_URB) ? 1 : ACM_NR;
+
+	/* handle quirks deadly to normal probing*/
 	if (quirks == NO_UNION_NORMAL) {
 		data_interface = usb_ifnum_to_if(usb_dev, 1);
 		control_interface = usb_ifnum_to_if(usb_dev, 0);
@@ -900,7 +915,7 @@ skip_normal_probe:
 	}
 
 	ctrlsize = le16_to_cpu(epctrl->wMaxPacketSize);
-	readsize = le16_to_cpu(epread->wMaxPacketSize)*2;
+	readsize = le16_to_cpu(epread->wMaxPacketSize)* ( quirks == SINGLE_RX_URB ? 1 : 2);
 	acm->writesize = le16_to_cpu(epwrite->wMaxPacketSize);
 	acm->control = control_interface;
 	acm->data = data_interface;
@@ -909,6 +924,7 @@ skip_normal_probe:
 	acm->ctrl_caps = ac_management_function;
 	acm->ctrlsize = ctrlsize;
 	acm->readsize = readsize;
+	acm->rx_buflimit = num_rx_buf;
 	acm->urb_task.func = acm_rx_tasklet;
 	acm->urb_task.data = (unsigned long) acm;
 	INIT_WORK(&acm->work, acm_softint, acm);
@@ -935,7 +951,7 @@ skip_normal_probe:
 		dev_dbg(&intf->dev, "out of memory (ctrlurb kmalloc)\n");
 		goto alloc_fail5;
 	}
-	for (i = 0; i < ACM_NRU; i++) {
+	for (i = 0; i < num_rx_buf; i++) {
 		struct acm_ru *rcv = &(acm->ru[i]);
 
 		if (!(rcv->urb = usb_alloc_urb(0, GFP_KERNEL))) {
@@ -946,10 +962,9 @@ skip_normal_probe:
 		rcv->urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
 		rcv->instance = acm;
 	}
-	for (i = 0; i < ACM_NRB; i++) {
+	for (i = 0; i < num_rx_buf; i++) {
 		struct acm_rb *buf = &(acm->rb[i]);
 
-		// Using usb_buffer_alloc instead of kmalloc as Oliver suggested
 		if (!(buf->base = usb_buffer_alloc(acm->dev, readsize, GFP_KERNEL, &buf->dma))) {
 			dev_dbg(&intf->dev, "out of memory (read bufs usb_buffer_alloc)\n");
 			goto alloc_fail7;
@@ -988,9 +1003,9 @@ skip_normal_probe:
 	return 0;
 
 alloc_fail7:
-	for (i = 0; i < ACM_NRB; i++)
+	for (i = 0; i < num_rx_buf; i++)
 		usb_buffer_free(usb_dev, acm->readsize, acm->rb[i].base, acm->rb[i].dma);
-	for (i = 0; i < ACM_NRU; i++)
+	for (i = 0; i < num_rx_buf; i++)
 		usb_free_urb(acm->ru[i].urb);
 	usb_free_urb(acm->ctrlurb);
 alloc_fail5:
@@ -1027,7 +1042,7 @@ static void acm_disconnect(struct usb_interface *intf)
 
 	usb_kill_urb(acm->ctrlurb);
 	usb_kill_urb(acm->writeurb);
-	for (i = 0; i < ACM_NRU; i++)
+	for (i = 0; i < acm->rx_buflimit; i++)
 		usb_kill_urb(acm->ru[i].urb);
 
 	INIT_LIST_HEAD(&acm->filled_read_bufs);
@@ -1039,7 +1054,7 @@ static void acm_disconnect(struct usb_interface *intf)
 
 	acm_write_buffers_free(acm);
 	usb_buffer_free(usb_dev, acm->ctrlsize, acm->ctrl_buffer, acm->ctrl_dma);
-	for (i = 0; i < ACM_NRB; i++)
+	for (i = 0; i < acm->rx_buflimit; i++)
 		usb_buffer_free(usb_dev, acm->readsize, acm->rb[i].base, acm->rb[i].dma);
 
 	usb_driver_release_interface(&acm_driver, intf == acm->control ? acm->data : intf);
@@ -1068,6 +1083,9 @@ static struct usb_device_id acm_ids[] = {
 	{ USB_DEVICE(0x0482, 0x0203), /* KYOCERA AH-K3001V */
 	.driver_info = NO_UNION_NORMAL, /* has no union descriptor */
 	},
+	{ USB_DEVICE(0x0ace, 0x1608), /* ZyDAS 56K USB MODEM */
+	.driver_info = SINGLE_RX_URB, /* firmware bug */
+	},
 	/* control interfaces with various AT-command sets */
 	{ USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_ACM,
 		USB_CDC_ACM_PROTO_AT_V25TER) },
diff --git a/drivers/usb/class/cdc-acm.h b/drivers/usb/class/cdc-acm.h
index fd2aaccdcba..1bcaea32cfc 100644
--- a/drivers/usb/class/cdc-acm.h
+++ b/drivers/usb/class/cdc-acm.h
@@ -56,11 +56,11 @@
  * in line disciplines. They ask for empty space amount, receive our URB size,
  * and proceed to issue several 1-character writes, assuming they will fit.
  * The very first write takes a complete URB. Fortunately, this only happens
- * when processing onlcr, so we only need 2 buffers.
+ * when processing onlcr, so we only need 2 buffers. These values must be
+ * powers of 2.
  */
-#define ACM_NWB  2
-#define ACM_NRU  16
-#define ACM_NRB  16
+#define ACM_NW  2
+#define ACM_NR  16
 
 struct acm_wb {
 	unsigned char *buf;
@@ -91,9 +91,10 @@ struct acm {
 	struct urb *ctrlurb, *writeurb;			/* urbs */
 	u8 *ctrl_buffer;				/* buffers of urbs */
 	dma_addr_t ctrl_dma;				/* dma handles of buffers */
-	struct acm_wb wb[ACM_NWB];
-	struct acm_ru ru[ACM_NRU];
-	struct acm_rb rb[ACM_NRB];
+	struct acm_wb wb[ACM_NW];
+	struct acm_ru ru[ACM_NR];
+	struct acm_rb rb[ACM_NR];
+	int rx_buflimit;
 	int rx_endpoint;
 	spinlock_t read_lock;
 	struct list_head spare_read_urbs;
@@ -122,3 +123,4 @@ struct acm {
 
 /* constants describing various quirks and errors */
 #define NO_UNION_NORMAL			1
+#define SINGLE_RX_URB			2
diff --git a/drivers/usb/core/Makefile b/drivers/usb/core/Makefile
index 28329ddf187..ec510922af6 100644
--- a/drivers/usb/core/Makefile
+++ b/drivers/usb/core/Makefile
@@ -3,7 +3,8 @@
 #
 
 usbcore-objs	:= usb.o hub.o hcd.o urb.o message.o driver.o \
-			config.o file.o buffer.o sysfs.o devio.o notify.o
+			config.o file.o buffer.o sysfs.o endpoint.o \
+			devio.o notify.o
 
 ifeq ($(CONFIG_PCI),y)
 	usbcore-objs	+= hcd-pci.o
diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
index 545da37afca..3f8e06279c9 100644
--- a/drivers/usb/core/devio.c
+++ b/drivers/usb/core/devio.c
@@ -515,19 +515,19 @@ static int check_ctrlrecip(struct dev_state *ps, unsigned int requesttype, unsig
 
 static struct usb_device *usbdev_lookup_minor(int minor)
 {
-	struct class_device *class_dev;
-	struct usb_device *dev = NULL;
+	struct device *device;
+	struct usb_device *udev = NULL;
 
 	down(&usb_device_class->sem);
-	list_for_each_entry(class_dev, &usb_device_class->children, node) {
-		if (class_dev->devt == MKDEV(USB_DEVICE_MAJOR, minor)) {
-			dev = class_dev->class_data;
+	list_for_each_entry(device, &usb_device_class->devices, node) {
+		if (device->devt == MKDEV(USB_DEVICE_MAJOR, minor)) {
+			udev = device->platform_data;
 			break;
 		}
 	}
 	up(&usb_device_class->sem);
 
-	return dev;
+	return udev;
 };
 
 /*
@@ -823,8 +823,7 @@ static int proc_connectinfo(struct dev_state *ps, void __user *arg)
 
 static int proc_resetdevice(struct dev_state *ps)
 {
-	return usb_reset_device(ps->dev);
-
+	return usb_reset_composite_device(ps->dev, NULL);
 }
 
 static int proc_setintf(struct dev_state *ps, void __user *arg)
@@ -923,8 +922,8 @@ static int proc_do_submiturb(struct dev_state *ps, struct usbdevfs_urb *uurb,
 		if ((ep->desc.bmAttributes & USB_ENDPOINT_XFERTYPE_MASK)
 				!= USB_ENDPOINT_XFER_CONTROL)
 			return -EINVAL;
-		/* min 8 byte setup packet, max arbitrary */
-		if (uurb->buffer_length < 8 || uurb->buffer_length > PAGE_SIZE)
+		/* min 8 byte setup packet, max 8 byte setup plus an arbitrary data stage */
+		if (uurb->buffer_length < 8 || uurb->buffer_length > (8 + MAX_USBFS_BUFFER_SIZE))
 			return -EINVAL;
 		if (!(dr = kmalloc(sizeof(struct usb_ctrlrequest), GFP_KERNEL)))
 			return -ENOMEM;
@@ -982,7 +981,8 @@ static int proc_do_submiturb(struct dev_state *ps, struct usbdevfs_urb *uurb,
 			return -EFAULT;
 		}
 		for (totlen = u = 0; u < uurb->number_of_packets; u++) {
-			if (isopkt[u].length > 1023) {
+			/* arbitrary limit, sufficient for USB 2.0 high-bandwidth iso */
+			if (isopkt[u].length > 8192) {
 				kfree(isopkt);
 				return -EINVAL;
 			}
@@ -1078,7 +1078,9 @@ static int proc_submiturb(struct dev_state *ps, void __user *arg)
 	if (copy_from_user(&uurb, arg, sizeof(uurb)))
 		return -EFAULT;
 
-	return proc_do_submiturb(ps, &uurb, (((struct usbdevfs_urb __user *)arg)->iso_frame_desc), arg);
+	return proc_do_submiturb(ps, &uurb,
+		(struct usbdevfs_iso_packet_desc __user *)uurb.iso_frame_desc,
+		arg);
 }
 
 static int proc_unlinkurb(struct dev_state *ps, void __user *arg)
@@ -1203,7 +1205,9 @@ static int proc_submiturb_compat(struct dev_state *ps, void __user *arg)
 	if (get_urb32(&uurb,(struct usbdevfs_urb32 *)arg))
 		return -EFAULT;
 
-	return proc_do_submiturb(ps, &uurb, ((struct usbdevfs_urb32 __user *)arg)->iso_frame_desc, arg);
+	return proc_do_submiturb(ps, &uurb,
+		(struct usbdevfs_iso_packet_desc __user *)uurb.iso_frame_desc,
+		arg);
 }
 
 static int processcompl_compat(struct async *as, void __user * __user *arg)
@@ -1576,16 +1580,16 @@ static void usbdev_add(struct usb_device *dev)
 {
 	int minor = ((dev->bus->busnum-1) * 128) + (dev->devnum-1);
 
-	dev->class_dev = class_device_create(usb_device_class, NULL,
-				MKDEV(USB_DEVICE_MAJOR, minor), &dev->dev,
+	dev->usbfs_dev = device_create(usb_device_class, &dev->dev,
+				MKDEV(USB_DEVICE_MAJOR, minor),
 				"usbdev%d.%d", dev->bus->busnum, dev->devnum);
 
-	dev->class_dev->class_data = dev;
+	dev->usbfs_dev->platform_data = dev;
 }
 
 static void usbdev_remove(struct usb_device *dev)
 {
-	class_device_unregister(dev->class_dev);
+	device_unregister(dev->usbfs_dev);
 }
 
 static int usbdev_notify(struct notifier_block *self, unsigned long action,
diff --git a/drivers/usb/core/endpoint.c b/drivers/usb/core/endpoint.c
new file mode 100644
index 00000000000..247b5a4913a
--- /dev/null
+++ b/drivers/usb/core/endpoint.c
@@ -0,0 +1,275 @@
+/*
+ * drivers/usb/core/endpoint.c
+ *
+ * (C) Copyright 2002,2004,2006 Greg Kroah-Hartman
+ * (C) Copyright 2002,2004 IBM Corp.
+ * (C) Copyright 2006 Novell Inc.
+ *
+ * Endpoint sysfs stuff
+ *
+ */
+
+#include <linux/kernel.h>
+#include <linux/usb.h>
+#include "usb.h"
+
+/* endpoint stuff */
+
+struct ep_device {
+	struct usb_endpoint_descriptor *desc;
+	struct usb_device *udev;
+	struct device dev;
+};
+#define to_ep_device(_dev) \
+	container_of(_dev, struct ep_device, dev)
+
+struct ep_attribute {
+	struct attribute attr;
+	ssize_t (*show)(struct usb_device *,
+			struct usb_endpoint_descriptor *, char *);
+};
+#define to_ep_attribute(_attr) \
+	container_of(_attr, struct ep_attribute, attr)
+
+#define usb_ep_attr(field, format_string)			\
+static ssize_t show_ep_##field(struct device *dev,		\
+			       struct device_attribute *attr,	\
+			       char *buf)			\
+{								\
+	struct ep_device *ep = to_ep_device(dev);		\
+	return sprintf(buf, format_string, ep->desc->field);	\
+}								\
+static DEVICE_ATTR(field, S_IRUGO, show_ep_##field, NULL);
+
+usb_ep_attr(bLength, "%02x\n")
+usb_ep_attr(bEndpointAddress, "%02x\n")
+usb_ep_attr(bmAttributes, "%02x\n")
+usb_ep_attr(bInterval, "%02x\n")
+
+static ssize_t show_ep_wMaxPacketSize(struct device *dev,
+				      struct device_attribute *attr, char *buf)
+{
+	struct ep_device *ep = to_ep_device(dev);
+	return sprintf(buf, "%04x\n",
+			le16_to_cpu(ep->desc->wMaxPacketSize) & 0x07ff);
+}
+static DEVICE_ATTR(wMaxPacketSize, S_IRUGO, show_ep_wMaxPacketSize, NULL);
+
+static ssize_t show_ep_type(struct device *dev, struct device_attribute *attr,
+			    char *buf)
+{
+	struct ep_device *ep = to_ep_device(dev);
+	char *type = "unknown";
+
+	switch (ep->desc->bmAttributes & USB_ENDPOINT_XFERTYPE_MASK) {
+	case USB_ENDPOINT_XFER_CONTROL:
+		type = "Control";
+		break;
+	case USB_ENDPOINT_XFER_ISOC:
+		type = "Isoc";
+		break;
+	case USB_ENDPOINT_XFER_BULK:
+		type = "Bulk";
+		break;
+	case USB_ENDPOINT_XFER_INT:
+		type = "Interrupt";
+		break;
+	}
+	return sprintf(buf, "%s\n", type);
+}
+static DEVICE_ATTR(type, S_IRUGO, show_ep_type, NULL);
+
+static ssize_t show_ep_interval(struct device *dev,
+				struct device_attribute *attr, char *buf)
+{
+	struct ep_device *ep = to_ep_device(dev);
+	char unit;
+	unsigned interval = 0;
+	unsigned in;
+
+	in = (ep->desc->bEndpointAddress & USB_DIR_IN);
+
+	switch (ep->desc->bmAttributes & USB_ENDPOINT_XFERTYPE_MASK) {
+	case USB_ENDPOINT_XFER_CONTROL:
+		if (ep->udev->speed == USB_SPEED_HIGH) 	/* uframes per NAK */
+			interval = ep->desc->bInterval;
+		break;
+	case USB_ENDPOINT_XFER_ISOC:
+		interval = 1 << (ep->desc->bInterval - 1);
+		break;
+	case USB_ENDPOINT_XFER_BULK:
+		if (ep->udev->speed == USB_SPEED_HIGH && !in) /* uframes per NAK */
+			interval = ep->desc->bInterval;
+		break;
+	case USB_ENDPOINT_XFER_INT:
+		if (ep->udev->speed == USB_SPEED_HIGH)
+			interval = 1 << (ep->desc->bInterval - 1);
+		else
+			interval = ep->desc->bInterval;
+		break;
+	}
+	interval *= (ep->udev->speed == USB_SPEED_HIGH) ? 125 : 1000;
+	if (interval % 1000)
+		unit = 'u';
+	else {
+		unit = 'm';
+		interval /= 1000;
+	}
+
+	return sprintf(buf, "%d%cs\n", interval, unit);
+}
+static DEVICE_ATTR(interval, S_IRUGO, show_ep_interval, NULL);
+
+static ssize_t show_ep_direction(struct device *dev,
+				 struct device_attribute *attr, char *buf)
+{
+	struct ep_device *ep = to_ep_device(dev);
+	char *direction;
+
+	if ((ep->desc->bmAttributes & USB_ENDPOINT_XFERTYPE_MASK) ==
+			USB_ENDPOINT_XFER_CONTROL)
+		direction = "both";
+	else if (ep->desc->bEndpointAddress & USB_DIR_IN)
+		direction = "in";
+	else
+		direction = "out";
+	return sprintf(buf, "%s\n", direction);
+}
+static DEVICE_ATTR(direction, S_IRUGO, show_ep_direction, NULL);
+
+static struct attribute *ep_dev_attrs[] = {
+	&dev_attr_bLength.attr,
+	&dev_attr_bEndpointAddress.attr,
+	&dev_attr_bmAttributes.attr,
+	&dev_attr_bInterval.attr,
+	&dev_attr_wMaxPacketSize.attr,
+	&dev_attr_interval.attr,
+	&dev_attr_type.attr,
+	&dev_attr_direction.attr,
+	NULL,
+};
+static struct attribute_group ep_dev_attr_grp = {
+	.attrs = ep_dev_attrs,
+};
+
+static struct endpoint_class {
+	struct kref kref;
+	struct class *class;
+} *ep_class;
+
+static int init_endpoint_class(void)
+{
+	int result = 0;
+
+	if (ep_class != NULL) {
+		kref_get(&ep_class->kref);
+		goto exit;
+	}
+
+	ep_class = kmalloc(sizeof(*ep_class), GFP_KERNEL);
+	if (!ep_class) {
+		result = -ENOMEM;
+		goto exit;
+	}
+
+	kref_init(&ep_class->kref);
+	ep_class->class = class_create(THIS_MODULE, "usb_endpoint");
+	if (IS_ERR(ep_class->class)) {
+		result = IS_ERR(ep_class->class);
+		kfree(ep_class);
+		ep_class = NULL;
+		goto exit;
+	}
+
+exit:
+	return result;
+}
+
+static void release_endpoint_class(struct kref *kref)
+{
+	/* Ok, we cheat as we know we only have one ep_class */
+	class_destroy(ep_class->class);
+	kfree(ep_class);
+	ep_class = NULL;
+}
+
+static void destroy_endpoint_class(void)
+{
+	if (ep_class)
+		kref_put(&ep_class->kref, release_endpoint_class);
+}
+
+static void ep_device_release(struct device *dev)
+{
+	struct ep_device *ep_dev = to_ep_device(dev);
+
+	dev_dbg(dev, "%s called for %s\n", __FUNCTION__, dev->bus_id);
+	kfree(ep_dev);
+}
+
+void usb_create_ep_files(struct device *parent,
+			 struct usb_host_endpoint *endpoint,
+			 struct usb_device *udev)
+{
+	char name[8];
+	struct ep_device *ep_dev;
+	int minor;
+	int retval;
+
+	retval = init_endpoint_class();
+	if (retval)
+		goto exit;
+
+	ep_dev = kzalloc(sizeof(*ep_dev), GFP_KERNEL);
+	if (!ep_dev) {
+		retval = -ENOMEM;
+		goto exit;
+	}
+
+	/* fun calculation to determine the minor of this endpoint */
+	minor = (((udev->bus->busnum - 1) * 128) * 16) + (udev->devnum - 1);
+
+	ep_dev->desc = &endpoint->desc;
+	ep_dev->udev = udev;
+	ep_dev->dev.devt = MKDEV(442, minor);	// FIXME fake number...
+	ep_dev->dev.class = ep_class->class;
+	ep_dev->dev.parent = parent;
+	ep_dev->dev.release = ep_device_release;
+	snprintf(ep_dev->dev.bus_id, BUS_ID_SIZE, "usbdev%d.%d_ep%02x",
+		 udev->bus->busnum, udev->devnum,
+		 endpoint->desc.bEndpointAddress);
+
+	retval = device_register(&ep_dev->dev);
+	if (retval)
+		goto error;
+	sysfs_create_group(&ep_dev->dev.kobj, &ep_dev_attr_grp);
+
+	endpoint->ep_dev = ep_dev;
+
+	/* create the symlink to the old-style "ep_XX" directory */
+	sprintf(name, "ep_%02x", endpoint->desc.bEndpointAddress);
+	sysfs_create_link(&parent->kobj, &endpoint->ep_dev->dev.kobj, name);
+
+exit:
+	return;
+error:
+	kfree(ep_dev);
+	return;
+}
+
+void usb_remove_ep_files(struct usb_host_endpoint *endpoint)
+{
+
+	if (endpoint->ep_dev) {
+		char name[8];
+
+		sprintf(name, "ep_%02x", endpoint->desc.bEndpointAddress);
+		sysfs_remove_link(&endpoint->ep_dev->dev.parent->kobj, name);
+		sysfs_remove_group(&endpoint->ep_dev->dev.kobj, &ep_dev_attr_grp);
+		device_unregister(&endpoint->ep_dev->dev);
+		endpoint->ep_dev = NULL;
+	}
+	destroy_endpoint_class();
+}
+
+
diff --git a/drivers/usb/core/file.c b/drivers/usb/core/file.c
index b263a54a13c..f65b193cde3 100644
--- a/drivers/usb/core/file.c
+++ b/drivers/usb/core/file.c
@@ -61,33 +61,66 @@ static struct file_operations usb_fops = {
 	.open =		usb_open,
 };
 
-static struct class *usb_class;
+static struct usb_class {
+	struct kref kref;
+	struct class *class;
+} *usb_class;
 
-int usb_major_init(void)
+static int init_usb_class(void)
 {
-	int error;
+	int result = 0;
 
-	error = register_chrdev(USB_MAJOR, "usb", &usb_fops);
-	if (error) {
-		err("unable to get major %d for usb devices", USB_MAJOR);
-		goto out;
+	if (usb_class != NULL) {
+		kref_get(&usb_class->kref);
+		goto exit;
+	}
+
+	usb_class = kmalloc(sizeof(*usb_class), GFP_KERNEL);
+	if (!usb_class) {
+		result = -ENOMEM;
+		goto exit;
 	}
 
-	usb_class = class_create(THIS_MODULE, "usb");
-	if (IS_ERR(usb_class)) {
-		error = PTR_ERR(usb_class);
+	kref_init(&usb_class->kref);
+	usb_class->class = class_create(THIS_MODULE, "usb");
+	if (IS_ERR(usb_class->class)) {
+		result = IS_ERR(usb_class->class);
 		err("class_create failed for usb devices");
-		unregister_chrdev(USB_MAJOR, "usb");
-		goto out;
+		kfree(usb_class);
+		usb_class = NULL;
 	}
 
-out:
+exit:
+	return result;
+}
+
+static void release_usb_class(struct kref *kref)
+{
+	/* Ok, we cheat as we know we only have one usb_class */
+	class_destroy(usb_class->class);
+	kfree(usb_class);
+	usb_class = NULL;
+}
+
+static void destroy_usb_class(void)
+{
+	if (usb_class)
+		kref_put(&usb_class->kref, release_usb_class);
+}
+
+int usb_major_init(void)
+{
+	int error;
+
+	error = register_chrdev(USB_MAJOR, "usb", &usb_fops);
+	if (error)
+		err("unable to get major %d for usb devices", USB_MAJOR);
+
 	return error;
 }
 
 void usb_major_cleanup(void)
 {
-	class_destroy(usb_class);
 	unregister_chrdev(USB_MAJOR, "usb");
 }
 
@@ -149,6 +182,10 @@ int usb_register_dev(struct usb_interface *intf,
 	if (retval)
 		goto exit;
 
+	retval = init_usb_class();
+	if (retval)
+		goto exit;
+
 	intf->minor = minor;
 
 	/* create a usb class device for this usb interface */
@@ -158,14 +195,13 @@ int usb_register_dev(struct usb_interface *intf,
 		++temp;
 	else
 		temp = name;
-	intf->class_dev = class_device_create(usb_class, NULL,
-					      MKDEV(USB_MAJOR, minor),
-					      &intf->dev, "%s", temp);
-	if (IS_ERR(intf->class_dev)) {
+	intf->usb_dev = device_create(usb_class->class, &intf->dev,
+				      MKDEV(USB_MAJOR, minor), "%s", temp);
+	if (IS_ERR(intf->usb_dev)) {
 		spin_lock (&minor_lock);
 		usb_minors[intf->minor] = NULL;
 		spin_unlock (&minor_lock);
-		retval = PTR_ERR(intf->class_dev);
+		retval = PTR_ERR(intf->usb_dev);
 	}
 exit:
 	return retval;
@@ -206,9 +242,10 @@ void usb_deregister_dev(struct usb_interface *intf,
 	spin_unlock (&minor_lock);
 
 	snprintf(name, BUS_ID_SIZE, class_driver->name, intf->minor - minor_base);
-	class_device_destroy(usb_class, MKDEV(USB_MAJOR, intf->minor));
-	intf->class_dev = NULL;
+	device_destroy(usb_class->class, MKDEV(USB_MAJOR, intf->minor));
+	intf->usb_dev = NULL;
 	intf->minor = -1;
+	destroy_usb_class();
 }
 EXPORT_SYMBOL(usb_deregister_dev);
 
diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c
index e2e00ba4e1e..4bf914d00a1 100644
--- a/drivers/usb/core/hcd.c
+++ b/drivers/usb/core/hcd.c
@@ -1826,24 +1826,16 @@ int usb_add_hcd(struct usb_hcd *hcd,
 
 	/* enable irqs just before we start the controller */
 	if (hcd->driver->irq) {
-		char	buf[8], *bufp = buf;
-
-#ifdef __sparc__
-		bufp = __irq_itoa(irqnum);
-#else
-		sprintf(buf, "%d", irqnum);
-#endif
-
 		snprintf(hcd->irq_descr, sizeof(hcd->irq_descr), "%s:usb%d",
 				hcd->driver->description, hcd->self.busnum);
 		if ((retval = request_irq(irqnum, &usb_hcd_irq, irqflags,
 				hcd->irq_descr, hcd)) != 0) {
 			dev_err(hcd->self.controller,
-					"request interrupt %s failed\n", bufp);
+					"request interrupt %d failed\n", irqnum);
 			goto err_request_irq;
 		}
 		hcd->irq = irqnum;
-		dev_info(hcd->self.controller, "irq %s, %s 0x%08llx\n", bufp,
+		dev_info(hcd->self.controller, "irq %d, %s 0x%08llx\n", irqnum,
 				(hcd->driver->flags & HCD_MEMORY) ?
 					"io mem" : "io base",
 					(unsigned long long)hcd->rsrc_start);
diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index 90b8d43c6b3..e1731ff8af4 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -432,15 +432,22 @@ static void hub_power_on(struct usb_hub *hub)
 {
 	int port1;
 	unsigned pgood_delay = hub->descriptor->bPwrOn2PwrGood * 2;
-	u16 wHubCharacteristics = le16_to_cpu(hub->descriptor->wHubCharacteristics);
-
-	/* if hub supports power switching, enable power on each port */
-	if ((wHubCharacteristics & HUB_CHAR_LPSM) < 2) {
+	u16 wHubCharacteristics =
+			le16_to_cpu(hub->descriptor->wHubCharacteristics);
+
+	/* Enable power on each port.  Some hubs have reserved values
+	 * of LPSM (> 2) in their descriptors, even though they are
+	 * USB 2.0 hubs.  Some hubs do not implement port-power switching
+	 * but only emulate it.  In all cases, the ports won't work
+	 * unless we send these messages to the hub.
+	 */
+	if ((wHubCharacteristics & HUB_CHAR_LPSM) < 2)
 		dev_dbg(hub->intfdev, "enabling power on all ports\n");
-		for (port1 = 1; port1 <= hub->descriptor->bNbrPorts; port1++)
-			set_port_feature(hub->hdev, port1,
-					USB_PORT_FEAT_POWER);
-	}
+	else
+		dev_dbg(hub->intfdev, "trying to enable port power on "
+				"non-switchable hub\n");
+	for (port1 = 1; port1 <= hub->descriptor->bNbrPorts; port1++)
+		set_port_feature(hub->hdev, port1, USB_PORT_FEAT_POWER);
 
 	/* Wait at least 100 msec for power to become stable */
 	msleep(max(pgood_delay, (unsigned) 100));
@@ -518,15 +525,16 @@ static int hub_port_disable(struct usb_hub *hub, int port1, int set_state)
 
 
 /* caller has locked the hub device */
-static void hub_pre_reset(struct usb_hub *hub, int disable_ports)
+static void hub_pre_reset(struct usb_interface *intf)
 {
+	struct usb_hub *hub = usb_get_intfdata(intf);
 	struct usb_device *hdev = hub->hdev;
 	int port1;
 
 	for (port1 = 1; port1 <= hdev->maxchild; ++port1) {
 		if (hdev->children[port1 - 1]) {
 			usb_disconnect(&hdev->children[port1 - 1]);
-			if (disable_ports)
+			if (hub->error == 0)
 				hub_port_disable(hub, port1, 0);
 		}
 	}
@@ -534,8 +542,10 @@ static void hub_pre_reset(struct usb_hub *hub, int disable_ports)
 }
 
 /* caller has locked the hub device */
-static void hub_post_reset(struct usb_hub *hub)
+static void hub_post_reset(struct usb_interface *intf)
 {
+	struct usb_hub *hub = usb_get_intfdata(intf);
+
 	hub_activate(hub);
 	hub_power_on(hub);
 }
@@ -795,15 +805,16 @@ static void hub_disconnect(struct usb_interface *intf)
 	struct usb_hub *hub = usb_get_intfdata (intf);
 	struct usb_device *hdev;
 
+	/* Disconnect all children and quiesce the hub */
+	hub->error = 0;
+	hub_pre_reset(intf);
+
 	usb_set_intfdata (intf, NULL);
 	hdev = hub->hdev;
 
 	if (hdev->speed == USB_SPEED_HIGH)
 		highspeed_hubs--;
 
-	/* Disconnect all children and quiesce the hub */
-	hub_pre_reset(hub, 1);
-
 	usb_free_urb(hub->urb);
 	hub->urb = NULL;
 
@@ -1169,6 +1180,7 @@ static int choose_configuration(struct usb_device *udev)
 {
 	int i;
 	int num_configs;
+	int insufficient_power = 0;
 	struct usb_host_config *c, *best;
 
 	best = NULL;
@@ -1221,8 +1233,10 @@ static int choose_configuration(struct usb_device *udev)
 		 */
 
 		/* Rule out configs that draw too much bus current */
-		if (c->desc.bMaxPower * 2 > udev->bus_mA)
+		if (c->desc.bMaxPower * 2 > udev->bus_mA) {
+			insufficient_power++;
 			continue;
+		}
 
 		/* If the first config's first interface is COMM/2/0xff
 		 * (MSFT RNDIS), rule it out unless Linux has host-side
@@ -1231,7 +1245,7 @@ static int choose_configuration(struct usb_device *udev)
 				&& desc->bInterfaceClass == USB_CLASS_COMM
 				&& desc->bInterfaceSubClass == 2
 				&& desc->bInterfaceProtocol == 0xff) {
-#ifndef CONFIG_USB_NET_RNDIS
+#ifndef CONFIG_USB_NET_RNDIS_HOST
 			continue;
 #else
 			best = c;
@@ -1256,6 +1270,11 @@ static int choose_configuration(struct usb_device *udev)
 			best = c;
 	}
 
+	if (insufficient_power > 0)
+		dev_info(&udev->dev, "rejected %d configuration%s "
+			"due to insufficient available bus power\n",
+			insufficient_power, plural(insufficient_power));
+
 	if (best) {
 		i = best->desc.bConfigurationValue;
 		dev_info(&udev->dev,
@@ -2732,7 +2751,8 @@ static void hub_events(void)
 
 		/* If the hub has died, clean up after it */
 		if (hdev->state == USB_STATE_NOTATTACHED) {
-			hub_pre_reset(hub, 0);
+			hub->error = -ENODEV;
+			hub_pre_reset(intf);
 			goto loop;
 		}
 
@@ -2744,7 +2764,7 @@ static void hub_events(void)
 			dev_dbg (hub_dev, "resetting for error %d\n",
 				hub->error);
 
-			ret = usb_reset_device(hdev);
+			ret = usb_reset_composite_device(hdev, intf);
 			if (ret) {
 				dev_dbg (hub_dev,
 					"error resetting hub: %d\n", ret);
@@ -2913,6 +2933,8 @@ static struct usb_driver hub_driver = {
 	.disconnect =	hub_disconnect,
 	.suspend =	hub_suspend,
 	.resume =	hub_resume,
+	.pre_reset =	hub_pre_reset,
+	.post_reset =	hub_post_reset,
 	.ioctl =	hub_ioctl,
 	.id_table =	hub_id_table,
 };
@@ -2992,9 +3014,9 @@ static int config_descriptors_changed(struct usb_device *udev)
  * usb_reset_device - perform a USB port reset to reinitialize a device
  * @udev: device to reset (not in SUSPENDED or NOTATTACHED state)
  *
- * WARNING - don't reset any device unless drivers for all of its
- * interfaces are expecting that reset!  Maybe some driver->reset()
- * method should eventually help ensure sufficient cooperation.
+ * WARNING - don't use this routine to reset a composite device
+ * (one with multiple interfaces owned by separate drivers)!
+ * Use usb_reset_composite_device() instead.
  *
  * Do a port reset, reassign the device's address, and establish its
  * former operating configuration.  If the reset fails, or the device's
@@ -3018,7 +3040,6 @@ int usb_reset_device(struct usb_device *udev)
 	struct usb_device		*parent_hdev = udev->parent;
 	struct usb_hub			*parent_hub;
 	struct usb_device_descriptor	descriptor = udev->descriptor;
-	struct usb_hub			*hub = NULL;
 	int 				i, ret = 0;
 	int				port1 = udev->portnum;
 
@@ -3036,14 +3057,6 @@ int usb_reset_device(struct usb_device *udev)
 	}
 	parent_hub = hdev_to_hub(parent_hdev);
 
-	/* If we're resetting an active hub, take some special actions */
-	if (udev->actconfig && udev->actconfig->desc.bNumInterfaces > 0 &&
-			udev->actconfig->interface[0]->dev.driver ==
-				&hub_driver.driver &&
-			(hub = hdev_to_hub(udev)) != NULL) {
-		hub_pre_reset(hub, 0);
-	}
-
 	set_bit(port1, parent_hub->busy_bits);
 	for (i = 0; i < SET_CONFIG_TRIES; ++i) {
 
@@ -3102,11 +3115,87 @@ int usb_reset_device(struct usb_device *udev)
 	}
 
 done:
-	if (hub)
-		hub_post_reset(hub);
 	return 0;
  
 re_enumerate:
 	hub_port_logical_disconnect(parent_hub, port1);
 	return -ENODEV;
 }
+
+/**
+ * usb_reset_composite_device - warn interface drivers and perform a USB port reset
+ * @udev: device to reset (not in SUSPENDED or NOTATTACHED state)
+ * @iface: interface bound to the driver making the request (optional)
+ *
+ * Warns all drivers bound to registered interfaces (using their pre_reset
+ * method), performs the port reset, and then lets the drivers know that
+ * the reset is over (using their post_reset method).
+ *
+ * Return value is the same as for usb_reset_device().
+ *
+ * The caller must own the device lock.  For example, it's safe to use
+ * this from a driver probe() routine after downloading new firmware.
+ * For calls that might not occur during probe(), drivers should lock
+ * the device using usb_lock_device_for_reset().
+ *
+ * The interface locks are acquired during the pre_reset stage and released
+ * during the post_reset stage.  However if iface is not NULL and is
+ * currently being probed, we assume that the caller already owns its
+ * lock.
+ */
+int usb_reset_composite_device(struct usb_device *udev,
+		struct usb_interface *iface)
+{
+	int ret;
+	struct usb_host_config *config = udev->actconfig;
+
+	if (udev->state == USB_STATE_NOTATTACHED ||
+			udev->state == USB_STATE_SUSPENDED) {
+		dev_dbg(&udev->dev, "device reset not allowed in state %d\n",
+				udev->state);
+		return -EINVAL;
+	}
+
+	if (iface && iface->condition != USB_INTERFACE_BINDING)
+		iface = NULL;
+
+	if (config) {
+		int i;
+		struct usb_interface *cintf;
+		struct usb_driver *drv;
+
+		for (i = 0; i < config->desc.bNumInterfaces; ++i) {
+			cintf = config->interface[i];
+			if (cintf != iface)
+				down(&cintf->dev.sem);
+			if (device_is_registered(&cintf->dev) &&
+					cintf->dev.driver) {
+				drv = to_usb_driver(cintf->dev.driver);
+				if (drv->pre_reset)
+					(drv->pre_reset)(cintf);
+			}
+		}
+	}
+
+	ret = usb_reset_device(udev);
+
+	if (config) {
+		int i;
+		struct usb_interface *cintf;
+		struct usb_driver *drv;
+
+		for (i = config->desc.bNumInterfaces - 1; i >= 0; --i) {
+			cintf = config->interface[i];
+			if (device_is_registered(&cintf->dev) &&
+					cintf->dev.driver) {
+				drv = to_usb_driver(cintf->dev.driver);
+				if (drv->post_reset)
+					(drv->post_reset)(cintf);
+			}
+			if (cintf != iface)
+				up(&cintf->dev.sem);
+		}
+	}
+
+	return ret;
+}
diff --git a/drivers/usb/core/inode.c b/drivers/usb/core/inode.c
index 695b90a17a6..bfc9b28a724 100644
--- a/drivers/usb/core/inode.c
+++ b/drivers/usb/core/inode.c
@@ -543,10 +543,10 @@ static void fs_remove_file (struct dentry *dentry)
 
 /* --------------------------------------------------------------------- */
 
-static struct super_block *usb_get_sb(struct file_system_type *fs_type,
-	int flags, const char *dev_name, void *data)
+static int usb_get_sb(struct file_system_type *fs_type,
+	int flags, const char *dev_name, void *data, struct vfsmount *mnt)
 {
-	return get_sb_single(fs_type, flags, data, usbfs_fill_super);
+	return get_sb_single(fs_type, flags, data, usbfs_fill_super, mnt);
 }
 
 static struct file_system_type usb_fs_type = {
diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c
index 08fb20f06f3..8569600f313 100644
--- a/drivers/usb/core/message.c
+++ b/drivers/usb/core/message.c
@@ -158,6 +158,37 @@ int usb_control_msg(struct usb_device *dev, unsigned int pipe, __u8 request, __u
 
 
 /**
+ * usb_interrupt_msg - Builds an interrupt urb, sends it off and waits for completion
+ * @usb_dev: pointer to the usb device to send the message to
+ * @pipe: endpoint "pipe" to send the message to
+ * @data: pointer to the data to send
+ * @len: length in bytes of the data to send
+ * @actual_length: pointer to a location to put the actual length transferred in bytes
+ * @timeout: time in msecs to wait for the message to complete before
+ *	timing out (if 0 the wait is forever)
+ * Context: !in_interrupt ()
+ *
+ * This function sends a simple interrupt message to a specified endpoint and
+ * waits for the message to complete, or timeout.
+ *
+ * If successful, it returns 0, otherwise a negative error number.  The number
+ * of actual bytes transferred will be stored in the actual_length paramater.
+ *
+ * Don't use this function from within an interrupt context, like a bottom half
+ * handler.  If you need an asynchronous message, or need to send a message
+ * from within interrupt context, use usb_submit_urb() If a thread in your
+ * driver uses this call, make sure your disconnect() method can wait for it to
+ * complete.  Since you don't have a handle on the URB used, you can't cancel
+ * the request.
+ */
+int usb_interrupt_msg(struct usb_device *usb_dev, unsigned int pipe,
+		      void *data, int len, int *actual_length, int timeout)
+{
+	return usb_bulk_msg(usb_dev, pipe, data, len, actual_length, timeout);
+}
+EXPORT_SYMBOL_GPL(usb_interrupt_msg);
+
+/**
  *	usb_bulk_msg - Builds a bulk urb, sends it off and waits for completion
  *	@usb_dev: pointer to the usb device to send the message to
  *	@pipe: endpoint "pipe" to send the message to
@@ -1380,15 +1411,7 @@ free_interfaces:
 				return ret;
 			}
 		}
-	}
-
-	/* if it's already configured, clear out old state first.
-	 * getting rid of old interfaces means unbinding their drivers.
-	 */
-	if (dev->state != USB_STATE_ADDRESS)
-		usb_disable_device (dev, 1);	// Skip ep0
 
-	if (cp) {
 		i = dev->bus_mA - cp->desc.bMaxPower * 2;
 		if (i < 0)
 			dev_warn(&dev->dev, "new config #%d exceeds power "
@@ -1396,84 +1419,91 @@ free_interfaces:
 					configuration, -i);
 	}
 
+	/* if it's already configured, clear out old state first.
+	 * getting rid of old interfaces means unbinding their drivers.
+	 */
+	if (dev->state != USB_STATE_ADDRESS)
+		usb_disable_device (dev, 1);	// Skip ep0
+
 	if ((ret = usb_control_msg(dev, usb_sndctrlpipe(dev, 0),
 			USB_REQ_SET_CONFIGURATION, 0, configuration, 0,
-			NULL, 0, USB_CTRL_SET_TIMEOUT)) < 0)
-		goto free_interfaces;
+			NULL, 0, USB_CTRL_SET_TIMEOUT)) < 0) {
+
+		/* All the old state is gone, so what else can we do?
+		 * The device is probably useless now anyway.
+		 */
+		cp = NULL;
+	}
 
 	dev->actconfig = cp;
-	if (!cp)
+	if (!cp) {
 		usb_set_device_state(dev, USB_STATE_ADDRESS);
-	else {
-		usb_set_device_state(dev, USB_STATE_CONFIGURED);
+		goto free_interfaces;
+	}
+	usb_set_device_state(dev, USB_STATE_CONFIGURED);
 
-		/* Initialize the new interface structures and the
-		 * hc/hcd/usbcore interface/endpoint state.
-		 */
-		for (i = 0; i < nintf; ++i) {
-			struct usb_interface_cache *intfc;
-			struct usb_interface *intf;
-			struct usb_host_interface *alt;
-
-			cp->interface[i] = intf = new_interfaces[i];
-			intfc = cp->intf_cache[i];
-			intf->altsetting = intfc->altsetting;
-			intf->num_altsetting = intfc->num_altsetting;
-			kref_get(&intfc->ref);
-
-			alt = usb_altnum_to_altsetting(intf, 0);
-
-			/* No altsetting 0?  We'll assume the first altsetting.
-			 * We could use a GetInterface call, but if a device is
-			 * so non-compliant that it doesn't have altsetting 0
-			 * then I wouldn't trust its reply anyway.
-			 */
-			if (!alt)
-				alt = &intf->altsetting[0];
-
-			intf->cur_altsetting = alt;
-			usb_enable_interface(dev, intf);
-			intf->dev.parent = &dev->dev;
-			intf->dev.driver = NULL;
-			intf->dev.bus = &usb_bus_type;
-			intf->dev.dma_mask = dev->dev.dma_mask;
-			intf->dev.release = release_interface;
-			device_initialize (&intf->dev);
-			mark_quiesced(intf);
-			sprintf (&intf->dev.bus_id[0], "%d-%s:%d.%d",
-				 dev->bus->busnum, dev->devpath,
-				 configuration,
-				 alt->desc.bInterfaceNumber);
-		}
-		kfree(new_interfaces);
+	/* Initialize the new interface structures and the
+	 * hc/hcd/usbcore interface/endpoint state.
+	 */
+	for (i = 0; i < nintf; ++i) {
+		struct usb_interface_cache *intfc;
+		struct usb_interface *intf;
+		struct usb_host_interface *alt;
+
+		cp->interface[i] = intf = new_interfaces[i];
+		intfc = cp->intf_cache[i];
+		intf->altsetting = intfc->altsetting;
+		intf->num_altsetting = intfc->num_altsetting;
+		kref_get(&intfc->ref);
 
-		if (cp->string == NULL)
-			cp->string = usb_cache_string(dev,
-					cp->desc.iConfiguration);
+		alt = usb_altnum_to_altsetting(intf, 0);
 
-		/* Now that all the interfaces are set up, register them
-		 * to trigger binding of drivers to interfaces.  probe()
-		 * routines may install different altsettings and may
-		 * claim() any interfaces not yet bound.  Many class drivers
-		 * need that: CDC, audio, video, etc.
+		/* No altsetting 0?  We'll assume the first altsetting.
+		 * We could use a GetInterface call, but if a device is
+		 * so non-compliant that it doesn't have altsetting 0
+		 * then I wouldn't trust its reply anyway.
 		 */
-		for (i = 0; i < nintf; ++i) {
-			struct usb_interface *intf = cp->interface[i];
-
-			dev_dbg (&dev->dev,
-				"adding %s (config #%d, interface %d)\n",
-				intf->dev.bus_id, configuration,
-				intf->cur_altsetting->desc.bInterfaceNumber);
-			ret = device_add (&intf->dev);
-			if (ret != 0) {
-				dev_err(&dev->dev,
-					"device_add(%s) --> %d\n",
-					intf->dev.bus_id,
-					ret);
-				continue;
-			}
-			usb_create_sysfs_intf_files (intf);
+		if (!alt)
+			alt = &intf->altsetting[0];
+
+		intf->cur_altsetting = alt;
+		usb_enable_interface(dev, intf);
+		intf->dev.parent = &dev->dev;
+		intf->dev.driver = NULL;
+		intf->dev.bus = &usb_bus_type;
+		intf->dev.dma_mask = dev->dev.dma_mask;
+		intf->dev.release = release_interface;
+		device_initialize (&intf->dev);
+		mark_quiesced(intf);
+		sprintf (&intf->dev.bus_id[0], "%d-%s:%d.%d",
+			 dev->bus->busnum, dev->devpath,
+			 configuration, alt->desc.bInterfaceNumber);
+	}
+	kfree(new_interfaces);
+
+	if (cp->string == NULL)
+		cp->string = usb_cache_string(dev, cp->desc.iConfiguration);
+
+	/* Now that all the interfaces are set up, register them
+	 * to trigger binding of drivers to interfaces.  probe()
+	 * routines may install different altsettings and may
+	 * claim() any interfaces not yet bound.  Many class drivers
+	 * need that: CDC, audio, video, etc.
+	 */
+	for (i = 0; i < nintf; ++i) {
+		struct usb_interface *intf = cp->interface[i];
+
+		dev_dbg (&dev->dev,
+			"adding %s (config #%d, interface %d)\n",
+			intf->dev.bus_id, configuration,
+			intf->cur_altsetting->desc.bInterfaceNumber);
+		ret = device_add (&intf->dev);
+		if (ret != 0) {
+			dev_err(&dev->dev, "device_add(%s) --> %d\n",
+				intf->dev.bus_id, ret);
+			continue;
 		}
+		usb_create_sysfs_intf_files (intf);
 	}
 
 	return 0;
diff --git a/drivers/usb/core/sysfs.c b/drivers/usb/core/sysfs.c
index 71d881327e8..3f49bf51cff 100644
--- a/drivers/usb/core/sysfs.c
+++ b/drivers/usb/core/sysfs.c
@@ -15,203 +15,6 @@
 #include <linux/usb.h>
 #include "usb.h"
 
-/* endpoint stuff */
-struct ep_object {
-	struct usb_endpoint_descriptor *desc;
-	struct usb_device *udev;
-	struct kobject kobj;
-};
-#define to_ep_object(_kobj) \
-	container_of(_kobj, struct ep_object, kobj)
-
-struct ep_attribute {
-	struct attribute attr;
-	ssize_t (*show)(struct usb_device *,
-			struct usb_endpoint_descriptor *, char *);
-};
-#define to_ep_attribute(_attr) \
-	container_of(_attr, struct ep_attribute, attr)
-
-#define EP_ATTR(_name)						\
-struct ep_attribute ep_##_name = {				\
-	.attr = {.name = #_name, .owner = THIS_MODULE,		\
-			.mode = S_IRUGO},			\
-	.show = show_ep_##_name}
-
-#define usb_ep_attr(field, format_string)			\
-static ssize_t show_ep_##field(struct usb_device *udev,		\
-		struct usb_endpoint_descriptor *desc, 		\
-		char *buf)					\
-{								\
-	return sprintf(buf, format_string, desc->field);	\
-}								\
-static EP_ATTR(field);
-
-usb_ep_attr(bLength, "%02x\n")
-usb_ep_attr(bEndpointAddress, "%02x\n")
-usb_ep_attr(bmAttributes, "%02x\n")
-usb_ep_attr(bInterval, "%02x\n")
-
-static ssize_t show_ep_wMaxPacketSize(struct usb_device *udev,
-		struct usb_endpoint_descriptor *desc, char *buf)
-{
-	return sprintf(buf, "%04x\n",
-			le16_to_cpu(desc->wMaxPacketSize) & 0x07ff);
-}
-static EP_ATTR(wMaxPacketSize);
-
-static ssize_t show_ep_type(struct usb_device *udev,
-		struct usb_endpoint_descriptor *desc, char *buf)
-{
-	char *type = "unknown";
-
-	switch (desc->bmAttributes & USB_ENDPOINT_XFERTYPE_MASK) {
-	case USB_ENDPOINT_XFER_CONTROL:
-		type = "Control";
-		break;
-	case USB_ENDPOINT_XFER_ISOC:
-		type = "Isoc";
-		break;
-	case USB_ENDPOINT_XFER_BULK:
-		type = "Bulk";
-		break;
-	case USB_ENDPOINT_XFER_INT:
-		type = "Interrupt";
-		break;
-	}
-	return sprintf(buf, "%s\n", type);
-}
-static EP_ATTR(type);
-
-static ssize_t show_ep_interval(struct usb_device *udev,
-		struct usb_endpoint_descriptor *desc, char *buf)
-{
-	char unit;
-	unsigned interval = 0;
-	unsigned in;
-
-	in = (desc->bEndpointAddress & USB_DIR_IN);
-
-	switch (desc->bmAttributes & USB_ENDPOINT_XFERTYPE_MASK) {
-	case USB_ENDPOINT_XFER_CONTROL:
-		if (udev->speed == USB_SPEED_HIGH) 	/* uframes per NAK */
-			interval = desc->bInterval;
-		break;
-	case USB_ENDPOINT_XFER_ISOC:
-		interval = 1 << (desc->bInterval - 1);
-		break;
-	case USB_ENDPOINT_XFER_BULK:
-		if (udev->speed == USB_SPEED_HIGH && !in) /* uframes per NAK */
-			interval = desc->bInterval;
-		break;
-	case USB_ENDPOINT_XFER_INT:
-		if (udev->speed == USB_SPEED_HIGH)
-			interval = 1 << (desc->bInterval - 1);
-		else
-			interval = desc->bInterval;
-		break;
-	}
-	interval *= (udev->speed == USB_SPEED_HIGH) ? 125 : 1000;
-	if (interval % 1000)
-		unit = 'u';
-	else {
-		unit = 'm';
-		interval /= 1000;
-	}
-
-	return sprintf(buf, "%d%cs\n", interval, unit);
-}
-static EP_ATTR(interval);
-
-static ssize_t show_ep_direction(struct usb_device *udev,
-		struct usb_endpoint_descriptor *desc, char *buf)
-{
-	char *direction;
-
-	if ((desc->bmAttributes & USB_ENDPOINT_XFERTYPE_MASK) ==
-			USB_ENDPOINT_XFER_CONTROL)
-		direction = "both";
-	else if (desc->bEndpointAddress & USB_DIR_IN)
-		direction = "in";
-	else
-		direction = "out";
-	return sprintf(buf, "%s\n", direction);
-}
-static EP_ATTR(direction);
-
-static struct attribute *ep_attrs[] = {
-	&ep_bLength.attr,
-	&ep_bEndpointAddress.attr,
-	&ep_bmAttributes.attr,
-	&ep_bInterval.attr,
-	&ep_wMaxPacketSize.attr,
-	&ep_type.attr,
-	&ep_interval.attr,
-	&ep_direction.attr,
-	NULL,
-};
-
-static void ep_object_release(struct kobject *kobj)
-{
-	kfree(to_ep_object(kobj));
-}
-
-static ssize_t ep_object_show(struct kobject *kobj, struct attribute *attr,
-		char *buf)
-{
-	struct ep_object *ep_obj = to_ep_object(kobj);
-	struct ep_attribute *ep_attr = to_ep_attribute(attr);
-
-	return (ep_attr->show)(ep_obj->udev, ep_obj->desc, buf);
-}
-
-static struct sysfs_ops ep_object_sysfs_ops = {
-	.show =			ep_object_show,
-};
-
-static struct kobj_type ep_object_ktype = {
-	.release =		ep_object_release,
-	.sysfs_ops =		&ep_object_sysfs_ops,
-	.default_attrs =	ep_attrs,
-};
-
-static void usb_create_ep_files(struct kobject *parent,
-		struct usb_host_endpoint *endpoint,
-		struct usb_device *udev)
-{
-	struct ep_object *ep_obj;
-	struct kobject *kobj;
-
-	ep_obj = kzalloc(sizeof(struct ep_object), GFP_KERNEL);
-	if (!ep_obj)
-		return;
-
-	ep_obj->desc = &endpoint->desc;
-	ep_obj->udev = udev;
-
-	kobj = &ep_obj->kobj;
-	kobject_set_name(kobj, "ep_%02x", endpoint->desc.bEndpointAddress);
-	kobj->parent = parent;
-	kobj->ktype = &ep_object_ktype;
-
-	/* Don't use kobject_register, because it generates a hotplug event */
-	kobject_init(kobj);
-	if (kobject_add(kobj) == 0)
-		endpoint->kobj = kobj;
-	else
-		kobject_put(kobj);
-}
-
-static void usb_remove_ep_files(struct usb_host_endpoint *endpoint)
-{
-
-	if (endpoint->kobj) {
-		kobject_del(endpoint->kobj);
-		kobject_put(endpoint->kobj);
-		endpoint->kobj = NULL;
-	}
-}
-
 /* Active configuration fields */
 #define usb_actconfig_show(field, multiplier, format_string)		\
 static ssize_t  show_##field (struct device *dev,			\
@@ -420,7 +223,7 @@ void usb_create_sysfs_dev_files (struct usb_device *udev)
 	if (udev->serial)
 		device_create_file (dev, &dev_attr_serial);
 	device_create_file (dev, &dev_attr_configuration);
-	usb_create_ep_files(&dev->kobj, &udev->ep0, udev);
+	usb_create_ep_files(dev, &udev->ep0, udev);
 }
 
 void usb_remove_sysfs_dev_files (struct usb_device *udev)
@@ -524,7 +327,7 @@ static inline void usb_create_intf_ep_files(struct usb_interface *intf,
 
 	iface_desc = intf->cur_altsetting;
 	for (i = 0; i < iface_desc->desc.bNumEndpoints; ++i)
-		usb_create_ep_files(&intf->dev.kobj, &iface_desc->endpoint[i],
+		usb_create_ep_files(&intf->dev, &iface_desc->endpoint[i],
 				udev);
 }
 
diff --git a/drivers/usb/core/usb.c b/drivers/usb/core/usb.c
index b7fdc1cd134..fb488c8a860 100644
--- a/drivers/usb/core/usb.c
+++ b/drivers/usb/core/usb.c
@@ -991,6 +991,8 @@ void usb_buffer_unmap_sg (struct usb_device *dev, unsigned pipe,
 
 static int verify_suspended(struct device *dev, void *unused)
 {
+	if (dev->driver == NULL)
+		return 0;
 	return (dev->power.power_state.event == PM_EVENT_ON) ? -EBUSY : 0;
 }
 
@@ -1207,6 +1209,7 @@ EXPORT_SYMBOL(usb_ifnum_to_if);
 EXPORT_SYMBOL(usb_altnum_to_altsetting);
 
 EXPORT_SYMBOL(usb_reset_device);
+EXPORT_SYMBOL(usb_reset_composite_device);
 
 EXPORT_SYMBOL(__usb_get_extra_descriptor);
 
diff --git a/drivers/usb/core/usb.h b/drivers/usb/core/usb.h
index 4647e1ebc68..7a650c763a6 100644
--- a/drivers/usb/core/usb.h
+++ b/drivers/usb/core/usb.h
@@ -4,6 +4,9 @@ extern void usb_create_sysfs_dev_files (struct usb_device *dev);
 extern void usb_remove_sysfs_dev_files (struct usb_device *dev);
 extern void usb_create_sysfs_intf_files (struct usb_interface *intf);
 extern void usb_remove_sysfs_intf_files (struct usb_interface *intf);
+extern void usb_create_ep_files(struct device *parent, struct usb_host_endpoint *endpoint,
+				struct usb_device *udev);
+extern void usb_remove_ep_files(struct usb_host_endpoint *endpoint);
 
 extern void usb_disable_endpoint (struct usb_device *dev, unsigned int epaddr);
 extern void usb_disable_interface (struct usb_device *dev,
diff --git a/drivers/usb/gadget/ether.c b/drivers/usb/gadget/ether.c
index 9c4422ac9de..078daa02671 100644
--- a/drivers/usb/gadget/ether.c
+++ b/drivers/usb/gadget/ether.c
@@ -49,7 +49,7 @@
 #include <asm/unaligned.h>
 
 #include <linux/usb_ch9.h>
-#include <linux/usb_cdc.h>
+#include <linux/usb/cdc.h>
 #include <linux/usb_gadget.h>
 
 #include <linux/random.h>
@@ -101,9 +101,9 @@ static const char driver_desc [] = DRIVER_DESC;
 
 /* CDC and RNDIS support the same host-chosen outgoing packet filters. */
 #define	DEFAULT_FILTER	(USB_CDC_PACKET_TYPE_BROADCAST \
- 			|USB_CDC_PACKET_TYPE_ALL_MULTICAST \
- 			|USB_CDC_PACKET_TYPE_PROMISCUOUS \
- 			|USB_CDC_PACKET_TYPE_DIRECTED)
+			|USB_CDC_PACKET_TYPE_ALL_MULTICAST \
+			|USB_CDC_PACKET_TYPE_PROMISCUOUS \
+			|USB_CDC_PACKET_TYPE_DIRECTED)
 
 
 /*-------------------------------------------------------------------------*/
@@ -318,7 +318,7 @@ static inline int rndis_active(struct eth_dev *dev)
 #define DEFAULT_QLEN	2	/* double buffering by default */
 
 /* peak bulk transfer bits-per-second */
-#define	HS_BPS 		(13 * 512 * 8 * 1000 * 8)
+#define	HS_BPS		(13 * 512 * 8 * 1000 * 8)
 #define	FS_BPS		(19 *  64 * 1 * 1000 * 8)
 
 #ifdef CONFIG_USB_GADGET_DUALSPEED
@@ -466,7 +466,7 @@ eth_config = {
 };
 
 #ifdef	CONFIG_USB_ETH_RNDIS
-static struct usb_config_descriptor 
+static struct usb_config_descriptor
 rndis_config = {
 	.bLength =              sizeof rndis_config,
 	.bDescriptorType =      USB_DT_CONFIG,
@@ -511,7 +511,7 @@ static const struct usb_interface_descriptor
 rndis_control_intf = {
 	.bLength =              sizeof rndis_control_intf,
 	.bDescriptorType =      USB_DT_INTERFACE,
-	  
+
 	.bInterfaceNumber =     0,
 	.bNumEndpoints =        1,
 	.bInterfaceClass =      USB_CLASS_COMM,
@@ -545,20 +545,20 @@ static const struct usb_cdc_union_desc union_desc = {
 #ifdef	CONFIG_USB_ETH_RNDIS
 
 static const struct usb_cdc_call_mgmt_descriptor call_mgmt_descriptor = {
-	.bLength =  		sizeof call_mgmt_descriptor,
-	.bDescriptorType = 	USB_DT_CS_INTERFACE,
-	.bDescriptorSubType = 	USB_CDC_CALL_MANAGEMENT_TYPE,
+	.bLength =		sizeof call_mgmt_descriptor,
+	.bDescriptorType =	USB_DT_CS_INTERFACE,
+	.bDescriptorSubType =	USB_CDC_CALL_MANAGEMENT_TYPE,
 
-	.bmCapabilities = 	0x00,
-	.bDataInterface = 	0x01,
+	.bmCapabilities =	0x00,
+	.bDataInterface =	0x01,
 };
 
 static const struct usb_cdc_acm_descriptor acm_descriptor = {
-	.bLength =  		sizeof acm_descriptor,
-	.bDescriptorType = 	USB_DT_CS_INTERFACE,
-	.bDescriptorSubType = 	USB_CDC_ACM_TYPE,
+	.bLength =		sizeof acm_descriptor,
+	.bDescriptorType =	USB_DT_CS_INTERFACE,
+	.bDescriptorSubType =	USB_CDC_ACM_TYPE,
 
-	.bmCapabilities = 	0x00,
+	.bmCapabilities =	0x00,
 };
 
 #endif
@@ -595,7 +595,7 @@ static const struct usb_cdc_ether_desc ether_desc = {
  * RNDIS requires the status endpoint, since it uses that encapsulation
  * mechanism for its funky RPC scheme.
  */
- 
+
 #define LOG2_STATUS_INTERVAL_MSEC	5	/* 1 << 5 == 32 msec */
 #define STATUS_BYTECOUNT		16	/* 8 byte header + data */
 
@@ -978,7 +978,7 @@ set_ether_config (struct eth_dev *dev, gfp_t gfp_flags)
 
 		result = usb_ep_enable (dev->status_ep, dev->status);
 		if (result != 0) {
-			DEBUG (dev, "enable %s --> %d\n", 
+			DEBUG (dev, "enable %s --> %d\n",
 				dev->status_ep->name, result);
 			goto done;
 		}
@@ -1002,15 +1002,15 @@ set_ether_config (struct eth_dev *dev, gfp_t gfp_flags)
 	if (!cdc_active(dev)) {
 		result = usb_ep_enable (dev->in_ep, dev->in);
 		if (result != 0) {
-			DEBUG(dev, "enable %s --> %d\n", 
+			DEBUG(dev, "enable %s --> %d\n",
 				dev->in_ep->name, result);
 			goto done;
 		}
 
 		result = usb_ep_enable (dev->out_ep, dev->out);
 		if (result != 0) {
-			DEBUG (dev, "enable %s --> %d\n", 
-				dev->in_ep->name, result);
+			DEBUG (dev, "enable %s --> %d\n",
+				dev->out_ep->name, result);
 			goto done;
 		}
 	}
@@ -1144,7 +1144,7 @@ eth_set_config (struct eth_dev *dev, unsigned number, gfp_t gfp_flags)
 #ifdef CONFIG_USB_GADGET_DUALSPEED
 		case USB_SPEED_HIGH:	speed = "high"; break;
 #endif
-		default: 		speed = "?"; break;
+		default:		speed = "?"; break;
 		}
 
 		dev->config = number;
@@ -1206,7 +1206,7 @@ static void issue_start_status (struct eth_dev *dev)
 	struct usb_request		*req = dev->stat_req;
 	struct usb_cdc_notification	*event;
 	int				value;
- 
+
 	DEBUG (dev, "%s, flush old status first\n", __FUNCTION__);
 
 	/* flush old status
@@ -1268,7 +1268,7 @@ static void rndis_command_complete (struct usb_ep *ep, struct usb_request *req)
 {
 	struct eth_dev          *dev = ep->driver_data;
 	int			status;
-	
+
 	/* received RNDIS command from USB_CDC_SEND_ENCAPSULATED_COMMAND */
 	spin_lock(&dev->lock);
 	status = rndis_msg_parser (dev->rndis_config, (u8 *) req->buf);
@@ -1472,7 +1472,7 @@ done_set_intf:
 
 #endif /* DEV_CONFIG_CDC */
 
-#ifdef CONFIG_USB_ETH_RNDIS		
+#ifdef CONFIG_USB_ETH_RNDIS
 	/* RNDIS uses the CDC command encapsulation mechanism to implement
 	 * an RPC scheme, with much getting/setting of attributes by OID.
 	 */
@@ -1489,7 +1489,7 @@ done_set_intf:
 		req->complete = rndis_command_complete;
 		/* later, rndis_control_ack () sends a notification */
 		break;
-		
+
 	case USB_CDC_GET_ENCAPSULATED_RESPONSE:
 		if ((USB_DIR_IN|USB_TYPE_CLASS|USB_RECIP_INTERFACE)
 					== ctrl->bRequestType
@@ -1641,7 +1641,7 @@ rx_submit (struct eth_dev *dev, struct usb_request *req, gfp_t gfp_flags)
 		DEBUG (dev, "no rx skb\n");
 		goto enomem;
 	}
-	
+
 	/* Some platforms perform better when IP packets are aligned,
 	 * but on at least one, checksumming fails otherwise.  Note:
 	 * RNDIS headers involve variable numbers of LE32 values.
@@ -1720,7 +1720,7 @@ quiesce:
 	case -EOVERFLOW:
 		dev->stats.rx_over_errors++;
 		// FALLTHROUGH
-	    
+
 	default:
 		dev->stats.rx_errors++;
 		DEBUG (dev, "rx status %d\n", status);
@@ -1915,7 +1915,7 @@ static int eth_start_xmit (struct sk_buff *skb, struct net_device *net)
 				sizeof (struct rndis_packet_msg_type));
 		if (!skb_rndis)
 			goto drop;
-	
+
 		dev_kfree_skb_any (skb);
 		skb = skb_rndis;
 		rndis_add_hdr (skb);
@@ -2001,7 +2001,7 @@ static int rndis_control_ack (struct net_device *net)
 	struct eth_dev          *dev = netdev_priv(net);
 	u32                     length;
 	struct usb_request      *resp = dev->stat_req;
-	
+
 	/* in case RNDIS calls this after disconnect */
 	if (!dev->status) {
 		DEBUG (dev, "status ENODEV\n");
@@ -2021,16 +2021,16 @@ static int rndis_control_ack (struct net_device *net)
 	resp->length = 8;
 	resp->complete = rndis_control_ack_complete;
 	resp->context = dev;
-	
+
 	*((__le32 *) resp->buf) = __constant_cpu_to_le32 (1);
 	*((__le32 *) resp->buf + 1) = __constant_cpu_to_le32 (0);
-	
+
 	length = usb_ep_queue (dev->status_ep, resp, GFP_ATOMIC);
 	if (length < 0) {
 		resp->status = 0;
 		rndis_control_ack_complete (dev->status_ep, resp);
 	}
-	
+
 	return 0;
 }
 
@@ -2047,7 +2047,7 @@ static void eth_start (struct eth_dev *dev, gfp_t gfp_flags)
 	/* fill the rx queue */
 	rx_fill (dev, gfp_flags);
 
-	/* and open the tx floodgates */ 
+	/* and open the tx floodgates */
 	atomic_set (&dev->tx_qlen, 0);
 	netif_wake_queue (dev->net);
 	if (rndis_active(dev)) {
@@ -2076,7 +2076,7 @@ static int eth_stop (struct net_device *net)
 	netif_stop_queue (net);
 
 	DEBUG (dev, "stop stats: rx/tx %ld/%ld, errs %ld/%ld\n",
-		dev->stats.rx_packets, dev->stats.tx_packets, 
+		dev->stats.rx_packets, dev->stats.tx_packets,
 		dev->stats.rx_errors, dev->stats.tx_errors
 		);
 
@@ -2095,7 +2095,7 @@ static int eth_stop (struct net_device *net)
 			usb_ep_enable (dev->status_ep, dev->status);
 		}
 	}
-	
+
 	if (rndis_active(dev)) {
 		rndis_set_param_medium (dev->rndis_config,
 					NDIS_MEDIUM_802_3, 0);
@@ -2301,7 +2301,7 @@ autoconf_fail:
 		return -ENODEV;
 	}
 	in_ep->driver_data = in_ep;	/* claim */
-	
+
 	out_ep = usb_ep_autoconfig (gadget, &fs_sink_desc);
 	if (!out_ep)
 		goto autoconf_fail;
@@ -2374,8 +2374,8 @@ autoconf_fail:
 #endif
 	}
 
- 	net = alloc_etherdev (sizeof *dev);
- 	if (!net)
+	net = alloc_etherdev (sizeof *dev);
+	if (!net)
 		return status;
 	dev = netdev_priv(net);
 	spin_lock_init (&dev->lock);
@@ -2454,7 +2454,7 @@ autoconf_fail:
 	dev->gadget = gadget;
 	set_gadget_data (gadget, dev);
 	gadget->ep0->driver_data = dev;
-	
+
 	/* two kinds of host-initiated state changes:
 	 *  - iff DATA transfer is active, carrier is "on"
 	 *  - tx queueing enabled if open *and* carrier is "on"
@@ -2462,8 +2462,8 @@ autoconf_fail:
 	netif_stop_queue (dev->net);
 	netif_carrier_off (dev->net);
 
- 	SET_NETDEV_DEV (dev->net, &gadget->dev);
- 	status = register_netdev (dev->net);
+	SET_NETDEV_DEV (dev->net, &gadget->dev);
+	status = register_netdev (dev->net);
 	if (status < 0)
 		goto fail1;
 
@@ -2488,7 +2488,7 @@ autoconf_fail:
 		u32	vendorID = 0;
 
 		/* FIXME RNDIS vendor id == "vendor NIC code" == ? */
-		
+
 		dev->rndis_config = rndis_register (rndis_control_ack);
 		if (dev->rndis_config < 0) {
 fail0:
@@ -2496,7 +2496,7 @@ fail0:
 			status = -ENODEV;
 			goto fail;
 		}
-		
+
 		/* these set up a lot of the OIDs that RNDIS needs */
 		rndis_set_host_mac (dev->rndis_config, dev->host_mac);
 		if (rndis_set_param_dev (dev->rndis_config, dev->net,
@@ -2556,7 +2556,7 @@ static struct usb_gadget_driver eth_driver = {
 	.suspend	= eth_suspend,
 	.resume		= eth_resume,
 
-	.driver 	= {
+	.driver	= {
 		.name		= (char *) shortname,
 		.owner		= THIS_MODULE,
 	},
diff --git a/drivers/usb/gadget/file_storage.c b/drivers/usb/gadget/file_storage.c
index 6f887478b14..a43dc908ac5 100644
--- a/drivers/usb/gadget/file_storage.c
+++ b/drivers/usb/gadget/file_storage.c
@@ -1906,7 +1906,6 @@ static int fsync_sub(struct lun *curlun)
 
 	inode = filp->f_dentry->d_inode;
 	mutex_lock(&inode->i_mutex);
-	current->flags |= PF_SYNCWRITE;
 	rc = filemap_fdatawrite(inode->i_mapping);
 	err = filp->f_op->fsync(filp, filp->f_dentry, 1);
 	if (!rc)
@@ -1914,7 +1913,6 @@ static int fsync_sub(struct lun *curlun)
 	err = filemap_fdatawait(inode->i_mapping);
 	if (!rc)
 		rc = err;
-	current->flags &= ~PF_SYNCWRITE;
 	mutex_unlock(&inode->i_mutex);
 	VLDBG(curlun, "fdatasync -> %d\n", rc);
 	return rc;
diff --git a/drivers/usb/gadget/goku_udc.c b/drivers/usb/gadget/goku_udc.c
index 66b81bbf6be..5378c175729 100644
--- a/drivers/usb/gadget/goku_udc.c
+++ b/drivers/usb/gadget/goku_udc.c
@@ -1850,7 +1850,6 @@ static int goku_probe(struct pci_dev *pdev, const struct pci_device_id *id)
 	unsigned long		resource, len;
 	void __iomem		*base = NULL;
 	int			retval;
-	char			buf [8], *bufp;
 
 	/* if you want to support more than one controller in a system,
 	 * usb_gadget_driver_{register,unregister}() must change.
@@ -1913,20 +1912,14 @@ static int goku_probe(struct pci_dev *pdev, const struct pci_device_id *id)
 	pci_set_drvdata(pdev, dev);
 	INFO(dev, "%s\n", driver_desc);
 	INFO(dev, "version: " DRIVER_VERSION " %s\n", dmastr());
-#ifndef __sparc__
-	scnprintf(buf, sizeof buf, "%d", pdev->irq);
-	bufp = buf;
-#else
-	bufp = __irq_itoa(pdev->irq);
-#endif
-	INFO(dev, "irq %s, pci mem %p\n", bufp, base);
+	INFO(dev, "irq %d, pci mem %p\n", pdev->irq, base);
 
 	/* init to known state, then setup irqs */
 	udc_reset(dev);
 	udc_reinit (dev);
 	if (request_irq(pdev->irq, goku_irq, SA_SHIRQ/*|SA_SAMPLE_RANDOM*/,
 			driver_name, dev) != 0) {
-		DBG(dev, "request interrupt %s failed\n", bufp);
+		DBG(dev, "request interrupt %d failed\n", pdev->irq);
 		retval = -EBUSY;
 		goto done;
 	}
diff --git a/drivers/usb/gadget/inode.c b/drivers/usb/gadget/inode.c
index 0eb010a3f5b..3bdc5e3ba23 100644
--- a/drivers/usb/gadget/inode.c
+++ b/drivers/usb/gadget/inode.c
@@ -528,7 +528,7 @@ struct kiocb_priv {
 	struct usb_request	*req;
 	struct ep_data		*epdata;
 	void			*buf;
-	char __user		*ubuf;
+	char __user		*ubuf;		/* NULL for writes */
 	unsigned		actual;
 };
 
@@ -566,7 +566,6 @@ static ssize_t ep_aio_read_retry(struct kiocb *iocb)
 		status = priv->actual;
 	kfree(priv->buf);
 	kfree(priv);
-	aio_put_req(iocb);
 	return status;
 }
 
@@ -580,8 +579,8 @@ static void ep_aio_complete(struct usb_ep *ep, struct usb_request *req)
 	spin_lock(&epdata->dev->lock);
 	priv->req = NULL;
 	priv->epdata = NULL;
-	if (NULL == iocb->ki_retry
-			|| unlikely(0 == req->actual)
+	if (priv->ubuf == NULL
+			|| unlikely(req->actual == 0)
 			|| unlikely(kiocbIsCancelled(iocb))) {
 		kfree(req->buf);
 		kfree(priv);
@@ -618,7 +617,7 @@ ep_aio_rwtail(
 	char __user	*ubuf
 )
 {
-	struct kiocb_priv	*priv = (void *) &iocb->private;
+	struct kiocb_priv	*priv;
 	struct usb_request	*req;
 	ssize_t			value;
 
@@ -670,7 +669,7 @@ fail:
 		kfree(priv);
 		put_ep(epdata);
 	} else
-		value = -EIOCBQUEUED;
+		value = (ubuf ? -EIOCBRETRY : -EIOCBQUEUED);
 	return value;
 }
 
@@ -1039,7 +1038,7 @@ scan:
 		/* ep0 can't deliver events when STATE_SETUP */
 		for (i = 0; i < n; i++) {
 			if (dev->event [i].type == GADGETFS_SETUP) {
-				len = n = i + 1;
+				len = i + 1;
 				len *= sizeof (struct usb_gadgetfs_event);
 				n = 0;
 				break;
@@ -1587,13 +1586,13 @@ gadgetfs_create_file (struct super_block *sb, char const *name,
 static int activate_ep_files (struct dev_data *dev)
 {
 	struct usb_ep	*ep;
+	struct ep_data	*data;
 
 	gadget_for_each_ep (ep, dev->gadget) {
-		struct ep_data	*data;
 
 		data = kzalloc(sizeof(*data), GFP_KERNEL);
 		if (!data)
-			goto enomem;
+			goto enomem0;
 		data->state = STATE_EP_DISABLED;
 		init_MUTEX (&data->lock);
 		init_waitqueue_head (&data->wait);
@@ -1608,21 +1607,23 @@ static int activate_ep_files (struct dev_data *dev)
 
 		data->req = usb_ep_alloc_request (ep, GFP_KERNEL);
 		if (!data->req)
-			goto enomem;
+			goto enomem1;
 
 		data->inode = gadgetfs_create_file (dev->sb, data->name,
 				data, &ep_config_operations,
 				&data->dentry);
-		if (!data->inode) {
-			usb_ep_free_request(ep, data->req);
-			kfree (data);
-			goto enomem;
-		}
+		if (!data->inode)
+			goto enomem2;
 		list_add_tail (&data->epfiles, &dev->epfiles);
 	}
 	return 0;
 
-enomem:
+enomem2:
+	usb_ep_free_request (ep, data->req);
+enomem1:
+	put_dev (dev);
+	kfree (data);
+enomem0:
 	DBG (dev, "%s enomem\n", __FUNCTION__);
 	destroy_ep_files (dev);
 	return -ENOMEM;
@@ -1793,7 +1794,7 @@ static struct usb_gadget_driver probe_driver = {
  *
  * After initialization, the device stays active for as long as that
  * $CHIP file is open.  Events may then be read from that descriptor,
- * such configuration notifications.  More complex drivers will handle
+ * such as configuration notifications.  More complex drivers will handle
  * some control requests in user space.
  */
 
@@ -2033,12 +2034,10 @@ gadgetfs_fill_super (struct super_block *sb, void *opts, int silent)
 			NULL, &simple_dir_operations,
 			S_IFDIR | S_IRUGO | S_IXUGO);
 	if (!inode)
-		return -ENOMEM;
+		goto enomem0;
 	inode->i_op = &simple_dir_inode_operations;
-	if (!(d = d_alloc_root (inode))) {
-		iput (inode);
-		return -ENOMEM;
-	}
+	if (!(d = d_alloc_root (inode)))
+		goto enomem1;
 	sb->s_root = d;
 
 	/* the ep0 file is named after the controller we expect;
@@ -2046,29 +2045,36 @@ gadgetfs_fill_super (struct super_block *sb, void *opts, int silent)
 	 */
 	dev = dev_new ();
 	if (!dev)
-		return -ENOMEM;
+		goto enomem2;
 
 	dev->sb = sb;
-	if (!(inode = gadgetfs_create_file (sb, CHIP,
+	if (!gadgetfs_create_file (sb, CHIP,
 				dev, &dev_init_operations,
-				&dev->dentry))) {
-		put_dev(dev);
-		return -ENOMEM;
-	}
+				&dev->dentry))
+		goto enomem3;
 
 	/* other endpoint files are available after hardware setup,
 	 * from binding to a controller.
 	 */
 	the_device = dev;
 	return 0;
+
+enomem3:
+	put_dev (dev);
+enomem2:
+	dput (d);
+enomem1:
+	iput (inode);
+enomem0:
+	return -ENOMEM;
 }
 
 /* "mount -t gadgetfs path /dev/gadget" ends up here */
-static struct super_block *
+static int
 gadgetfs_get_sb (struct file_system_type *t, int flags,
-		const char *path, void *opts)
+		const char *path, void *opts, struct vfsmount *mnt)
 {
-	return get_sb_single (t, flags, opts, gadgetfs_fill_super);
+	return get_sb_single (t, flags, opts, gadgetfs_fill_super, mnt);
 }
 
 static void
diff --git a/drivers/usb/gadget/net2280.c b/drivers/usb/gadget/net2280.c
index 0b929349395..1facdea56a8 100644
--- a/drivers/usb/gadget/net2280.c
+++ b/drivers/usb/gadget/net2280.c
@@ -2822,7 +2822,6 @@ static int net2280_probe (struct pci_dev *pdev, const struct pci_device_id *id)
 	unsigned long		resource, len;
 	void			__iomem *base = NULL;
 	int			retval, i;
-	char			buf [8], *bufp;
 
 	/* if you want to support more than one controller in a system,
 	 * usb_gadget_driver_{register,unregister}() must change.
@@ -2896,15 +2895,10 @@ static int net2280_probe (struct pci_dev *pdev, const struct pci_device_id *id)
 		retval = -ENODEV;
 		goto done;
 	}
-#ifndef __sparc__
-	scnprintf (buf, sizeof buf, "%d", pdev->irq);
-	bufp = buf;
-#else
-	bufp = __irq_itoa(pdev->irq);
-#endif
+
 	if (request_irq (pdev->irq, net2280_irq, SA_SHIRQ, driver_name, dev)
 			!= 0) {
-		ERROR (dev, "request interrupt %s failed\n", bufp);
+		ERROR (dev, "request interrupt %d failed\n", pdev->irq);
 		retval = -EBUSY;
 		goto done;
 	}
@@ -2953,8 +2947,8 @@ static int net2280_probe (struct pci_dev *pdev, const struct pci_device_id *id)
 
 	/* done */
 	INFO (dev, "%s\n", driver_desc);
-	INFO (dev, "irq %s, pci mem %p, chip rev %04x\n",
-			bufp, base, dev->chiprev);
+	INFO (dev, "irq %d, pci mem %p, chip rev %04x\n",
+			pdev->irq, base, dev->chiprev);
 	INFO (dev, "version: " DRIVER_VERSION "; dma %s\n",
 			use_dma
 				? (use_dma_chaining ? "chaining" : "enabled")
@@ -2972,6 +2966,22 @@ done:
 	return retval;
 }
 
+/* make sure the board is quiescent; otherwise it will continue
+ * generating IRQs across the upcoming reboot.
+ */
+
+static void net2280_shutdown (struct pci_dev *pdev)
+{
+	struct net2280		*dev = pci_get_drvdata (pdev);
+
+	/* disable IRQs */
+	writel (0, &dev->regs->pciirqenb0);
+	writel (0, &dev->regs->pciirqenb1);
+
+	/* disable the pullup so the host will think we're gone */
+	writel (0, &dev->usb->usbctl);
+}
+
 
 /*-------------------------------------------------------------------------*/
 
@@ -3001,6 +3011,7 @@ static struct pci_driver net2280_pci_driver = {
 
 	.probe =	net2280_probe,
 	.remove =	net2280_remove,
+	.shutdown =	net2280_shutdown,
 
 	/* FIXME add power management support */
 };
diff --git a/drivers/usb/gadget/pxa2xx_udc.c b/drivers/usb/gadget/pxa2xx_udc.c
index 680f7fc5b17..269ce7f4ad6 100644
--- a/drivers/usb/gadget/pxa2xx_udc.c
+++ b/drivers/usb/gadget/pxa2xx_udc.c
@@ -53,12 +53,14 @@
 #include <asm/mach-types.h>
 #include <asm/unaligned.h>
 #include <asm/hardware.h>
+#ifdef CONFIG_ARCH_PXA
 #include <asm/arch/pxa-regs.h>
+#endif
 
 #include <linux/usb_ch9.h>
 #include <linux/usb_gadget.h>
 
-#include <asm/arch/udc.h>
+#include <asm/arch/hardware/intel_udc.h>
 
 
 /*
@@ -545,6 +547,7 @@ write_ep0_fifo (struct pxa2xx_ep *ep, struct pxa2xx_request *req)
 		count = req->req.length;
 		done (ep, req, 0);
 		ep0_idle(ep->dev);
+#ifndef CONFIG_ARCH_IXP4XX
 #if 1
 		/* This seems to get rid of lost status irqs in some cases:
 		 * host responds quickly, or next request involves config
@@ -565,6 +568,7 @@ write_ep0_fifo (struct pxa2xx_ep *ep, struct pxa2xx_request *req)
 			} while (count);
 		}
 #endif
+#endif
 	} else if (ep->dev->req_pending)
 		ep0start(ep->dev, 0, "IN");
 	return is_short;
@@ -1585,7 +1589,7 @@ int usb_gadget_register_driver(struct usb_gadget_driver *driver)
 	int			retval;
 
 	if (!driver
-			|| driver->speed != USB_SPEED_FULL
+			|| driver->speed < USB_SPEED_FULL
 			|| !driver->bind
 			|| !driver->unbind
 			|| !driver->disconnect
@@ -2427,6 +2431,7 @@ static struct pxa2xx_udc memory = {
 #define PXA210_B1		0x00000123
 #define PXA210_B0		0x00000122
 #define IXP425_A0		0x000001c1
+#define IXP465_AD		0x00000200
 
 /*
  * 	probe - binds to the platform device
@@ -2463,6 +2468,8 @@ static int __init pxa2xx_udc_probe(struct platform_device *pdev)
 		break;
 #elif	defined(CONFIG_ARCH_IXP4XX)
 	case IXP425_A0:
+	case IXP465_AD:
+		dev->has_cfr = 1;
 		out_dma = 0;
 		break;
 #endif
@@ -2575,10 +2582,12 @@ static int __exit pxa2xx_udc_remove(struct platform_device *pdev)
 		free_irq(IRQ_USB, dev);
 		dev->got_irq = 0;
 	}
+#ifdef CONFIG_ARCH_LUBBOCK
 	if (machine_is_lubbock()) {
 		free_irq(LUBBOCK_USB_DISC_IRQ, dev);
 		free_irq(LUBBOCK_USB_IRQ, dev);
 	}
+#endif
 	platform_set_drvdata(pdev, NULL);
 	the_controller = NULL;
 	return 0;
diff --git a/drivers/usb/gadget/rndis.c b/drivers/usb/gadget/rndis.c
index 6d6eaad7396..3ff6db7828a 100644
--- a/drivers/usb/gadget/rndis.c
+++ b/drivers/usb/gadget/rndis.c
@@ -1,23 +1,23 @@
-/* 
+/*
  * RNDIS MSG parser
- * 
+ *
  * Version:     $Id: rndis.c,v 1.19 2004/03/25 21:33:46 robert Exp $
- * 
+ *
  * Authors:	Benedikt Spranger, Pengutronix
- * 		Robert Schwebel, Pengutronix
- * 
+ *		Robert Schwebel, Pengutronix
+ *
  *              This program is free software; you can redistribute it and/or
  *              modify it under the terms of the GNU General Public License
- *              version 2, as published by the Free Software Foundation. 
- * 
+ *              version 2, as published by the Free Software Foundation.
+ *
  *		This software was originally developed in conformance with
  *		Microsoft's Remote NDIS Specification License Agreement.
- *              
+ *
  * 03/12/2004 Kai-Uwe Bloem <linux-development@auerswald.de>
  *		Fixed message length bug in init_response
- * 
+ *
  * 03/25/2004 Kai-Uwe Bloem <linux-development@auerswald.de>
- * 		Fixed rndis_rm_hdr length bug.
+ *		Fixed rndis_rm_hdr length bug.
  *
  * Copyright (C) 2004 by David Brownell
  *		updates to merge with Linux 2.6, better match RNDIS spec
@@ -82,7 +82,7 @@ static rndis_resp_t *rndis_add_response (int configNr, u32 length);
 
 
 /* supported OIDs */
-static const u32 oid_supported_list [] = 
+static const u32 oid_supported_list [] =
 {
 	/* the general stuff */
 	OID_GEN_SUPPORTED_LIST,
@@ -103,7 +103,7 @@ static const u32 oid_supported_list [] =
 #if 0
 	OID_GEN_RNDIS_CONFIG_PARAMETER,
 #endif
-	
+
 	/* the statistical stuff */
 	OID_GEN_XMIT_OK,
 	OID_GEN_RCV_OK,
@@ -127,14 +127,14 @@ static const u32 oid_supported_list [] =
 	OID_GEN_TRANSMIT_QUEUE_LENGTH,
 #endif	/* RNDIS_OPTIONAL_STATS */
 
-    	/* mandatory 802.3 */
+	/* mandatory 802.3 */
 	/* the general stuff */
 	OID_802_3_PERMANENT_ADDRESS,
 	OID_802_3_CURRENT_ADDRESS,
 	OID_802_3_MULTICAST_LIST,
 	OID_802_3_MAC_OPTIONS,
 	OID_802_3_MAXIMUM_LIST_SIZE,
-	
+
 	/* the statistical stuff */
 	OID_802_3_RCV_ERROR_ALIGNMENT,
 	OID_802_3_XMIT_ONE_COLLISION,
@@ -172,8 +172,8 @@ static int
 gen_ndis_query_resp (int configNr, u32 OID, u8 *buf, unsigned buf_len,
 		rndis_resp_t *r)
 {
-	int 			retval = -ENOTSUPP;
-	u32 			length = 4;	/* usually */
+	int			retval = -ENOTSUPP;
+	u32			length = 4;	/* usually */
 	__le32			*outbuf;
 	int			i, count;
 	rndis_query_cmplt_type	*resp;
@@ -211,27 +211,27 @@ gen_ndis_query_resp (int configNr, u32 OID, u8 *buf, unsigned buf_len,
 			outbuf[i] = cpu_to_le32 (oid_supported_list[i]);
 		retval = 0;
 		break;
-		
+
 	/* mandatory */
 	case OID_GEN_HARDWARE_STATUS:
 		DEBUG("%s: OID_GEN_HARDWARE_STATUS\n", __FUNCTION__);
-		/* Bogus question! 
+		/* Bogus question!
 		 * Hardware must be ready to receive high level protocols.
-		 * BTW: 
+		 * BTW:
 		 * reddite ergo quae sunt Caesaris Caesari
 		 * et quae sunt Dei Deo!
 		 */
 		*outbuf = __constant_cpu_to_le32 (0);
 		retval = 0;
 		break;
-		
+
 	/* mandatory */
 	case OID_GEN_MEDIA_SUPPORTED:
 		DEBUG("%s: OID_GEN_MEDIA_SUPPORTED\n", __FUNCTION__);
 		*outbuf = cpu_to_le32 (rndis_per_dev_params [configNr].medium);
 		retval = 0;
 		break;
-		
+
 	/* mandatory */
 	case OID_GEN_MEDIA_IN_USE:
 		DEBUG("%s: OID_GEN_MEDIA_IN_USE\n", __FUNCTION__);
@@ -239,7 +239,7 @@ gen_ndis_query_resp (int configNr, u32 OID, u8 *buf, unsigned buf_len,
 		*outbuf = cpu_to_le32 (rndis_per_dev_params [configNr].medium);
 		retval = 0;
 		break;
-		
+
 	/* mandatory */
 	case OID_GEN_MAXIMUM_FRAME_SIZE:
 		DEBUG("%s: OID_GEN_MAXIMUM_FRAME_SIZE\n", __FUNCTION__);
@@ -249,7 +249,7 @@ gen_ndis_query_resp (int configNr, u32 OID, u8 *buf, unsigned buf_len,
 			retval = 0;
 		}
 		break;
-		
+
 	/* mandatory */
 	case OID_GEN_LINK_SPEED:
 		if (rndis_debug > 1)
@@ -272,7 +272,7 @@ gen_ndis_query_resp (int configNr, u32 OID, u8 *buf, unsigned buf_len,
 			retval = 0;
 		}
 		break;
-		
+
 	/* mandatory */
 	case OID_GEN_RECEIVE_BLOCK_SIZE:
 		DEBUG("%s: OID_GEN_RECEIVE_BLOCK_SIZE\n", __FUNCTION__);
@@ -282,7 +282,7 @@ gen_ndis_query_resp (int configNr, u32 OID, u8 *buf, unsigned buf_len,
 			retval = 0;
 		}
 		break;
-		
+
 	/* mandatory */
 	case OID_GEN_VENDOR_ID:
 		DEBUG("%s: OID_GEN_VENDOR_ID\n", __FUNCTION__);
@@ -290,7 +290,7 @@ gen_ndis_query_resp (int configNr, u32 OID, u8 *buf, unsigned buf_len,
 			rndis_per_dev_params [configNr].vendorID);
 		retval = 0;
 		break;
-		
+
 	/* mandatory */
 	case OID_GEN_VENDOR_DESCRIPTION:
 		DEBUG("%s: OID_GEN_VENDOR_DESCRIPTION\n", __FUNCTION__);
@@ -356,7 +356,7 @@ gen_ndis_query_resp (int configNr, u32 OID, u8 *buf, unsigned buf_len,
 			DEBUG("%s: OID_GEN_XMIT_OK\n", __FUNCTION__);
 		if (rndis_per_dev_params [configNr].stats) {
 			*outbuf = cpu_to_le32 (
-			    rndis_per_dev_params [configNr].stats->tx_packets - 
+			    rndis_per_dev_params [configNr].stats->tx_packets -
 			    rndis_per_dev_params [configNr].stats->tx_errors -
 			    rndis_per_dev_params [configNr].stats->tx_dropped);
 			retval = 0;
@@ -369,13 +369,13 @@ gen_ndis_query_resp (int configNr, u32 OID, u8 *buf, unsigned buf_len,
 			DEBUG("%s: OID_GEN_RCV_OK\n", __FUNCTION__);
 		if (rndis_per_dev_params [configNr].stats) {
 			*outbuf = cpu_to_le32 (
-			    rndis_per_dev_params [configNr].stats->rx_packets - 
+			    rndis_per_dev_params [configNr].stats->rx_packets -
 			    rndis_per_dev_params [configNr].stats->rx_errors -
 			    rndis_per_dev_params [configNr].stats->rx_dropped);
 			retval = 0;
 		}
 		break;
-		
+
 	/* mandatory */
 	case OID_GEN_XMIT_ERROR:
 		if (rndis_debug > 1)
@@ -386,7 +386,7 @@ gen_ndis_query_resp (int configNr, u32 OID, u8 *buf, unsigned buf_len,
 			retval = 0;
 		}
 		break;
-		
+
 	/* mandatory */
 	case OID_GEN_RCV_ERROR:
 		if (rndis_debug > 1)
@@ -397,7 +397,7 @@ gen_ndis_query_resp (int configNr, u32 OID, u8 *buf, unsigned buf_len,
 			retval = 0;
 		}
 		break;
-		
+
 	/* mandatory */
 	case OID_GEN_RCV_NO_BUFFER:
 		DEBUG("%s: OID_GEN_RCV_NO_BUFFER\n", __FUNCTION__);
@@ -411,7 +411,7 @@ gen_ndis_query_resp (int configNr, u32 OID, u8 *buf, unsigned buf_len,
 #ifdef	RNDIS_OPTIONAL_STATS
 	case OID_GEN_DIRECTED_BYTES_XMIT:
 		DEBUG("%s: OID_GEN_DIRECTED_BYTES_XMIT\n", __FUNCTION__);
-		/* 
+		/*
 		 * Aunt Tilly's size of shoes
 		 * minus antarctica count of penguins
 		 * divided by weight of Alpha Centauri
@@ -419,7 +419,7 @@ gen_ndis_query_resp (int configNr, u32 OID, u8 *buf, unsigned buf_len,
 		if (rndis_per_dev_params [configNr].stats) {
 			*outbuf = cpu_to_le32 (
 				(rndis_per_dev_params [configNr]
-					.stats->tx_packets - 
+					.stats->tx_packets -
 				 rndis_per_dev_params [configNr]
 					 .stats->tx_errors -
 				 rndis_per_dev_params [configNr]
@@ -428,14 +428,14 @@ gen_ndis_query_resp (int configNr, u32 OID, u8 *buf, unsigned buf_len,
 			retval = 0;
 		}
 		break;
-		
+
 	case OID_GEN_DIRECTED_FRAMES_XMIT:
 		DEBUG("%s: OID_GEN_DIRECTED_FRAMES_XMIT\n", __FUNCTION__);
 		/* dito */
 		if (rndis_per_dev_params [configNr].stats) {
 			*outbuf = cpu_to_le32 (
 				(rndis_per_dev_params [configNr]
-					.stats->tx_packets - 
+					.stats->tx_packets -
 				 rndis_per_dev_params [configNr]
 					 .stats->tx_errors -
 				 rndis_per_dev_params [configNr]
@@ -444,7 +444,7 @@ gen_ndis_query_resp (int configNr, u32 OID, u8 *buf, unsigned buf_len,
 			retval = 0;
 		}
 		break;
-		
+
 	case OID_GEN_MULTICAST_BYTES_XMIT:
 		DEBUG("%s: OID_GEN_MULTICAST_BYTES_XMIT\n", __FUNCTION__);
 		if (rndis_per_dev_params [configNr].stats) {
@@ -453,7 +453,7 @@ gen_ndis_query_resp (int configNr, u32 OID, u8 *buf, unsigned buf_len,
 			retval = 0;
 		}
 		break;
-		
+
 	case OID_GEN_MULTICAST_FRAMES_XMIT:
 		DEBUG("%s: OID_GEN_MULTICAST_FRAMES_XMIT\n", __FUNCTION__);
 		if (rndis_per_dev_params [configNr].stats) {
@@ -462,7 +462,7 @@ gen_ndis_query_resp (int configNr, u32 OID, u8 *buf, unsigned buf_len,
 			retval = 0;
 		}
 		break;
-		
+
 	case OID_GEN_BROADCAST_BYTES_XMIT:
 		DEBUG("%s: OID_GEN_BROADCAST_BYTES_XMIT\n", __FUNCTION__);
 		if (rndis_per_dev_params [configNr].stats) {
@@ -471,7 +471,7 @@ gen_ndis_query_resp (int configNr, u32 OID, u8 *buf, unsigned buf_len,
 			retval = 0;
 		}
 		break;
-		
+
 	case OID_GEN_BROADCAST_FRAMES_XMIT:
 		DEBUG("%s: OID_GEN_BROADCAST_FRAMES_XMIT\n", __FUNCTION__);
 		if (rndis_per_dev_params [configNr].stats) {
@@ -480,19 +480,19 @@ gen_ndis_query_resp (int configNr, u32 OID, u8 *buf, unsigned buf_len,
 			retval = 0;
 		}
 		break;
-		
+
 	case OID_GEN_DIRECTED_BYTES_RCV:
 		DEBUG("%s: OID_GEN_DIRECTED_BYTES_RCV\n", __FUNCTION__);
 		*outbuf = __constant_cpu_to_le32 (0);
 		retval = 0;
 		break;
-		
+
 	case OID_GEN_DIRECTED_FRAMES_RCV:
 		DEBUG("%s: OID_GEN_DIRECTED_FRAMES_RCV\n", __FUNCTION__);
 		*outbuf = __constant_cpu_to_le32 (0);
 		retval = 0;
 		break;
-		
+
 	case OID_GEN_MULTICAST_BYTES_RCV:
 		DEBUG("%s: OID_GEN_MULTICAST_BYTES_RCV\n", __FUNCTION__);
 		if (rndis_per_dev_params [configNr].stats) {
@@ -501,7 +501,7 @@ gen_ndis_query_resp (int configNr, u32 OID, u8 *buf, unsigned buf_len,
 			retval = 0;
 		}
 		break;
-		
+
 	case OID_GEN_MULTICAST_FRAMES_RCV:
 		DEBUG("%s: OID_GEN_MULTICAST_FRAMES_RCV\n", __FUNCTION__);
 		if (rndis_per_dev_params [configNr].stats) {
@@ -510,7 +510,7 @@ gen_ndis_query_resp (int configNr, u32 OID, u8 *buf, unsigned buf_len,
 			retval = 0;
 		}
 		break;
-		
+
 	case OID_GEN_BROADCAST_BYTES_RCV:
 		DEBUG("%s: OID_GEN_BROADCAST_BYTES_RCV\n", __FUNCTION__);
 		if (rndis_per_dev_params [configNr].stats) {
@@ -519,7 +519,7 @@ gen_ndis_query_resp (int configNr, u32 OID, u8 *buf, unsigned buf_len,
 			retval = 0;
 		}
 		break;
-		
+
 	case OID_GEN_BROADCAST_FRAMES_RCV:
 		DEBUG("%s: OID_GEN_BROADCAST_FRAMES_RCV\n", __FUNCTION__);
 		if (rndis_per_dev_params [configNr].stats) {
@@ -528,7 +528,7 @@ gen_ndis_query_resp (int configNr, u32 OID, u8 *buf, unsigned buf_len,
 			retval = 0;
 		}
 		break;
-		
+
 	case OID_GEN_RCV_CRC_ERROR:
 		DEBUG("%s: OID_GEN_RCV_CRC_ERROR\n", __FUNCTION__);
 		if (rndis_per_dev_params [configNr].stats) {
@@ -537,7 +537,7 @@ gen_ndis_query_resp (int configNr, u32 OID, u8 *buf, unsigned buf_len,
 			retval = 0;
 		}
 		break;
-		
+
 	case OID_GEN_TRANSMIT_QUEUE_LENGTH:
 		DEBUG("%s: OID_GEN_TRANSMIT_QUEUE_LENGTH\n", __FUNCTION__);
 		*outbuf = __constant_cpu_to_le32 (0);
@@ -558,7 +558,7 @@ gen_ndis_query_resp (int configNr, u32 OID, u8 *buf, unsigned buf_len,
 			retval = 0;
 		}
 		break;
-		
+
 	/* mandatory */
 	case OID_802_3_CURRENT_ADDRESS:
 		DEBUG("%s: OID_802_3_CURRENT_ADDRESS\n", __FUNCTION__);
@@ -570,7 +570,7 @@ gen_ndis_query_resp (int configNr, u32 OID, u8 *buf, unsigned buf_len,
 			retval = 0;
 		}
 		break;
-		
+
 	/* mandatory */
 	case OID_802_3_MULTICAST_LIST:
 		DEBUG("%s: OID_802_3_MULTICAST_LIST\n", __FUNCTION__);
@@ -578,7 +578,7 @@ gen_ndis_query_resp (int configNr, u32 OID, u8 *buf, unsigned buf_len,
 		*outbuf = __constant_cpu_to_le32 (0xE0000000);
 		retval = 0;
 		break;
-		
+
 	/* mandatory */
 	case OID_802_3_MAXIMUM_LIST_SIZE:
 		DEBUG("%s: OID_802_3_MAXIMUM_LIST_SIZE\n", __FUNCTION__);
@@ -586,7 +586,7 @@ gen_ndis_query_resp (int configNr, u32 OID, u8 *buf, unsigned buf_len,
 		*outbuf = __constant_cpu_to_le32 (1);
 		retval = 0;
 		break;
-		
+
 	case OID_802_3_MAC_OPTIONS:
 		DEBUG("%s: OID_802_3_MAC_OPTIONS\n", __FUNCTION__);
 		break;
@@ -602,56 +602,56 @@ gen_ndis_query_resp (int configNr, u32 OID, u8 *buf, unsigned buf_len,
 			retval = 0;
 		}
 		break;
-		
+
 	/* mandatory */
 	case OID_802_3_XMIT_ONE_COLLISION:
 		DEBUG("%s: OID_802_3_XMIT_ONE_COLLISION\n", __FUNCTION__);
 		*outbuf = __constant_cpu_to_le32 (0);
 		retval = 0;
 		break;
-		
+
 	/* mandatory */
 	case OID_802_3_XMIT_MORE_COLLISIONS:
 		DEBUG("%s: OID_802_3_XMIT_MORE_COLLISIONS\n", __FUNCTION__);
 		*outbuf = __constant_cpu_to_le32 (0);
 		retval = 0;
 		break;
-		
+
 #ifdef	RNDIS_OPTIONAL_STATS
 	case OID_802_3_XMIT_DEFERRED:
 		DEBUG("%s: OID_802_3_XMIT_DEFERRED\n", __FUNCTION__);
 		/* TODO */
 		break;
-		
+
 	case OID_802_3_XMIT_MAX_COLLISIONS:
 		DEBUG("%s: OID_802_3_XMIT_MAX_COLLISIONS\n", __FUNCTION__);
 		/* TODO */
 		break;
-		
+
 	case OID_802_3_RCV_OVERRUN:
 		DEBUG("%s: OID_802_3_RCV_OVERRUN\n", __FUNCTION__);
 		/* TODO */
 		break;
-		
+
 	case OID_802_3_XMIT_UNDERRUN:
 		DEBUG("%s: OID_802_3_XMIT_UNDERRUN\n", __FUNCTION__);
 		/* TODO */
 		break;
-		
+
 	case OID_802_3_XMIT_HEARTBEAT_FAILURE:
 		DEBUG("%s: OID_802_3_XMIT_HEARTBEAT_FAILURE\n", __FUNCTION__);
 		/* TODO */
 		break;
-		
+
 	case OID_802_3_XMIT_TIMES_CRS_LOST:
 		DEBUG("%s: OID_802_3_XMIT_TIMES_CRS_LOST\n", __FUNCTION__);
 		/* TODO */
 		break;
-		
+
 	case OID_802_3_XMIT_LATE_COLLISIONS:
 		DEBUG("%s: OID_802_3_XMIT_LATE_COLLISIONS\n", __FUNCTION__);
 		/* TODO */
-		break;		
+		break;
 #endif	/* RNDIS_OPTIONAL_STATS */
 
 #ifdef	RNDIS_PM
@@ -676,23 +676,23 @@ gen_ndis_query_resp (int configNr, u32 OID, u8 *buf, unsigned buf_len,
 #endif
 
 	default:
-		printk (KERN_WARNING "%s: query unknown OID 0x%08X\n", 
+		printk (KERN_WARNING "%s: query unknown OID 0x%08X\n",
 			 __FUNCTION__, OID);
 	}
 	if (retval < 0)
 		length = 0;
-	
+
 	resp->InformationBufferLength = cpu_to_le32 (length);
 	r->length = length + sizeof *resp;
 	resp->MessageLength = cpu_to_le32 (r->length);
 	return retval;
 }
 
-static int gen_ndis_set_resp (u8 configNr, u32 OID, u8 *buf, u32 buf_len, 
-			      rndis_resp_t *r)
+static int gen_ndis_set_resp (u8 configNr, u32 OID, u8 *buf, u32 buf_len,
+			rndis_resp_t *r)
 {
 	rndis_set_cmplt_type		*resp;
-	int 				i, retval = -ENOTSUPP;
+	int				i, retval = -ENOTSUPP;
 	struct rndis_params		*params;
 
 	if (!r)
@@ -745,9 +745,9 @@ update_linkstate:
 			netif_stop_queue (params->dev);
 		}
 		break;
-		
+
 	case OID_802_3_MULTICAST_LIST:
-		/* I think we can ignore this */		
+		/* I think we can ignore this */
 		DEBUG("%s: OID_802_3_MULTICAST_LIST\n", __FUNCTION__);
 		retval = 0;
 		break;
@@ -796,29 +796,29 @@ update_linkstate:
 #endif	/* RNDIS_PM */
 
 	default:
-		printk (KERN_WARNING "%s: set unknown OID 0x%08X, size %d\n", 
+		printk (KERN_WARNING "%s: set unknown OID 0x%08X, size %d\n",
 			 __FUNCTION__, OID, buf_len);
 	}
-	
+
 	return retval;
 }
 
-/* 
- * Response Functions 
+/*
+ * Response Functions
  */
 
 static int rndis_init_response (int configNr, rndis_init_msg_type *buf)
 {
-	rndis_init_cmplt_type	*resp; 
+	rndis_init_cmplt_type	*resp;
 	rndis_resp_t            *r;
-	
+
 	if (!rndis_per_dev_params [configNr].dev) return -ENOTSUPP;
-	
+
 	r = rndis_add_response (configNr, sizeof (rndis_init_cmplt_type));
 	if (!r)
 		return -ENOMEM;
 	resp = (rndis_init_cmplt_type *) r->buf;
-	
+
 	resp->MessageType = __constant_cpu_to_le32 (
 			REMOTE_NDIS_INITIALIZE_CMPLT);
 	resp->MessageLength = __constant_cpu_to_le32 (52);
@@ -837,11 +837,11 @@ static int rndis_init_response (int configNr, rndis_init_msg_type *buf)
 	resp->PacketAlignmentFactor = __constant_cpu_to_le32 (0);
 	resp->AFListOffset = __constant_cpu_to_le32 (0);
 	resp->AFListSize = __constant_cpu_to_le32 (0);
-	
+
 	if (rndis_per_dev_params [configNr].ack)
-	    rndis_per_dev_params [configNr].ack (
-	    		rndis_per_dev_params [configNr].dev);
-	
+		rndis_per_dev_params [configNr].ack (
+			rndis_per_dev_params [configNr].dev);
+
 	return 0;
 }
 
@@ -849,10 +849,10 @@ static int rndis_query_response (int configNr, rndis_query_msg_type *buf)
 {
 	rndis_query_cmplt_type *resp;
 	rndis_resp_t            *r;
-	
+
 	// DEBUG("%s: OID = %08X\n", __FUNCTION__, cpu_to_le32(buf->OID));
 	if (!rndis_per_dev_params [configNr].dev) return -ENOTSUPP;
-	
+
 	/*
 	 * we need more memory:
 	 * gen_ndis_query_resp expects enough space for
@@ -864,10 +864,10 @@ static int rndis_query_response (int configNr, rndis_query_msg_type *buf)
 	if (!r)
 		return -ENOMEM;
 	resp = (rndis_query_cmplt_type *) r->buf;
-	
+
 	resp->MessageType = __constant_cpu_to_le32 (REMOTE_NDIS_QUERY_CMPLT);
 	resp->RequestID = buf->RequestID; /* Still LE in msg buffer */
-  	
+
 	if (gen_ndis_query_resp (configNr, le32_to_cpu (buf->OID),
 			le32_to_cpu(buf->InformationBufferOffset)
 					+ 8 + (u8 *) buf,
@@ -881,10 +881,10 @@ static int rndis_query_response (int configNr, rndis_query_msg_type *buf)
 		resp->InformationBufferOffset = __constant_cpu_to_le32 (0);
 	} else
 		resp->Status = __constant_cpu_to_le32 (RNDIS_STATUS_SUCCESS);
-	
+
 	if (rndis_per_dev_params [configNr].ack)
-	    rndis_per_dev_params [configNr].ack (
-	    		rndis_per_dev_params [configNr].dev);
+		rndis_per_dev_params [configNr].ack (
+			rndis_per_dev_params [configNr].dev);
 	return 0;
 }
 
@@ -893,7 +893,7 @@ static int rndis_set_response (int configNr, rndis_set_msg_type *buf)
 	u32			BufLength, BufOffset;
 	rndis_set_cmplt_type	*resp;
 	rndis_resp_t		*r;
-	
+
 	r = rndis_add_response (configNr, sizeof (rndis_set_cmplt_type));
 	if (!r)
 		return -ENOMEM;
@@ -906,26 +906,27 @@ static int rndis_set_response (int configNr, rndis_set_msg_type *buf)
 	DEBUG("%s: Length: %d\n", __FUNCTION__, BufLength);
 	DEBUG("%s: Offset: %d\n", __FUNCTION__, BufOffset);
 	DEBUG("%s: InfoBuffer: ", __FUNCTION__);
-	
+
 	for (i = 0; i < BufLength; i++) {
 		DEBUG ("%02x ", *(((u8 *) buf) + i + 8 + BufOffset));
 	}
-	
+
 	DEBUG ("\n");
 #endif
-	
+
 	resp->MessageType = __constant_cpu_to_le32 (REMOTE_NDIS_SET_CMPLT);
 	resp->MessageLength = __constant_cpu_to_le32 (16);
 	resp->RequestID = buf->RequestID; /* Still LE in msg buffer */
-	if (gen_ndis_set_resp (configNr, le32_to_cpu (buf->OID), 
-			       ((u8 *) buf) + 8 + BufOffset, BufLength, r))
-	    resp->Status = __constant_cpu_to_le32 (RNDIS_STATUS_NOT_SUPPORTED);
-	else resp->Status = __constant_cpu_to_le32 (RNDIS_STATUS_SUCCESS);
-	
+	if (gen_ndis_set_resp (configNr, le32_to_cpu (buf->OID),
+			((u8 *) buf) + 8 + BufOffset, BufLength, r))
+		resp->Status = __constant_cpu_to_le32 (RNDIS_STATUS_NOT_SUPPORTED);
+	else
+		resp->Status = __constant_cpu_to_le32 (RNDIS_STATUS_SUCCESS);
+
 	if (rndis_per_dev_params [configNr].ack)
-	    rndis_per_dev_params [configNr].ack (
-	    		rndis_per_dev_params [configNr].dev);
-	
+		rndis_per_dev_params [configNr].ack (
+			rndis_per_dev_params [configNr].dev);
+
 	return 0;
 }
 
@@ -933,27 +934,27 @@ static int rndis_reset_response (int configNr, rndis_reset_msg_type *buf)
 {
 	rndis_reset_cmplt_type	*resp;
 	rndis_resp_t		*r;
-	
+
 	r = rndis_add_response (configNr, sizeof (rndis_reset_cmplt_type));
 	if (!r)
 		return -ENOMEM;
 	resp = (rndis_reset_cmplt_type *) r->buf;
-	
+
 	resp->MessageType = __constant_cpu_to_le32 (REMOTE_NDIS_RESET_CMPLT);
 	resp->MessageLength = __constant_cpu_to_le32 (16);
 	resp->Status = __constant_cpu_to_le32 (RNDIS_STATUS_SUCCESS);
 	/* resent information */
 	resp->AddressingReset = __constant_cpu_to_le32 (1);
-	
+
 	if (rndis_per_dev_params [configNr].ack)
-	    rndis_per_dev_params [configNr].ack (
-	    		rndis_per_dev_params [configNr].dev);
+		rndis_per_dev_params [configNr].ack (
+			rndis_per_dev_params [configNr].dev);
 
 	return 0;
 }
 
 static int rndis_keepalive_response (int configNr,
-				     rndis_keepalive_msg_type *buf)
+				rndis_keepalive_msg_type *buf)
 {
 	rndis_keepalive_cmplt_type	*resp;
 	rndis_resp_t			*r;
@@ -964,48 +965,48 @@ static int rndis_keepalive_response (int configNr,
 	if (!r)
 		return -ENOMEM;
 	resp = (rndis_keepalive_cmplt_type *) r->buf;
-		
+
 	resp->MessageType = __constant_cpu_to_le32 (
 			REMOTE_NDIS_KEEPALIVE_CMPLT);
 	resp->MessageLength = __constant_cpu_to_le32 (16);
 	resp->RequestID = buf->RequestID; /* Still LE in msg buffer */
 	resp->Status = __constant_cpu_to_le32 (RNDIS_STATUS_SUCCESS);
-	
+
 	if (rndis_per_dev_params [configNr].ack)
-	    rndis_per_dev_params [configNr].ack (
-	    		rndis_per_dev_params [configNr].dev);
-	
+		rndis_per_dev_params [configNr].ack (
+			rndis_per_dev_params [configNr].dev);
+
 	return 0;
 }
 
 
-/* 
- * Device to Host Comunication 
+/*
+ * Device to Host Comunication
  */
 static int rndis_indicate_status_msg (int configNr, u32 status)
 {
-	rndis_indicate_status_msg_type	*resp;	
+	rndis_indicate_status_msg_type	*resp;
 	rndis_resp_t			*r;
-	
+
 	if (rndis_per_dev_params [configNr].state == RNDIS_UNINITIALIZED)
-	    return -ENOTSUPP;
-	
-	r = rndis_add_response (configNr, 
+		return -ENOTSUPP;
+
+	r = rndis_add_response (configNr,
 				sizeof (rndis_indicate_status_msg_type));
 	if (!r)
 		return -ENOMEM;
 	resp = (rndis_indicate_status_msg_type *) r->buf;
-	
+
 	resp->MessageType = __constant_cpu_to_le32 (
 			REMOTE_NDIS_INDICATE_STATUS_MSG);
 	resp->MessageLength = __constant_cpu_to_le32 (20);
 	resp->Status = cpu_to_le32 (status);
 	resp->StatusBufferLength = __constant_cpu_to_le32 (0);
 	resp->StatusBufferOffset = __constant_cpu_to_le32 (0);
-	
-	if (rndis_per_dev_params [configNr].ack) 
-	    rndis_per_dev_params [configNr].ack (
-	    		rndis_per_dev_params [configNr].dev);
+
+	if (rndis_per_dev_params [configNr].ack)
+		rndis_per_dev_params [configNr].ack (
+			rndis_per_dev_params [configNr].dev);
 	return 0;
 }
 
@@ -1013,7 +1014,7 @@ int rndis_signal_connect (int configNr)
 {
 	rndis_per_dev_params [configNr].media_state
 			= NDIS_MEDIA_STATE_CONNECTED;
-	return rndis_indicate_status_msg (configNr, 
+	return rndis_indicate_status_msg (configNr,
 					  RNDIS_STATUS_MEDIA_CONNECT);
 }
 
@@ -1045,26 +1046,26 @@ void rndis_set_host_mac (int configNr, const u8 *addr)
 	rndis_per_dev_params [configNr].host_mac = addr;
 }
 
-/* 
- * Message Parser 
+/*
+ * Message Parser
  */
 int rndis_msg_parser (u8 configNr, u8 *buf)
 {
 	u32 MsgType, MsgLength;
 	__le32 *tmp;
 	struct rndis_params		*params;
-	
+
 	if (!buf)
 		return -ENOMEM;
-	
-	tmp = (__le32 *) buf; 
+
+	tmp = (__le32 *) buf;
 	MsgType   = le32_to_cpup(tmp++);
 	MsgLength = le32_to_cpup(tmp++);
-	
+
 	if (configNr >= RNDIS_MAX_CONFIGS)
 		return -ENOTSUPP;
 	params = &rndis_per_dev_params [configNr];
-	
+
 	/* NOTE: RNDIS is *EXTREMELY* chatty ... Windows constantly polls for
 	 * rx/tx statistics and link status, in addition to KEEPALIVE traffic
 	 * and normal HC level polling to see if there's any IN traffic.
@@ -1073,12 +1074,12 @@ int rndis_msg_parser (u8 configNr, u8 *buf)
 	/* For USB: responses may take up to 10 seconds */
 	switch (MsgType) {
 	case REMOTE_NDIS_INITIALIZE_MSG:
-		DEBUG("%s: REMOTE_NDIS_INITIALIZE_MSG\n", 
+		DEBUG("%s: REMOTE_NDIS_INITIALIZE_MSG\n",
 			__FUNCTION__ );
 		params->state = RNDIS_INITIALIZED;
 		return  rndis_init_response (configNr,
-					     (rndis_init_msg_type *) buf);
-		
+					(rndis_init_msg_type *) buf);
+
 	case REMOTE_NDIS_HALT_MSG:
 		DEBUG("%s: REMOTE_NDIS_HALT_MSG\n",
 			__FUNCTION__ );
@@ -1088,37 +1089,37 @@ int rndis_msg_parser (u8 configNr, u8 *buf)
 			netif_stop_queue (params->dev);
 		}
 		return 0;
-		
+
 	case REMOTE_NDIS_QUERY_MSG:
-		return rndis_query_response (configNr, 
-					     (rndis_query_msg_type *) buf);
-		
+		return rndis_query_response (configNr,
+					(rndis_query_msg_type *) buf);
+
 	case REMOTE_NDIS_SET_MSG:
-		return rndis_set_response (configNr, 
-					   (rndis_set_msg_type *) buf);
-		
+		return rndis_set_response (configNr,
+					(rndis_set_msg_type *) buf);
+
 	case REMOTE_NDIS_RESET_MSG:
-		DEBUG("%s: REMOTE_NDIS_RESET_MSG\n", 
+		DEBUG("%s: REMOTE_NDIS_RESET_MSG\n",
 			__FUNCTION__ );
 		return rndis_reset_response (configNr,
-					     (rndis_reset_msg_type *) buf);
+					(rndis_reset_msg_type *) buf);
 
 	case REMOTE_NDIS_KEEPALIVE_MSG:
 		/* For USB: host does this every 5 seconds */
 		if (rndis_debug > 1)
-			DEBUG("%s: REMOTE_NDIS_KEEPALIVE_MSG\n", 
+			DEBUG("%s: REMOTE_NDIS_KEEPALIVE_MSG\n",
 				__FUNCTION__ );
 		return rndis_keepalive_response (configNr,
-						 (rndis_keepalive_msg_type *) 
+						 (rndis_keepalive_msg_type *)
 						 buf);
-		
-	default: 
+
+	default:
 		/* At least Windows XP emits some undefined RNDIS messages.
 		 * In one case those messages seemed to relate to the host
 		 * suspending itself.
 		 */
 		printk (KERN_WARNING
-			"%s: unknown RNDIS message 0x%08X len %d\n", 
+			"%s: unknown RNDIS message 0x%08X len %d\n",
 			__FUNCTION__ , MsgType, MsgLength);
 		{
 			unsigned i;
@@ -1142,14 +1143,14 @@ int rndis_msg_parser (u8 configNr, u8 *buf)
 		}
 		break;
 	}
-	
+
 	return -ENOTSUPP;
 }
 
 int rndis_register (int (* rndis_control_ack) (struct net_device *))
 {
 	u8 i;
-	
+
 	for (i = 0; i < RNDIS_MAX_CONFIGS; i++) {
 		if (!rndis_per_dev_params [i].used) {
 			rndis_per_dev_params [i].used = 1;
@@ -1159,32 +1160,32 @@ int rndis_register (int (* rndis_control_ack) (struct net_device *))
 		}
 	}
 	DEBUG("failed\n");
-	
+
 	return -1;
 }
 
 void rndis_deregister (int configNr)
 {
 	DEBUG("%s: \n", __FUNCTION__ );
-	
+
 	if (configNr >= RNDIS_MAX_CONFIGS) return;
 	rndis_per_dev_params [configNr].used = 0;
-	
+
 	return;
 }
 
-int rndis_set_param_dev (u8 configNr, struct net_device *dev, 
+int rndis_set_param_dev (u8 configNr, struct net_device *dev,
 			 struct net_device_stats *stats,
 			 u16 *cdc_filter)
 {
 	DEBUG("%s:\n", __FUNCTION__ );
 	if (!dev || !stats) return -1;
 	if (configNr >= RNDIS_MAX_CONFIGS) return -1;
-	
+
 	rndis_per_dev_params [configNr].dev = dev;
 	rndis_per_dev_params [configNr].stats = stats;
 	rndis_per_dev_params [configNr].filter = cdc_filter;
-	
+
 	return 0;
 }
 
@@ -1193,10 +1194,10 @@ int rndis_set_param_vendor (u8 configNr, u32 vendorID, const char *vendorDescr)
 	DEBUG("%s:\n", __FUNCTION__ );
 	if (!vendorDescr) return -1;
 	if (configNr >= RNDIS_MAX_CONFIGS) return -1;
-	
+
 	rndis_per_dev_params [configNr].vendorID = vendorID;
 	rndis_per_dev_params [configNr].vendorDescr = vendorDescr;
-	
+
 	return 0;
 }
 
@@ -1204,10 +1205,10 @@ int rndis_set_param_medium (u8 configNr, u32 medium, u32 speed)
 {
 	DEBUG("%s: %u %u\n", __FUNCTION__, medium, speed);
 	if (configNr >= RNDIS_MAX_CONFIGS) return -1;
-	
+
 	rndis_per_dev_params [configNr].medium = medium;
 	rndis_per_dev_params [configNr].speed = speed;
-	
+
 	return 0;
 }
 
@@ -1229,9 +1230,9 @@ void rndis_free_response (int configNr, u8 *buf)
 {
 	rndis_resp_t		*r;
 	struct list_head	*act, *tmp;
-	
-	list_for_each_safe (act, tmp, 
-			    &(rndis_per_dev_params [configNr].resp_queue))
+
+	list_for_each_safe (act, tmp,
+			&(rndis_per_dev_params [configNr].resp_queue))
 	{
 		r = list_entry (act, rndis_resp_t, list);
 		if (r && r->buf == buf) {
@@ -1244,12 +1245,12 @@ void rndis_free_response (int configNr, u8 *buf)
 u8 *rndis_get_next_response (int configNr, u32 *length)
 {
 	rndis_resp_t		*r;
-	struct list_head 	*act, *tmp;
-	
+	struct list_head	*act, *tmp;
+
 	if (!length) return NULL;
-	
-	list_for_each_safe (act, tmp, 
-			    &(rndis_per_dev_params [configNr].resp_queue))
+
+	list_for_each_safe (act, tmp,
+			&(rndis_per_dev_params [configNr].resp_queue))
 	{
 		r = list_entry (act, rndis_resp_t, list);
 		if (!r->send) {
@@ -1258,24 +1259,24 @@ u8 *rndis_get_next_response (int configNr, u32 *length)
 			return r->buf;
 		}
 	}
-	
+
 	return NULL;
 }
 
 static rndis_resp_t *rndis_add_response (int configNr, u32 length)
 {
 	rndis_resp_t	*r;
-	
+
 	/* NOTE:  this gets copied into ether.c USB_BUFSIZ bytes ... */
 	r = kmalloc (sizeof (rndis_resp_t) + length, GFP_ATOMIC);
 	if (!r) return NULL;
-	
+
 	r->buf = (u8 *) (r + 1);
 	r->length = length;
 	r->send = 0;
-	
-	list_add_tail (&r->list, 
-		       &(rndis_per_dev_params [configNr].resp_queue));
+
+	list_add_tail (&r->list,
+		&(rndis_per_dev_params [configNr].resp_queue));
 	return r;
 }
 
@@ -1301,14 +1302,14 @@ int rndis_rm_hdr(struct sk_buff *skb)
 
 #ifdef	CONFIG_USB_GADGET_DEBUG_FILES
 
-static int rndis_proc_read (char *page, char **start, off_t off, int count, int *eof, 
-		     void *data)
+static int rndis_proc_read (char *page, char **start, off_t off, int count, int *eof,
+		void *data)
 {
 	char *out = page;
 	int len;
 	rndis_params *param = (rndis_params *) data;
-	
-	out += snprintf (out, count, 
+
+	out += snprintf (out, count,
 			 "Config Nr. %d\n"
 			 "used      : %s\n"
 			 "state     : %s\n"
@@ -1316,8 +1317,8 @@ static int rndis_proc_read (char *page, char **start, off_t off, int count, int
 			 "speed     : %d\n"
 			 "cable     : %s\n"
 			 "vendor ID : 0x%08X\n"
-			 "vendor    : %s\n", 
-			 param->confignr, (param->used) ? "y" : "n", 
+			 "vendor    : %s\n",
+			 param->confignr, (param->used) ? "y" : "n",
 			 ({ char *s = "?";
 			 switch (param->state) {
 			 case RNDIS_UNINITIALIZED:
@@ -1327,32 +1328,32 @@ static int rndis_proc_read (char *page, char **start, off_t off, int count, int
 			 case RNDIS_DATA_INITIALIZED:
 				s = "RNDIS_DATA_INITIALIZED"; break;
 			}; s; }),
-			 param->medium, 
-			 (param->media_state) ? 0 : param->speed*100, 
+			 param->medium,
+			 (param->media_state) ? 0 : param->speed*100,
 			 (param->media_state) ? "disconnected" : "connected",
-			 param->vendorID, param->vendorDescr);      
-	
+			 param->vendorID, param->vendorDescr);
+
 	len = out - page;
 	len -= off;
-	
+
 	if (len < count) {
 		*eof = 1;
 		if (len <= 0)
 			return 0;
 	} else
 		len = count;
-	
+
 	*start = page + off;
 	return len;
 }
 
-static int rndis_proc_write (struct file *file, const char __user *buffer, 
-		      unsigned long count, void *data)
+static int rndis_proc_write (struct file *file, const char __user *buffer,
+		unsigned long count, void *data)
 {
 	rndis_params *p = data;
 	u32 speed = 0;
 	int i, fl_speed = 0;
-	
+
 	for (i = 0; i < count; i++) {
 		char c;
 		if (get_user(c, buffer))
@@ -1379,15 +1380,15 @@ static int rndis_proc_write (struct file *file, const char __user *buffer,
 		case 'd':
 			rndis_signal_disconnect(p->confignr);
 			break;
-		default: 
+		default:
 			if (fl_speed) p->speed = speed;
 			else DEBUG ("%c is not valid\n", c);
 			break;
 		}
-		
+
 		buffer++;
 	}
-	
+
 	return count;
 }
 
@@ -1408,7 +1409,7 @@ int __init rndis_init (void)
 
 		sprintf (name, NAME_TEMPLATE, i);
 		if (!(rndis_connect_state [i]
-				= create_proc_entry (name, 0660, NULL))) 
+				= create_proc_entry (name, 0660, NULL)))
 		{
 			DEBUG ("%s :remove entries", __FUNCTION__);
 			while (i) {
@@ -1432,7 +1433,7 @@ int __init rndis_init (void)
 				= NDIS_MEDIA_STATE_DISCONNECTED;
 		INIT_LIST_HEAD (&(rndis_per_dev_params [i].resp_queue));
 	}
-	
+
 	return 0;
 }
 
@@ -1441,7 +1442,7 @@ void rndis_exit (void)
 #ifdef	CONFIG_USB_GADGET_DEBUG_FILES
 	u8 i;
 	char name [20];
-	
+
 	for (i = 0; i < RNDIS_MAX_CONFIGS; i++) {
 		sprintf (name, NAME_TEMPLATE, i);
 		remove_proc_entry (name, NULL);
diff --git a/drivers/usb/gadget/rndis.h b/drivers/usb/gadget/rndis.h
index 95b4c632610..2956608be75 100644
--- a/drivers/usb/gadget/rndis.h
+++ b/drivers/usb/gadget/rndis.h
@@ -1,15 +1,15 @@
-/* 
+/*
  * RNDIS	Definitions for Remote NDIS
- * 
+ *
  * Version:	$Id: rndis.h,v 1.15 2004/03/25 21:33:46 robert Exp $
- * 
+ *
  * Authors:	Benedikt Spranger, Pengutronix
- * 		Robert Schwebel, Pengutronix
- * 
- * 		This program is free software; you can redistribute it and/or
+ *		Robert Schwebel, Pengutronix
+ *
+ *		This program is free software; you can redistribute it and/or
  *		modify it under the terms of the GNU General Public License
- *		version 2, as published by the Free Software Foundation. 
- * 
+ *		version 2, as published by the Free Software Foundation.
+ *
  *		This software was originally developed in conformance with
  *		Microsoft's Remote NDIS Specification License Agreement.
  */
@@ -34,7 +34,7 @@
 #define RNDIS_STATUS_MEDIA_CONNECT	0x4001000BU	/* Device connected  */
 #define RNDIS_STATUS_MEDIA_DISCONNECT	0x4001000CU	/* Device disconnected */
 /* For all not specified status messages:
- * RNDIS_STATUS_Xxx -> NDIS_STATUS_Xxx 
+ * RNDIS_STATUS_Xxx -> NDIS_STATUS_Xxx
  */
 
 /* Message Set for Connectionless (802.3) Devices */
@@ -69,7 +69,7 @@
 #define OID_PNP_ENABLE_WAKE_UP			0xFD010106
 
 
-typedef struct rndis_init_msg_type 
+typedef struct rndis_init_msg_type
 {
 	__le32	MessageType;
 	__le32	MessageLength;
@@ -234,12 +234,12 @@ typedef struct rndis_params
 
 	const u8		*host_mac;
 	u16			*filter;
-	struct net_device 	*dev;
+	struct net_device	*dev;
 	struct net_device_stats *stats;
 
 	u32			vendorID;
 	const char		*vendorDescr;
-	int 			(*ack) (struct net_device *);
+	int			(*ack) (struct net_device *);
 	struct list_head	resp_queue;
 } rndis_params;
 
@@ -250,7 +250,7 @@ void rndis_deregister (int configNr);
 int  rndis_set_param_dev (u8 configNr, struct net_device *dev,
 			 struct net_device_stats *stats,
 			 u16 *cdc_filter);
-int  rndis_set_param_vendor (u8 configNr, u32 vendorID, 
+int  rndis_set_param_vendor (u8 configNr, u32 vendorID,
 			    const char *vendorDescr);
 int  rndis_set_param_medium (u8 configNr, u32 medium, u32 speed);
 void rndis_add_hdr (struct sk_buff *skb);
diff --git a/drivers/usb/gadget/serial.c b/drivers/usb/gadget/serial.c
index b992546c394..9d6e1d29552 100644
--- a/drivers/usb/gadget/serial.c
+++ b/drivers/usb/gadget/serial.c
@@ -45,88 +45,16 @@
 #include <asm/uaccess.h>
 
 #include <linux/usb_ch9.h>
-#include <linux/usb_cdc.h>
+#include <linux/usb/cdc.h>
 #include <linux/usb_gadget.h>
 
 #include "gadget_chips.h"
 
 
-/* Wait Cond */
-
-#define __wait_cond_interruptible(wq, condition, lock, flags, ret)	\
-do {									\
-	wait_queue_t __wait;						\
-	init_waitqueue_entry(&__wait, current);				\
-									\
-	add_wait_queue(&wq, &__wait);					\
-	for (;;) {							\
-		set_current_state(TASK_INTERRUPTIBLE);			\
-		if (condition)						\
-			break;						\
-		if (!signal_pending(current)) {				\
-			spin_unlock_irqrestore(lock, flags);		\
-			schedule();					\
-			spin_lock_irqsave(lock, flags);			\
-			continue;					\
-		}							\
-		ret = -ERESTARTSYS;					\
-		break;							\
-	}								\
-	current->state = TASK_RUNNING;					\
-	remove_wait_queue(&wq, &__wait);				\
-} while (0)
-	
-#define wait_cond_interruptible(wq, condition, lock, flags)		\
-({									\
-	int __ret = 0;							\
-	if (!(condition))						\
-		__wait_cond_interruptible(wq, condition, lock, flags,	\
-						__ret);			\
-	__ret;								\
-})
-
-#define __wait_cond_interruptible_timeout(wq, condition, lock, flags, 	\
-						timeout, ret)		\
-do {									\
-	signed long __timeout = timeout;				\
-	wait_queue_t __wait;						\
-	init_waitqueue_entry(&__wait, current);				\
-									\
-	add_wait_queue(&wq, &__wait);					\
-	for (;;) {							\
-		set_current_state(TASK_INTERRUPTIBLE);			\
-		if (__timeout == 0)					\
-			break;						\
-		if (condition)						\
-			break;						\
-		if (!signal_pending(current)) {				\
-			spin_unlock_irqrestore(lock, flags);		\
-			__timeout = schedule_timeout(__timeout);	\
-			spin_lock_irqsave(lock, flags);			\
-			continue;					\
-		}							\
-		ret = -ERESTARTSYS;					\
-		break;							\
-	}								\
-	current->state = TASK_RUNNING;					\
-	remove_wait_queue(&wq, &__wait);				\
-} while (0)
-	
-#define wait_cond_interruptible_timeout(wq, condition, lock, flags,	\
-						timeout)		\
-({									\
-	int __ret = 0;							\
-	if (!(condition))						\
-		__wait_cond_interruptible_timeout(wq, condition, lock,	\
-						flags, timeout, __ret);	\
-	__ret;								\
-})
-
-
 /* Defines */
 
-#define GS_VERSION_STR			"v2.0"
-#define GS_VERSION_NUM			0x0200
+#define GS_VERSION_STR			"v2.2"
+#define GS_VERSION_NUM			0x0202
 
 #define GS_LONG_NAME			"Gadget Serial"
 #define GS_SHORT_NAME			"g_serial"
@@ -843,9 +771,19 @@ exit_unlock_dev:
 /*
  * gs_close
  */
+
+#define GS_WRITE_FINISHED_EVENT_SAFELY(p)			\
+({								\
+	int cond;						\
+								\
+	spin_lock_irq(&(p)->port_lock);				\
+	cond = !(p)->port_dev || !gs_buf_data_avail((p)->port_write_buf); \
+	spin_unlock_irq(&(p)->port_lock);			\
+	cond;							\
+})
+
 static void gs_close(struct tty_struct *tty, struct file *file)
 {
-	unsigned long flags;
 	struct gs_port *port = tty->driver_data;
 	struct semaphore *sem;
 
@@ -859,7 +797,7 @@ static void gs_close(struct tty_struct *tty, struct file *file)
 	sem = &gs_open_close_sem[port->port_num];
 	down(sem);
 
-	spin_lock_irqsave(&port->port_lock, flags);
+	spin_lock_irq(&port->port_lock);
 
 	if (port->port_open_count == 0) {
 		printk(KERN_ERR
@@ -887,12 +825,11 @@ static void gs_close(struct tty_struct *tty, struct file *file)
 	/* wait for write buffer to drain, or */
 	/* at most GS_CLOSE_TIMEOUT seconds */
 	if (gs_buf_data_avail(port->port_write_buf) > 0) {
-		spin_unlock_irqrestore(&port->port_lock, flags);
-		wait_cond_interruptible_timeout(port->port_write_wait,
-		port->port_dev == NULL
-		|| gs_buf_data_avail(port->port_write_buf) == 0,
-		&port->port_lock, flags, GS_CLOSE_TIMEOUT * HZ);
-		spin_lock_irqsave(&port->port_lock, flags);
+		spin_unlock_irq(&port->port_lock);
+		wait_event_interruptible_timeout(port->port_write_wait,
+					GS_WRITE_FINISHED_EVENT_SAFELY(port),
+					GS_CLOSE_TIMEOUT * HZ);
+		spin_lock_irq(&port->port_lock);
 	}
 
 	/* free disconnected port on final close */
@@ -912,7 +849,7 @@ static void gs_close(struct tty_struct *tty, struct file *file)
 		port->port_num, tty, file);
 
 exit:
-	spin_unlock_irqrestore(&port->port_lock, flags);
+	spin_unlock_irq(&port->port_lock);
 	up(sem);
 }
 
diff --git a/drivers/usb/host/Kconfig b/drivers/usb/host/Kconfig
index e27b79a3c05..b93d71d28db 100644
--- a/drivers/usb/host/Kconfig
+++ b/drivers/usb/host/Kconfig
@@ -47,12 +47,29 @@ config USB_EHCI_ROOT_HUB_TT
 	  controller is needed.  It's safe to say "y" even if your
 	  controller doesn't support this feature.
 
-	  This supports the EHCI implementation from TransDimension Inc.
+	  This supports the EHCI implementation that's originally
+	  from ARC, and has since changed hands a few times.
+
+config USB_EHCI_TT_NEWSCHED
+	bool "Improved Transaction Translator scheduling (EXPERIMENTAL)"
+	depends on USB_EHCI_HCD && EXPERIMENTAL
+	---help---
+	  This changes the periodic scheduling code to fill more of the low
+	  and full speed bandwidth available from the Transaction Translator
+	  (TT) in USB 2.0 hubs.  Without this, only one transfer will be
+	  issued in each microframe, significantly reducing the number of
+	  periodic low/fullspeed transfers possible.
+
+	  If you have multiple periodic low/fullspeed devices connected to a
+	  highspeed USB hub which is connected to a highspeed USB Host
+	  Controller, and some of those devices will not work correctly
+	  (possibly due to "ENOSPC" or "-28" errors), say Y.
+
+	  If unsure, say N.
 
 config USB_ISP116X_HCD
 	tristate "ISP116X HCD support"
 	depends on USB
-	default N
 	---help---
 	  The ISP1160 and ISP1161 chips are USB host controllers. Enable this
 	  option if your board has this chip. If unsure, say N.
@@ -127,7 +144,6 @@ config USB_UHCI_HCD
 config USB_SL811_HCD
 	tristate "SL811HS HCD support"
 	depends on USB
-	default N
 	help
 	  The SL811HS is a single-port USB controller that supports either
 	  host side or peripheral side roles.  Enable this option if your
@@ -140,7 +156,6 @@ config USB_SL811_HCD
 config USB_SL811_CS
 	tristate "CF/PCMCIA support for SL811HS HCD"
 	depends on USB_SL811_HCD && PCMCIA
-	default N
 	help
 	  Wraps a PCMCIA driver around the SL811HS HCD, supporting the RATOC
 	  REX-CFU1U CF card (often used with PDAs).  If unsure, say N.
diff --git a/drivers/usb/host/ehci-au1xxx.c b/drivers/usb/host/ehci-au1xxx.c
index 63eadeec132..9b4697add31 100644
--- a/drivers/usb/host/ehci-au1xxx.c
+++ b/drivers/usb/host/ehci-au1xxx.c
@@ -16,10 +16,6 @@
 #include <linux/platform_device.h>
 #include <asm/mach-au1x00/au1000.h>
 
-#ifndef CONFIG_SOC_AU1200
-#error "this Alchemy chip doesn't have EHCI"
-#else				/* Au1200 */
-
 #define USB_HOST_CONFIG   (USB_MSR_BASE + USB_MSR_MCFG)
 #define USB_MCFG_PFEN     (1<<31)
 #define USB_MCFG_RDCOMB   (1<<30)
@@ -272,6 +268,8 @@ static int ehci_hcd_au1xxx_drv_resume(struct device *dev)
 	return 0;
 }
 */
+MODULE_ALIAS("au1xxx-ehci");
+/* FIXME use "struct platform_driver" */
 static struct device_driver ehci_hcd_au1xxx_driver = {
 	.name = "au1xxx-ehci",
 	.bus = &platform_bus_type,
@@ -280,18 +278,3 @@ static struct device_driver ehci_hcd_au1xxx_driver = {
 	/*.suspend      = ehci_hcd_au1xxx_drv_suspend, */
 	/*.resume       = ehci_hcd_au1xxx_drv_resume, */
 };
-
-static int __init ehci_hcd_au1xxx_init(void)
-{
-	pr_debug(DRIVER_INFO " (Au1xxx)\n");
-
-	return driver_register(&ehci_hcd_au1xxx_driver);
-}
-
-static void __exit ehci_hcd_au1xxx_cleanup(void)
-{
-	driver_unregister(&ehci_hcd_au1xxx_driver);
-}
-
-module_init(ehci_hcd_au1xxx_init);
-module_exit(ehci_hcd_au1xxx_cleanup);
diff --git a/drivers/usb/host/ehci-fsl.c b/drivers/usb/host/ehci-fsl.c
index f985f121a24..a49a689bf42 100644
--- a/drivers/usb/host/ehci-fsl.c
+++ b/drivers/usb/host/ehci-fsl.c
@@ -324,43 +324,12 @@ static int ehci_fsl_drv_remove(struct platform_device *pdev)
 	return 0;
 }
 
-static struct platform_driver ehci_fsl_dr_driver = {
-	.probe = ehci_fsl_drv_probe,
-	.remove = ehci_fsl_drv_remove,
-	.driver = {
-		   .name = "fsl-usb2-dr",
-		   },
-};
+MODULE_ALIAS("fsl-ehci");
 
-static struct platform_driver ehci_fsl_mph_driver = {
+static struct platform_driver ehci_fsl_driver = {
 	.probe = ehci_fsl_drv_probe,
 	.remove = ehci_fsl_drv_remove,
 	.driver = {
-		   .name = "fsl-usb2-mph",
+		   .name = "fsl-ehci",
 		   },
 };
-
-static int __init ehci_fsl_init(void)
-{
-	int retval;
-
-	pr_debug("%s: block sizes: qh %Zd qtd %Zd itd %Zd sitd %Zd\n",
-		 hcd_name,
-		 sizeof(struct ehci_qh), sizeof(struct ehci_qtd),
-		 sizeof(struct ehci_itd), sizeof(struct ehci_sitd));
-
-	retval = platform_driver_register(&ehci_fsl_dr_driver);
-	if (retval)
-		return retval;
-
-	return platform_driver_register(&ehci_fsl_mph_driver);
-}
-
-static void __exit ehci_fsl_cleanup(void)
-{
-	platform_driver_unregister(&ehci_fsl_mph_driver);
-	platform_driver_unregister(&ehci_fsl_dr_driver);
-}
-
-module_init(ehci_fsl_init);
-module_exit(ehci_fsl_cleanup);
diff --git a/drivers/usb/host/ehci-hcd.c b/drivers/usb/host/ehci-hcd.c
index 79f2d8b9bfb..9b37e508ada 100644
--- a/drivers/usb/host/ehci-hcd.c
+++ b/drivers/usb/host/ehci-hcd.c
@@ -889,19 +889,59 @@ MODULE_LICENSE ("GPL");
 
 #ifdef CONFIG_PCI
 #include "ehci-pci.c"
-#define	EHCI_BUS_GLUED
+#define	PCI_DRIVER		ehci_pci_driver
 #endif
 
 #ifdef CONFIG_PPC_83xx
 #include "ehci-fsl.c"
-#define	EHCI_BUS_GLUED
+#define	PLATFORM_DRIVER		ehci_fsl_driver
 #endif
 
-#ifdef CONFIG_SOC_AU1X00
+#ifdef CONFIG_SOC_AU1200
 #include "ehci-au1xxx.c"
-#define	EHCI_BUS_GLUED
+#define	PLATFORM_DRIVER		ehci_hcd_au1xxx_driver
 #endif
 
-#ifndef	EHCI_BUS_GLUED
+#if !defined(PCI_DRIVER) && !defined(PLATFORM_DRIVER)
 #error "missing bus glue for ehci-hcd"
 #endif
+
+static int __init ehci_hcd_init(void)
+{
+	int retval = 0;
+
+	pr_debug("%s: block sizes: qh %Zd qtd %Zd itd %Zd sitd %Zd\n",
+		 hcd_name,
+		 sizeof(struct ehci_qh), sizeof(struct ehci_qtd),
+		 sizeof(struct ehci_itd), sizeof(struct ehci_sitd));
+
+#ifdef PLATFORM_DRIVER
+	retval = platform_driver_register(&PLATFORM_DRIVER);
+	if (retval < 0)
+		return retval;
+#endif
+
+#ifdef PCI_DRIVER
+	retval = pci_register_driver(&PCI_DRIVER);
+	if (retval < 0) {
+#ifdef PLATFORM_DRIVER
+		platform_driver_unregister(&PLATFORM_DRIVER);
+#endif
+	}
+#endif
+
+	return retval;
+}
+module_init(ehci_hcd_init);
+
+static void __exit ehci_hcd_cleanup(void)
+{
+#ifdef PLATFORM_DRIVER
+	platform_driver_unregister(&PLATFORM_DRIVER);
+#endif
+#ifdef PCI_DRIVER
+	pci_unregister_driver(&PCI_DRIVER);
+#endif
+}
+module_exit(ehci_hcd_cleanup);
+
diff --git a/drivers/usb/host/ehci-pci.c b/drivers/usb/host/ehci-pci.c
index a1bd2bea6de..cadffacd945 100644
--- a/drivers/usb/host/ehci-pci.c
+++ b/drivers/usb/host/ehci-pci.c
@@ -76,6 +76,30 @@ static int ehci_pci_setup(struct usb_hcd *hcd)
 	dbg_hcs_params(ehci, "reset");
 	dbg_hcc_params(ehci, "reset");
 
+        /* ehci_init() causes memory for DMA transfers to be
+         * allocated.  Thus, any vendor-specific workarounds based on
+         * limiting the type of memory used for DMA transfers must
+         * happen before ehci_init() is called. */
+	switch (pdev->vendor) {
+	case PCI_VENDOR_ID_NVIDIA:
+		/* NVidia reports that certain chips don't handle
+		 * QH, ITD, or SITD addresses above 2GB.  (But TD,
+		 * data buffer, and periodic schedule are normal.)
+		 */
+		switch (pdev->device) {
+		case 0x003c:	/* MCP04 */
+		case 0x005b:	/* CK804 */
+		case 0x00d8:	/* CK8 */
+		case 0x00e8:	/* CK8S */
+			if (pci_set_consistent_dma_mask(pdev,
+						DMA_31BIT_MASK) < 0)
+				ehci_warn(ehci, "can't enable NVidia "
+					"workaround for >2GB RAM\n");
+			break;
+		}
+		break;
+	}
+
 	/* cache this readonly data; minimize chip reads */
 	ehci->hcs_params = readl(&ehci->caps->hcs_params);
 
@@ -88,8 +112,6 @@ static int ehci_pci_setup(struct usb_hcd *hcd)
 	if (retval)
 		return retval;
 
-	/* NOTE:  only the parts below this line are PCI-specific */
-
 	switch (pdev->vendor) {
 	case PCI_VENDOR_ID_TDI:
 		if (pdev->device == PCI_DEVICE_ID_TDI_EHCI) {
@@ -107,19 +129,6 @@ static int ehci_pci_setup(struct usb_hcd *hcd)
 		break;
 	case PCI_VENDOR_ID_NVIDIA:
 		switch (pdev->device) {
-		/* NVidia reports that certain chips don't handle
-		 * QH, ITD, or SITD addresses above 2GB.  (But TD,
-		 * data buffer, and periodic schedule are normal.)
-		 */
-		case 0x003c:	/* MCP04 */
-		case 0x005b:	/* CK804 */
-		case 0x00d8:	/* CK8 */
-		case 0x00e8:	/* CK8S */
-			if (pci_set_consistent_dma_mask(pdev,
-						DMA_31BIT_MASK) < 0)
-				ehci_warn(ehci, "can't enable NVidia "
-					"workaround for >2GB RAM\n");
-			break;
 		/* Some NForce2 chips have problems with selective suspend;
 		 * fixed in newer silicon.
 		 */
@@ -370,23 +379,3 @@ static struct pci_driver ehci_pci_driver = {
 	.resume =	usb_hcd_pci_resume,
 #endif
 };
-
-static int __init ehci_hcd_pci_init(void)
-{
-	if (usb_disabled())
-		return -ENODEV;
-
-	pr_debug("%s: block sizes: qh %Zd qtd %Zd itd %Zd sitd %Zd\n",
-		hcd_name,
-		sizeof(struct ehci_qh), sizeof(struct ehci_qtd),
-		sizeof(struct ehci_itd), sizeof(struct ehci_sitd));
-
-	return pci_register_driver(&ehci_pci_driver);
-}
-module_init(ehci_hcd_pci_init);
-
-static void __exit ehci_hcd_pci_cleanup(void)
-{
-	pci_unregister_driver(&ehci_pci_driver);
-}
-module_exit(ehci_hcd_pci_cleanup);
diff --git a/drivers/usb/host/ehci-sched.c b/drivers/usb/host/ehci-sched.c
index 5871944e614..4859900bd13 100644
--- a/drivers/usb/host/ehci-sched.c
+++ b/drivers/usb/host/ehci-sched.c
@@ -163,6 +163,190 @@ static int same_tt (struct usb_device *dev1, struct usb_device *dev2)
 		return 1;
 }
 
+#ifdef CONFIG_USB_EHCI_TT_NEWSCHED
+
+/* Which uframe does the low/fullspeed transfer start in?
+ *
+ * The parameter is the mask of ssplits in "H-frame" terms
+ * and this returns the transfer start uframe in "B-frame" terms,
+ * which allows both to match, e.g. a ssplit in "H-frame" uframe 0
+ * will cause a transfer in "B-frame" uframe 0.  "B-frames" lag
+ * "H-frames" by 1 uframe.  See the EHCI spec sec 4.5 and figure 4.7.
+ */
+static inline unsigned char tt_start_uframe(struct ehci_hcd *ehci, __le32 mask)
+{
+	unsigned char smask = QH_SMASK & le32_to_cpu(mask);
+	if (!smask) {
+		ehci_err(ehci, "invalid empty smask!\n");
+		/* uframe 7 can't have bw so this will indicate failure */
+		return 7;
+	}
+	return ffs(smask) - 1;
+}
+
+static const unsigned char
+max_tt_usecs[] = { 125, 125, 125, 125, 125, 125, 30, 0 };
+
+/* carryover low/fullspeed bandwidth that crosses uframe boundries */
+static inline void carryover_tt_bandwidth(unsigned short tt_usecs[8])
+{
+	int i;
+	for (i=0; i<7; i++) {
+		if (max_tt_usecs[i] < tt_usecs[i]) {
+			tt_usecs[i+1] += tt_usecs[i] - max_tt_usecs[i];
+			tt_usecs[i] = max_tt_usecs[i];
+		}
+	}
+}
+
+/* How many of the tt's periodic downstream 1000 usecs are allocated?
+ *
+ * While this measures the bandwidth in terms of usecs/uframe,
+ * the low/fullspeed bus has no notion of uframes, so any particular
+ * low/fullspeed transfer can "carry over" from one uframe to the next,
+ * since the TT just performs downstream transfers in sequence.
+ *
+ * For example two seperate 100 usec transfers can start in the same uframe,
+ * and the second one would "carry over" 75 usecs into the next uframe.
+ */
+static void
+periodic_tt_usecs (
+	struct ehci_hcd *ehci,
+	struct usb_device *dev,
+	unsigned frame,
+	unsigned short tt_usecs[8]
+)
+{
+	__le32			*hw_p = &ehci->periodic [frame];
+	union ehci_shadow	*q = &ehci->pshadow [frame];
+	unsigned char		uf;
+
+	memset(tt_usecs, 0, 16);
+
+	while (q->ptr) {
+		switch (Q_NEXT_TYPE(*hw_p)) {
+		case Q_TYPE_ITD:
+			hw_p = &q->itd->hw_next;
+			q = &q->itd->itd_next;
+			continue;
+		case Q_TYPE_QH:
+			if (same_tt(dev, q->qh->dev)) {
+				uf = tt_start_uframe(ehci, q->qh->hw_info2);
+				tt_usecs[uf] += q->qh->tt_usecs;
+			}
+			hw_p = &q->qh->hw_next;
+			q = &q->qh->qh_next;
+			continue;
+		case Q_TYPE_SITD:
+			if (same_tt(dev, q->sitd->urb->dev)) {
+				uf = tt_start_uframe(ehci, q->sitd->hw_uframe);
+				tt_usecs[uf] += q->sitd->stream->tt_usecs;
+			}
+			hw_p = &q->sitd->hw_next;
+			q = &q->sitd->sitd_next;
+			continue;
+		// case Q_TYPE_FSTN:
+		default:
+			ehci_dbg(ehci,
+				  "ignoring periodic frame %d FSTN\n", frame);
+			hw_p = &q->fstn->hw_next;
+			q = &q->fstn->fstn_next;
+		}
+	}
+
+	carryover_tt_bandwidth(tt_usecs);
+
+	if (max_tt_usecs[7] < tt_usecs[7])
+		ehci_err(ehci, "frame %d tt sched overrun: %d usecs\n",
+			frame, tt_usecs[7] - max_tt_usecs[7]);
+}
+
+/*
+ * Return true if the device's tt's downstream bus is available for a
+ * periodic transfer of the specified length (usecs), starting at the
+ * specified frame/uframe.  Note that (as summarized in section 11.19
+ * of the usb 2.0 spec) TTs can buffer multiple transactions for each
+ * uframe.
+ *
+ * The uframe parameter is when the fullspeed/lowspeed transfer
+ * should be executed in "B-frame" terms, which is the same as the
+ * highspeed ssplit's uframe (which is in "H-frame" terms).  For example
+ * a ssplit in "H-frame" 0 causes a transfer in "B-frame" 0.
+ * See the EHCI spec sec 4.5 and fig 4.7.
+ *
+ * This checks if the full/lowspeed bus, at the specified starting uframe,
+ * has the specified bandwidth available, according to rules listed
+ * in USB 2.0 spec section 11.18.1 fig 11-60.
+ *
+ * This does not check if the transfer would exceed the max ssplit
+ * limit of 16, specified in USB 2.0 spec section 11.18.4 requirement #4,
+ * since proper scheduling limits ssplits to less than 16 per uframe.
+ */
+static int tt_available (
+	struct ehci_hcd		*ehci,
+	unsigned		period,
+	struct usb_device	*dev,
+	unsigned		frame,
+	unsigned		uframe,
+	u16			usecs
+)
+{
+	if ((period == 0) || (uframe >= 7))	/* error */
+		return 0;
+
+	for (; frame < ehci->periodic_size; frame += period) {
+		unsigned short tt_usecs[8];
+
+		periodic_tt_usecs (ehci, dev, frame, tt_usecs);
+
+		ehci_vdbg(ehci, "tt frame %d check %d usecs start uframe %d in"
+			" schedule %d/%d/%d/%d/%d/%d/%d/%d\n",
+			frame, usecs, uframe,
+			tt_usecs[0], tt_usecs[1], tt_usecs[2], tt_usecs[3],
+			tt_usecs[4], tt_usecs[5], tt_usecs[6], tt_usecs[7]);
+
+		if (max_tt_usecs[uframe] <= tt_usecs[uframe]) {
+			ehci_vdbg(ehci, "frame %d uframe %d fully scheduled\n",
+				frame, uframe);
+			return 0;
+		}
+
+		/* special case for isoc transfers larger than 125us:
+		 * the first and each subsequent fully used uframe
+		 * must be empty, so as to not illegally delay
+		 * already scheduled transactions
+		 */
+		if (125 < usecs) {
+			int ufs = (usecs / 125) - 1;
+			int i;
+			for (i = uframe; i < (uframe + ufs) && i < 8; i++)
+				if (0 < tt_usecs[i]) {
+					ehci_vdbg(ehci,
+						"multi-uframe xfer can't fit "
+						"in frame %d uframe %d\n",
+						frame, i);
+					return 0;
+				}
+		}
+
+		tt_usecs[uframe] += usecs;
+
+		carryover_tt_bandwidth(tt_usecs);
+
+		/* fail if the carryover pushed bw past the last uframe's limit */
+		if (max_tt_usecs[7] < tt_usecs[7]) {
+			ehci_vdbg(ehci,
+				"tt unavailable usecs %d frame %d uframe %d\n",
+				usecs, frame, uframe);
+			return 0;
+		}
+	}
+
+	return 1;
+}
+
+#else
+
 /* return true iff the device's transaction translator is available
  * for a periodic transfer starting at the specified frame, using
  * all the uframes in the mask.
@@ -237,6 +421,8 @@ static int tt_no_collision (
 	return 1;
 }
 
+#endif /* CONFIG_USB_EHCI_TT_NEWSCHED */
+
 /*-------------------------------------------------------------------------*/
 
 static int enable_periodic (struct ehci_hcd *ehci)
@@ -481,7 +667,7 @@ static int check_intr_schedule (
 )
 {
     	int		retval = -ENOSPC;
-	u8		mask;
+	u8		mask = 0;
 
 	if (qh->c_usecs && uframe >= 6)		/* FSTN territory? */
 		goto done;
@@ -494,6 +680,24 @@ static int check_intr_schedule (
 		goto done;
 	}
 
+#ifdef CONFIG_USB_EHCI_TT_NEWSCHED
+	if (tt_available (ehci, qh->period, qh->dev, frame, uframe,
+				qh->tt_usecs)) {
+		unsigned i;
+
+		/* TODO : this may need FSTN for SSPLIT in uframe 5. */
+		for (i=uframe+1; i<8 && i<uframe+4; i++)
+			if (!check_period (ehci, frame, i,
+						qh->period, qh->c_usecs))
+				goto done;
+			else
+				mask |= 1 << i;
+
+		retval = 0;
+
+		*c_maskp = cpu_to_le32 (mask << 8);
+	}
+#else
 	/* Make sure this tt's buffer is also available for CSPLITs.
 	 * We pessimize a bit; probably the typical full speed case
 	 * doesn't need the second CSPLIT.
@@ -514,6 +718,7 @@ static int check_intr_schedule (
 			goto done;
 		retval = 0;
 	}
+#endif
 done:
 	return retval;
 }
@@ -1047,12 +1252,21 @@ sitd_slot_ok (
 		frame = uframe >> 3;
 		uf = uframe & 7;
 
+#ifdef CONFIG_USB_EHCI_TT_NEWSCHED
+		/* The tt's fullspeed bus bandwidth must be available.
+		 * tt_available scheduling guarantees 10+% for control/bulk.
+		 */
+		if (!tt_available (ehci, period_uframes << 3,
+				stream->udev, frame, uf, stream->tt_usecs))
+			return 0;
+#else
 		/* tt must be idle for start(s), any gap, and csplit.
 		 * assume scheduling slop leaves 10+% for control/bulk.
 		 */
 		if (!tt_no_collision (ehci, period_uframes << 3,
 				stream->udev, frame, mask))
 			return 0;
+#endif
 
 		/* check starts (OUT uses more than one) */
 		max_used = 100 - stream->usecs;
diff --git a/drivers/usb/host/isp116x-hcd.c b/drivers/usb/host/isp116x-hcd.c
index e99210b7909..14386254c87 100644
--- a/drivers/usb/host/isp116x-hcd.c
+++ b/drivers/usb/host/isp116x-hcd.c
@@ -63,7 +63,7 @@
 #include <linux/init.h>
 #include <linux/list.h>
 #include <linux/usb.h>
-#include <linux/usb_isp116x.h>
+#include <linux/usb/isp116x.h>
 #include <linux/platform_device.h>
 
 #include <asm/io.h>
@@ -781,7 +781,7 @@ static int isp116x_urb_enqueue(struct usb_hcd *hcd,
 		if (ep->branch < PERIODIC_SIZE)
 			break;
 
-		ret = ep->branch = balance(isp116x, ep->period, ep->load);
+		ep->branch = ret = balance(isp116x, ep->period, ep->load);
 		if (ret < 0)
 			goto fail;
 		ret = 0;
diff --git a/drivers/usb/host/sl811-hcd.c b/drivers/usb/host/sl811-hcd.c
index a9234305275..6b4bc3f2bd8 100644
--- a/drivers/usb/host/sl811-hcd.c
+++ b/drivers/usb/host/sl811-hcd.c
@@ -46,7 +46,7 @@
 #include <linux/list.h>
 #include <linux/interrupt.h>
 #include <linux/usb.h>
-#include <linux/usb_sl811.h>
+#include <linux/usb/sl811.h>
 #include <linux/platform_device.h>
 
 #include <asm/io.h>
diff --git a/drivers/usb/host/sl811_cs.c b/drivers/usb/host/sl811_cs.c
index 302aa1ec312..54f554e0f0a 100644
--- a/drivers/usb/host/sl811_cs.c
+++ b/drivers/usb/host/sl811_cs.c
@@ -27,7 +27,7 @@
 #include <pcmcia/cisreg.h>
 #include <pcmcia/ds.h>
 
-#include <linux/usb_sl811.h>
+#include <linux/usb/sl811.h>
 
 MODULE_AUTHOR("Botond Botyanszki");
 MODULE_DESCRIPTION("REX-CFU1U PCMCIA driver for 2.6");
diff --git a/drivers/usb/host/uhci-debug.c b/drivers/usb/host/uhci-debug.c
index e1239319655..6637a0e4997 100644
--- a/drivers/usb/host/uhci-debug.c
+++ b/drivers/usb/host/uhci-debug.c
@@ -98,6 +98,7 @@ static int uhci_show_urbp(struct urb_priv *urbp, char *buf, int len, int space)
 	char *out = buf;
 	struct uhci_td *td;
 	int i, nactive, ninactive;
+	char *ptype;
 
 	if (len < 200)
 		return 0;
@@ -110,13 +111,15 @@ static int uhci_show_urbp(struct urb_priv *urbp, char *buf, int len, int space)
 			(usb_pipein(urbp->urb->pipe) ? "IN" : "OUT"));
 
 	switch (usb_pipetype(urbp->urb->pipe)) {
-	case PIPE_ISOCHRONOUS: out += sprintf(out, "ISO"); break;
-	case PIPE_INTERRUPT: out += sprintf(out, "INT"); break;
-	case PIPE_BULK: out += sprintf(out, "BLK"); break;
-	case PIPE_CONTROL: out += sprintf(out, "CTL"); break;
+	case PIPE_ISOCHRONOUS: ptype = "ISO"; break;
+	case PIPE_INTERRUPT: ptype = "INT"; break;
+	case PIPE_BULK: ptype = "BLK"; break;
+	default:
+	case PIPE_CONTROL: ptype = "CTL"; break;
 	}
 
-	out += sprintf(out, "%s", (urbp->fsbr ? " FSBR" : ""));
+	out += sprintf(out, "%s%s", ptype, (urbp->fsbr ? " FSBR" : ""));
+	out += sprintf(out, " Actlen=%d", urbp->urb->actual_length);
 
 	if (urbp->urb->status != -EINPROGRESS)
 		out += sprintf(out, " Status=%d", urbp->urb->status);
@@ -124,7 +127,8 @@ static int uhci_show_urbp(struct urb_priv *urbp, char *buf, int len, int space)
 
 	i = nactive = ninactive = 0;
 	list_for_each_entry(td, &urbp->td_list, list) {
-		if (++i <= 10 || debug > 2) {
+		if (urbp->qh->type != USB_ENDPOINT_XFER_ISOC &&
+				(++i <= 10 || debug > 2)) {
 			out += sprintf(out, "%*s%d: ", space + 2, "", i);
 			out += uhci_show_td(td, out, len - (out - buf), 0);
 		} else {
@@ -147,13 +151,27 @@ static int uhci_show_qh(struct uhci_qh *qh, char *buf, int len, int space)
 	char *out = buf;
 	int i, nurbs;
 	__le32 element = qh_element(qh);
+	char *qtype;
 
 	/* Try to make sure there's enough memory */
-	if (len < 80 * 6)
+	if (len < 80 * 7)
 		return 0;
 
-	out += sprintf(out, "%*s[%p] link (%08x) element (%08x)\n", space, "",
-			qh, le32_to_cpu(qh->link), le32_to_cpu(element));
+	switch (qh->type) {
+	case USB_ENDPOINT_XFER_ISOC: qtype = "ISO"; break;
+	case USB_ENDPOINT_XFER_INT: qtype = "INT"; break;
+	case USB_ENDPOINT_XFER_BULK: qtype = "BLK"; break;
+	case USB_ENDPOINT_XFER_CONTROL: qtype = "CTL"; break;
+	default: qtype = "Skel" ; break;
+	}
+
+	out += sprintf(out, "%*s[%p] %s QH link (%08x) element (%08x)\n",
+			space, "", qh, qtype,
+			le32_to_cpu(qh->link), le32_to_cpu(element));
+	if (qh->type == USB_ENDPOINT_XFER_ISOC)
+		out += sprintf(out, "%*s    period %d frame %x desc [%p]\n",
+				space, "", qh->period, qh->iso_frame,
+				qh->iso_packet_desc);
 
 	if (element & UHCI_PTR_QH)
 		out += sprintf(out, "%*s  Element points to QH (bug?)\n", space, "");
@@ -261,7 +279,8 @@ static int uhci_show_root_hub_state(struct uhci_hcd *uhci, char *buf, int len)
 	    default:
 		rh_state = "?";			break;
 	}
-	out += sprintf(out, "Root-hub state: %s\n", rh_state);
+	out += sprintf(out, "Root-hub state: %s   FSBR: %d\n",
+			rh_state, uhci->fsbr_is_on);
 	return out - buf;
 }
 
@@ -275,7 +294,7 @@ static int uhci_show_status(struct uhci_hcd *uhci, char *buf, int len)
 	unsigned short portsc1, portsc2;
 
 	/* Try to make sure there's enough memory */
-	if (len < 80 * 6)
+	if (len < 80 * 9)
 		return 0;
 
 	usbcmd    = inw(io_addr + 0);
@@ -314,6 +333,10 @@ static int uhci_show_status(struct uhci_hcd *uhci, char *buf, int len)
 	out += sprintf(out, "  sof       =       %02x\n", sof);
 	out += uhci_show_sc(1, portsc1, out, len - (out - buf));
 	out += uhci_show_sc(2, portsc2, out, len - (out - buf));
+	out += sprintf(out, "Most recent frame: %x (%d)   "
+			"Last ISO frame: %x (%d)\n",
+			uhci->frame_number, uhci->frame_number & 1023,
+			uhci->last_iso_frame, uhci->last_iso_frame & 1023);
 
 	return out - buf;
 }
diff --git a/drivers/usb/host/uhci-hcd.c b/drivers/usb/host/uhci-hcd.c
index d225e11f405..7b48567622e 100644
--- a/drivers/usb/host/uhci-hcd.c
+++ b/drivers/usb/host/uhci-hcd.c
@@ -13,7 +13,7 @@
  * (C) Copyright 2000 Yggdrasil Computing, Inc. (port of new PCI interface
  *               support from usb-ohci.c by Adam Richter, adam@yggdrasil.com).
  * (C) Copyright 1999 Gregory P. Smith (from usb-ohci.c)
- * (C) Copyright 2004-2005 Alan Stern, stern@rowland.harvard.edu
+ * (C) Copyright 2004-2006 Alan Stern, stern@rowland.harvard.edu
  *
  * Intel documents this fairly well, and as far as I know there
  * are no royalties or anything like that, but even so there are
@@ -31,7 +31,6 @@
 #include <linux/ioport.h>
 #include <linux/sched.h>
 #include <linux/slab.h>
-#include <linux/smp_lock.h>
 #include <linux/errno.h>
 #include <linux/unistd.h>
 #include <linux/interrupt.h>
@@ -88,15 +87,6 @@ static void suspend_rh(struct uhci_hcd *uhci, enum uhci_rh_state new_state);
 static void wakeup_rh(struct uhci_hcd *uhci);
 static void uhci_get_current_frame_number(struct uhci_hcd *uhci);
 
-/* If a transfer is still active after this much time, turn off FSBR */
-#define IDLE_TIMEOUT	msecs_to_jiffies(50)
-#define FSBR_DELAY	msecs_to_jiffies(50)
-
-/* When we timeout an idle transfer for FSBR, we'll switch it over to */
-/* depth first traversal. We'll do it in groups of this number of TDs */
-/* to make sure it doesn't hog all of the bandwidth */
-#define DEPTH_INTERVAL 5
-
 #include "uhci-debug.c"
 #include "uhci-q.c"
 #include "uhci-hub.c"
@@ -120,22 +110,29 @@ static void finish_reset(struct uhci_hcd *uhci)
 	uhci->is_stopped = UHCI_IS_STOPPED;
 	uhci_to_hcd(uhci)->state = HC_STATE_HALT;
 	uhci_to_hcd(uhci)->poll_rh = 0;
+
+	uhci->dead = 0;		/* Full reset resurrects the controller */
 }
 
 /*
  * Last rites for a defunct/nonfunctional controller
  * or one we don't want to use any more.
  */
-static void hc_died(struct uhci_hcd *uhci)
+static void uhci_hc_died(struct uhci_hcd *uhci)
 {
+	uhci_get_current_frame_number(uhci);
 	uhci_reset_hc(to_pci_dev(uhci_dev(uhci)), uhci->io_addr);
 	finish_reset(uhci);
-	uhci->hc_inaccessible = 1;
+	uhci->dead = 1;
+
+	/* The current frame may already be partway finished */
+	++uhci->frame_number;
 }
 
 /*
- * Initialize a controller that was newly discovered or has just been
- * resumed.  In either case we can't be sure of its previous state.
+ * Initialize a controller that was newly discovered or has lost power
+ * or otherwise been reset while it was suspended.  In none of these cases
+ * can we be sure of its previous state.
  */
 static void check_and_reset_hc(struct uhci_hcd *uhci)
 {
@@ -155,7 +152,8 @@ static void configure_hc(struct uhci_hcd *uhci)
 	outl(uhci->frame_dma_handle, uhci->io_addr + USBFLBASEADD);
 
 	/* Set the current frame number */
-	outw(uhci->frame_number, uhci->io_addr + USBFRNUM);
+	outw(uhci->frame_number & UHCI_MAX_SOF_NUMBER,
+			uhci->io_addr + USBFRNUM);
 
 	/* Mark controller as not halted before we enable interrupts */
 	uhci_to_hcd(uhci)->state = HC_STATE_SUSPENDED;
@@ -207,7 +205,8 @@ __acquires(uhci->lock)
 	int int_enable;
 
 	auto_stop = (new_state == UHCI_RH_AUTO_STOPPED);
-	dev_dbg(uhci_dev(uhci), "%s%s\n", __FUNCTION__,
+	dev_dbg(&uhci_to_hcd(uhci)->self.root_hub->dev,
+			"%s%s\n", __FUNCTION__,
 			(auto_stop ? " (auto-stop)" : ""));
 
 	/* If we get a suspend request when we're already auto-stopped
@@ -241,27 +240,27 @@ __acquires(uhci->lock)
 		spin_unlock_irq(&uhci->lock);
 		msleep(1);
 		spin_lock_irq(&uhci->lock);
-		if (uhci->hc_inaccessible)	/* Died */
+		if (uhci->dead)
 			return;
 	}
 	if (!(inw(uhci->io_addr + USBSTS) & USBSTS_HCH))
-		dev_warn(uhci_dev(uhci), "Controller not stopped yet!\n");
+		dev_warn(&uhci_to_hcd(uhci)->self.root_hub->dev,
+			"Controller not stopped yet!\n");
 
 	uhci_get_current_frame_number(uhci);
-	smp_wmb();
 
 	uhci->rh_state = new_state;
 	uhci->is_stopped = UHCI_IS_STOPPED;
 	uhci_to_hcd(uhci)->poll_rh = !int_enable;
 
 	uhci_scan_schedule(uhci, NULL);
+	uhci_fsbr_off(uhci);
 }
 
 static void start_rh(struct uhci_hcd *uhci)
 {
 	uhci_to_hcd(uhci)->state = HC_STATE_RUNNING;
 	uhci->is_stopped = 0;
-	smp_wmb();
 
 	/* Mark it configured and running with a 64-byte max packet.
 	 * All interrupts are enabled, even though RESUME won't do anything.
@@ -278,7 +277,8 @@ static void wakeup_rh(struct uhci_hcd *uhci)
 __releases(uhci->lock)
 __acquires(uhci->lock)
 {
-	dev_dbg(uhci_dev(uhci), "%s%s\n", __FUNCTION__,
+	dev_dbg(&uhci_to_hcd(uhci)->self.root_hub->dev,
+			"%s%s\n", __FUNCTION__,
 			uhci->rh_state == UHCI_RH_AUTO_STOPPED ?
 				" (auto-start)" : "");
 
@@ -293,7 +293,7 @@ __acquires(uhci->lock)
 		spin_unlock_irq(&uhci->lock);
 		msleep(20);
 		spin_lock_irq(&uhci->lock);
-		if (uhci->hc_inaccessible)	/* Died */
+		if (uhci->dead)
 			return;
 
 		/* End Global Resume and wait for EOP to be sent */
@@ -345,7 +345,7 @@ static irqreturn_t uhci_irq(struct usb_hcd *hcd, struct pt_regs *regs)
 							errbuf, ERRBUF_LEN);
 					lprintk(errbuf);
 				}
-				hc_died(uhci);
+				uhci_hc_died(uhci);
 
 				/* Force a callback in case there are
 				 * pending unlinks */
@@ -368,12 +368,21 @@ static irqreturn_t uhci_irq(struct usb_hcd *hcd, struct pt_regs *regs)
 
 /*
  * Store the current frame number in uhci->frame_number if the controller
- * is runnning
+ * is runnning.  Expand from 11 bits (of which we use only 10) to a
+ * full-sized integer.
+ *
+ * Like many other parts of the driver, this code relies on being polled
+ * more than once per second as long as the controller is running.
  */
 static void uhci_get_current_frame_number(struct uhci_hcd *uhci)
 {
-	if (!uhci->is_stopped)
-		uhci->frame_number = inw(uhci->io_addr + USBFRNUM);
+	if (!uhci->is_stopped) {
+		unsigned delta;
+
+		delta = (inw(uhci->io_addr + USBFRNUM) - uhci->frame_number) &
+				(UHCI_NUMFRAMES - 1);
+		uhci->frame_number += delta;
+	}
 }
 
 /*
@@ -407,7 +416,7 @@ static void release_uhci(struct uhci_hcd *uhci)
 			uhci->frame, uhci->frame_dma_handle);
 }
 
-static int uhci_reset(struct usb_hcd *hcd)
+static int uhci_init(struct usb_hcd *hcd)
 {
 	struct uhci_hcd *uhci = hcd_to_uhci(hcd);
 	unsigned io_size = (unsigned) hcd->rsrc_len;
@@ -459,7 +468,7 @@ static void uhci_shutdown(struct pci_dev *pdev)
 {
 	struct usb_hcd *hcd = (struct usb_hcd *) pci_get_drvdata(pdev);
 
-	hc_died(hcd_to_uhci(hcd));
+	uhci_hc_died(hcd_to_uhci(hcd));
 }
 
 /*
@@ -487,14 +496,10 @@ static int uhci_start(struct usb_hcd *hcd)
 
 	hcd->uses_new_polling = 1;
 
-	uhci->fsbr = 0;
-	uhci->fsbrtimeout = 0;
-
 	spin_lock_init(&uhci->lock);
-
-	INIT_LIST_HEAD(&uhci->td_remove_list);
+	setup_timer(&uhci->fsbr_timer, uhci_fsbr_timeout,
+			(unsigned long) uhci);
 	INIT_LIST_HEAD(&uhci->idle_qh_list);
-
 	init_waitqueue_head(&uhci->waitqh);
 
 	if (DEBUG_CONFIGURED) {
@@ -665,11 +670,12 @@ static void uhci_stop(struct usb_hcd *hcd)
 	struct uhci_hcd *uhci = hcd_to_uhci(hcd);
 
 	spin_lock_irq(&uhci->lock);
-	if (!uhci->hc_inaccessible)
-		hc_died(uhci);
+	if (test_bit(HCD_FLAG_HW_ACCESSIBLE, &hcd->flags) && !uhci->dead)
+		uhci_hc_died(uhci);
 	uhci_scan_schedule(uhci, NULL);
 	spin_unlock_irq(&uhci->lock);
 
+	del_timer_sync(&uhci->fsbr_timer);
 	release_uhci(uhci);
 }
 
@@ -677,12 +683,15 @@ static void uhci_stop(struct usb_hcd *hcd)
 static int uhci_rh_suspend(struct usb_hcd *hcd)
 {
 	struct uhci_hcd *uhci = hcd_to_uhci(hcd);
+	int rc = 0;
 
 	spin_lock_irq(&uhci->lock);
-	if (!uhci->hc_inaccessible)		/* Not dead */
+	if (!test_bit(HCD_FLAG_HW_ACCESSIBLE, &hcd->flags))
+		rc = -ESHUTDOWN;
+	else if (!uhci->dead)
 		suspend_rh(uhci, UHCI_RH_SUSPENDED);
 	spin_unlock_irq(&uhci->lock);
-	return 0;
+	return rc;
 }
 
 static int uhci_rh_resume(struct usb_hcd *hcd)
@@ -691,13 +700,10 @@ static int uhci_rh_resume(struct usb_hcd *hcd)
 	int rc = 0;
 
 	spin_lock_irq(&uhci->lock);
-	if (uhci->hc_inaccessible) {
-		if (uhci->rh_state == UHCI_RH_SUSPENDED) {
-			dev_warn(uhci_dev(uhci), "HC isn't running!\n");
-			rc = -ENODEV;
-		}
-		/* Otherwise the HC is dead */
-	} else
+	if (!test_bit(HCD_FLAG_HW_ACCESSIBLE, &hcd->flags)) {
+		dev_warn(&hcd->self.root_hub->dev, "HC isn't running!\n");
+		rc = -ESHUTDOWN;
+	} else if (!uhci->dead)
 		wakeup_rh(uhci);
 	spin_unlock_irq(&uhci->lock);
 	return rc;
@@ -711,8 +717,8 @@ static int uhci_suspend(struct usb_hcd *hcd, pm_message_t message)
 	dev_dbg(uhci_dev(uhci), "%s\n", __FUNCTION__);
 
 	spin_lock_irq(&uhci->lock);
-	if (uhci->hc_inaccessible)	/* Dead or already suspended */
-		goto done;
+	if (!test_bit(HCD_FLAG_HW_ACCESSIBLE, &hcd->flags) || uhci->dead)
+		goto done_okay;		/* Already suspended or dead */
 
 	if (uhci->rh_state > UHCI_RH_SUSPENDED) {
 		dev_warn(uhci_dev(uhci), "Root hub isn't suspended!\n");
@@ -725,12 +731,12 @@ static int uhci_suspend(struct usb_hcd *hcd, pm_message_t message)
 	 */
 	pci_write_config_word(to_pci_dev(uhci_dev(uhci)), USBLEGSUP, 0);
 	mb();
-	clear_bit(HCD_FLAG_HW_ACCESSIBLE, &hcd->flags);
-	uhci->hc_inaccessible = 1;
 	hcd->poll_rh = 0;
 
 	/* FIXME: Enable non-PME# remote wakeup? */
 
+done_okay:
+	clear_bit(HCD_FLAG_HW_ACCESSIBLE, &hcd->flags);
 done:
 	spin_unlock_irq(&uhci->lock);
 	return rc;
@@ -743,24 +749,22 @@ static int uhci_resume(struct usb_hcd *hcd)
 	dev_dbg(uhci_dev(uhci), "%s\n", __FUNCTION__);
 
 	/* Since we aren't in D3 any more, it's safe to set this flag
-	 * even if the controller was dead.  It might not even be dead
-	 * any more, if the firmware or quirks code has reset it.
+	 * even if the controller was dead.
 	 */
 	set_bit(HCD_FLAG_HW_ACCESSIBLE, &hcd->flags);
 	mb();
 
-	if (uhci->rh_state == UHCI_RH_RESET)	/* Dead */
-		return 0;
 	spin_lock_irq(&uhci->lock);
 
 	/* FIXME: Disable non-PME# remote wakeup? */
 
-	uhci->hc_inaccessible = 0;
-
-	/* The BIOS may have changed the controller settings during a
-	 * system wakeup.  Check it and reconfigure to avoid problems.
+	/* The firmware or a boot kernel may have changed the controller
+	 * settings during a system wakeup.  Check it and reconfigure
+	 * to avoid problems.
 	 */
 	check_and_reset_hc(uhci);
+
+	/* If the controller was dead before, it's back alive now */
 	configure_hc(uhci);
 
 	if (uhci->rh_state == UHCI_RH_RESET) {
@@ -810,18 +814,15 @@ done:
 static int uhci_hcd_get_frame_number(struct usb_hcd *hcd)
 {
 	struct uhci_hcd *uhci = hcd_to_uhci(hcd);
-	unsigned long flags;
-	int is_stopped;
-	int frame_number;
+	unsigned frame_number;
+	unsigned delta;
 
 	/* Minimize latency by avoiding the spinlock */
-	local_irq_save(flags);
-	is_stopped = uhci->is_stopped;
-	smp_rmb();
-	frame_number = (is_stopped ? uhci->frame_number :
-			inw(uhci->io_addr + USBFRNUM));
-	local_irq_restore(flags);
-	return frame_number;
+	frame_number = uhci->frame_number;
+	barrier();
+	delta = (inw(uhci->io_addr + USBFRNUM) - frame_number) &
+			(UHCI_NUMFRAMES - 1);
+	return frame_number + delta;
 }
 
 static const char hcd_name[] = "uhci_hcd";
@@ -836,7 +837,7 @@ static const struct hc_driver uhci_driver = {
 	.flags =		HCD_USB11,
 
 	/* Basic lifecycle operations */
-	.reset =		uhci_reset,
+	.reset =		uhci_init,
 	.start =		uhci_start,
 #ifdef CONFIG_PM
 	.suspend =		uhci_suspend,
diff --git a/drivers/usb/host/uhci-hcd.h b/drivers/usb/host/uhci-hcd.h
index d5c8f4d9282..108e3de2dc2 100644
--- a/drivers/usb/host/uhci-hcd.h
+++ b/drivers/usb/host/uhci-hcd.h
@@ -84,6 +84,13 @@
 #define CAN_SCHEDULE_FRAMES	1000	/* how far in the future frames
 					 * can be scheduled */
 
+/* When no queues need Full-Speed Bandwidth Reclamation,
+ * delay this long before turning FSBR off */
+#define FSBR_OFF_DELAY		msecs_to_jiffies(10)
+
+/* If a queue hasn't advanced after this much time, assume it is stuck */
+#define QH_WAIT_TIMEOUT		msecs_to_jiffies(200)
+
 
 /*
  *	Queue Headers
@@ -121,21 +128,31 @@ struct uhci_qh {
 	__le32 element;			/* Queue element (TD) pointer */
 
 	/* Software fields */
-	dma_addr_t dma_handle;
-
 	struct list_head node;		/* Node in the list of QHs */
 	struct usb_host_endpoint *hep;	/* Endpoint information */
 	struct usb_device *udev;
 	struct list_head queue;		/* Queue of urbps for this QH */
 	struct uhci_qh *skel;		/* Skeleton for this QH */
 	struct uhci_td *dummy_td;	/* Dummy TD to end the queue */
+	struct uhci_td *post_td;	/* Last TD completed */
 
+	struct usb_iso_packet_descriptor *iso_packet_desc;
+					/* Next urb->iso_frame_desc entry */
+	unsigned long advance_jiffies;	/* Time of last queue advance */
 	unsigned int unlink_frame;	/* When the QH was unlinked */
+	unsigned int period;		/* For Interrupt and Isochronous QHs */
+	unsigned int iso_frame;		/* Frame # for iso_packet_desc */
+	int iso_status;			/* Status for Isochronous URBs */
+
 	int state;			/* QH_STATE_xxx; see above */
+	int type;			/* Queue type (control, bulk, etc) */
+
+	dma_addr_t dma_handle;
 
 	unsigned int initial_toggle:1;	/* Endpoint's current toggle value */
 	unsigned int needs_fixup:1;	/* Must fix the TD toggle values */
-	unsigned int is_stopped:1;	/* Queue was stopped by an error */
+	unsigned int is_stopped:1;	/* Queue was stopped by error/unlink */
+	unsigned int wait_expired:1;	/* QH_WAIT_TIMEOUT has expired */
 } __attribute__((aligned(16)));
 
 /*
@@ -226,7 +243,6 @@ struct uhci_td {
 	dma_addr_t dma_handle;
 
 	struct list_head list;
-	struct list_head remove_list;
 
 	int frame;			/* for iso: what frame? */
 	struct list_head fl_list;
@@ -305,38 +321,8 @@ static inline u32 td_status(struct uhci_td *td) {
 #define skel_bulk_qh		skelqh[12]
 #define skel_term_qh		skelqh[13]
 
-/*
- * Search tree for determining where <interval> fits in the skelqh[]
- * skeleton.
- *
- * An interrupt request should be placed into the slowest skelqh[]
- * which meets the interval/period/frequency requirement.
- * An interrupt request is allowed to be faster than <interval> but not slower.
- *
- * For a given <interval>, this function returns the appropriate/matching
- * skelqh[] index value.
- */
-static inline int __interval_to_skel(int interval)
-{
-	if (interval < 16) {
-		if (interval < 4) {
-			if (interval < 2)
-				return 9;	/* int1 for 0-1 ms */
-			return 8;		/* int2 for 2-3 ms */
-		}
-		if (interval < 8)
-			return 7;		/* int4 for 4-7 ms */
-		return 6;			/* int8 for 8-15 ms */
-	}
-	if (interval < 64) {
-		if (interval < 32)
-			return 5;		/* int16 for 16-31 ms */
-		return 4;			/* int32 for 32-63 ms */
-	}
-	if (interval < 128)
-		return 3;			/* int64 for 64-127 ms */
-	return 2;				/* int128 for 128-255 ms (Max.) */
-}
+/* Find the skelqh entry corresponding to an interval exponent */
+#define UHCI_SKEL_INDEX(exponent)	(9 - exponent)
 
 
 /*
@@ -396,32 +382,32 @@ struct uhci_hcd {
 	__le32 *frame;
 	void **frame_cpu;		/* CPU's frame list */
 
-	int fsbr;			/* Full-speed bandwidth reclamation */
-	unsigned long fsbrtimeout;	/* FSBR delay */
-
 	enum uhci_rh_state rh_state;
 	unsigned long auto_stop_time;		/* When to AUTO_STOP */
 
 	unsigned int frame_number;		/* As of last check */
 	unsigned int is_stopped;
 #define UHCI_IS_STOPPED		9999		/* Larger than a frame # */
+	unsigned int last_iso_frame;		/* Frame of last scan */
+	unsigned int cur_iso_frame;		/* Frame for current scan */
 
 	unsigned int scan_in_progress:1;	/* Schedule scan is running */
 	unsigned int need_rescan:1;		/* Redo the schedule scan */
-	unsigned int hc_inaccessible:1;		/* HC is suspended or dead */
+	unsigned int dead:1;			/* Controller has died */
 	unsigned int working_RD:1;		/* Suspended root hub doesn't
 						   need to be polled */
 	unsigned int is_initialized:1;		/* Data structure is usable */
+	unsigned int fsbr_is_on:1;		/* FSBR is turned on */
+	unsigned int fsbr_is_wanted:1;		/* Does any URB want FSBR? */
+	unsigned int fsbr_expiring:1;		/* FSBR is timing out */
+
+	struct timer_list fsbr_timer;		/* For turning off FBSR */
 
 	/* Support for port suspend/resume/reset */
 	unsigned long port_c_suspend;		/* Bit-arrays of ports */
 	unsigned long resuming_ports;
 	unsigned long ports_timeout;		/* Time to stop signalling */
 
-	/* List of TDs that are done, but waiting to be freed (race) */
-	struct list_head td_remove_list;
-	unsigned int td_remove_age;		/* Age in frames */
-
 	struct list_head idle_qh_list;		/* Where the idle QHs live */
 
 	int rh_numports;			/* Number of root-hub ports */
@@ -442,6 +428,9 @@ static inline struct usb_hcd *uhci_to_hcd(struct uhci_hcd *uhci)
 
 #define uhci_dev(u)	(uhci_to_hcd(u)->self.controller)
 
+/* Utility macro for comparing frame numbers */
+#define uhci_frame_before_eq(f1, f2)	(0 <= (int) ((f2) - (f1)))
+
 
 /*
  *	Private per-URB data
@@ -454,9 +443,7 @@ struct urb_priv {
 	struct uhci_qh *qh;		/* QH for this URB */
 	struct list_head td_list;
 
-	unsigned fsbr : 1;		/* URB turned on FSBR */
-	unsigned short_transfer : 1;	/* URB got a short transfer, no
-					 * need to rescan */
+	unsigned fsbr:1;		/* URB wants FSBR */
 };
 
 
diff --git a/drivers/usb/host/uhci-hub.c b/drivers/usb/host/uhci-hub.c
index c8451d9578f..c545ef92fe2 100644
--- a/drivers/usb/host/uhci-hub.c
+++ b/drivers/usb/host/uhci-hub.c
@@ -171,9 +171,8 @@ static int uhci_hub_status_data(struct usb_hcd *hcd, char *buf)
 	spin_lock_irqsave(&uhci->lock, flags);
 
 	uhci_scan_schedule(uhci, NULL);
-	if (uhci->hc_inaccessible)
+	if (!test_bit(HCD_FLAG_HW_ACCESSIBLE, &hcd->flags) || uhci->dead)
 		goto done;
-	check_fsbr(uhci);
 	uhci_check_ports(uhci);
 
 	status = get_hub_status_data(uhci, buf);
@@ -228,7 +227,7 @@ static int uhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
 	u16 wPortChange, wPortStatus;
 	unsigned long flags;
 
-	if (uhci->hc_inaccessible)
+	if (!test_bit(HCD_FLAG_HW_ACCESSIBLE, &hcd->flags) || uhci->dead)
 		return -ETIMEDOUT;
 
 	spin_lock_irqsave(&uhci->lock, flags);
diff --git a/drivers/usb/host/uhci-q.c b/drivers/usb/host/uhci-q.c
index a06d84c19e1..c9d72ac0a1d 100644
--- a/drivers/usb/host/uhci-q.c
+++ b/drivers/usb/host/uhci-q.c
@@ -13,10 +13,9 @@
  * (C) Copyright 2000 Yggdrasil Computing, Inc. (port of new PCI interface
  *               support from usb-ohci.c by Adam Richter, adam@yggdrasil.com).
  * (C) Copyright 1999 Gregory P. Smith (from usb-ohci.c)
- * (C) Copyright 2004-2005 Alan Stern, stern@rowland.harvard.edu
+ * (C) Copyright 2004-2006 Alan Stern, stern@rowland.harvard.edu
  */
 
-static void uhci_free_pending_tds(struct uhci_hcd *uhci);
 
 /*
  * Technically, updating td->status here is a race, but it's not really a
@@ -38,6 +37,60 @@ static inline void uhci_clear_next_interrupt(struct uhci_hcd *uhci)
 	uhci->term_td->status &= ~cpu_to_le32(TD_CTRL_IOC);
 }
 
+
+/*
+ * Full-Speed Bandwidth Reclamation (FSBR).
+ * We turn on FSBR whenever a queue that wants it is advancing,
+ * and leave it on for a short time thereafter.
+ */
+static void uhci_fsbr_on(struct uhci_hcd *uhci)
+{
+	uhci->fsbr_is_on = 1;
+	uhci->skel_term_qh->link = cpu_to_le32(
+			uhci->skel_fs_control_qh->dma_handle) | UHCI_PTR_QH;
+}
+
+static void uhci_fsbr_off(struct uhci_hcd *uhci)
+{
+	uhci->fsbr_is_on = 0;
+	uhci->skel_term_qh->link = UHCI_PTR_TERM;
+}
+
+static void uhci_add_fsbr(struct uhci_hcd *uhci, struct urb *urb)
+{
+	struct urb_priv *urbp = urb->hcpriv;
+
+	if (!(urb->transfer_flags & URB_NO_FSBR))
+		urbp->fsbr = 1;
+}
+
+static void uhci_urbp_wants_fsbr(struct uhci_hcd *uhci, struct urb_priv *urbp)
+{
+	if (urbp->fsbr) {
+		uhci->fsbr_is_wanted = 1;
+		if (!uhci->fsbr_is_on)
+			uhci_fsbr_on(uhci);
+		else if (uhci->fsbr_expiring) {
+			uhci->fsbr_expiring = 0;
+			del_timer(&uhci->fsbr_timer);
+		}
+	}
+}
+
+static void uhci_fsbr_timeout(unsigned long _uhci)
+{
+	struct uhci_hcd *uhci = (struct uhci_hcd *) _uhci;
+	unsigned long flags;
+
+	spin_lock_irqsave(&uhci->lock, flags);
+	if (uhci->fsbr_expiring) {
+		uhci->fsbr_expiring = 0;
+		uhci_fsbr_off(uhci);
+	}
+	spin_unlock_irqrestore(&uhci->lock, flags);
+}
+
+
 static struct uhci_td *uhci_alloc_td(struct uhci_hcd *uhci)
 {
 	dma_addr_t dma_handle;
@@ -51,7 +104,6 @@ static struct uhci_td *uhci_alloc_td(struct uhci_hcd *uhci)
 	td->frame = -1;
 
 	INIT_LIST_HEAD(&td->list);
-	INIT_LIST_HEAD(&td->remove_list);
 	INIT_LIST_HEAD(&td->fl_list);
 
 	return td;
@@ -61,8 +113,6 @@ static void uhci_free_td(struct uhci_hcd *uhci, struct uhci_td *td)
 {
 	if (!list_empty(&td->list))
 		dev_warn(uhci_dev(uhci), "td %p still in list!\n", td);
-	if (!list_empty(&td->remove_list))
-		dev_warn(uhci_dev(uhci), "td %p still in remove_list!\n", td);
 	if (!list_empty(&td->fl_list))
 		dev_warn(uhci_dev(uhci), "td %p still in fl_list!\n", td);
 
@@ -77,6 +127,16 @@ static inline void uhci_fill_td(struct uhci_td *td, u32 status,
 	td->buffer = cpu_to_le32(buffer);
 }
 
+static void uhci_add_td_to_urbp(struct uhci_td *td, struct urb_priv *urbp)
+{
+	list_add_tail(&td->list, &urbp->td_list);
+}
+
+static void uhci_remove_td_from_urbp(struct uhci_td *td)
+{
+	list_del_init(&td->list);
+}
+
 /*
  * We insert Isochronous URBs directly into the frame list at the beginning
  */
@@ -138,6 +198,24 @@ static inline void uhci_remove_td_from_frame_list(struct uhci_hcd *uhci,
 	td->frame = -1;
 }
 
+static inline void uhci_remove_tds_from_frame(struct uhci_hcd *uhci,
+		unsigned int framenum)
+{
+	struct uhci_td *ftd, *ltd;
+
+	framenum &= (UHCI_NUMFRAMES - 1);
+
+	ftd = uhci->frame_cpu[framenum];
+	if (ftd) {
+		ltd = list_entry(ftd->fl_list.prev, struct uhci_td, fl_list);
+		uhci->frame[framenum] = ltd->link;
+		uhci->frame_cpu[framenum] = NULL;
+
+		while (!list_empty(&ftd->fl_list))
+			list_del_init(ftd->fl_list.prev);
+	}
+}
+
 /*
  * Remove all the TDs for an Isochronous URB from the frame list
  */
@@ -148,7 +226,6 @@ static void uhci_unlink_isochronous_tds(struct uhci_hcd *uhci, struct urb *urb)
 
 	list_for_each_entry(td, &urbp->td_list, list)
 		uhci_remove_td_from_frame_list(uhci, td);
-	wmb();
 }
 
 static struct uhci_qh *uhci_alloc_qh(struct uhci_hcd *uhci,
@@ -161,6 +238,7 @@ static struct uhci_qh *uhci_alloc_qh(struct uhci_hcd *uhci,
 	if (!qh)
 		return NULL;
 
+	memset(qh, 0, sizeof(*qh));
 	qh->dma_handle = dma_handle;
 
 	qh->element = UHCI_PTR_TERM;
@@ -179,10 +257,11 @@ static struct uhci_qh *uhci_alloc_qh(struct uhci_hcd *uhci,
 		qh->hep = hep;
 		qh->udev = udev;
 		hep->hcpriv = qh;
+		qh->type = hep->desc.bmAttributes & USB_ENDPOINT_XFERTYPE_MASK;
 
 	} else {		/* Skeleton QH */
 		qh->state = QH_STATE_ACTIVE;
-		qh->udev = NULL;
+		qh->type = -1;
 	}
 	return qh;
 }
@@ -202,35 +281,64 @@ static void uhci_free_qh(struct uhci_hcd *uhci, struct uhci_qh *qh)
 }
 
 /*
- * When the currently executing URB is dequeued, save its current toggle value
+ * When a queue is stopped and a dequeued URB is given back, adjust
+ * the previous TD link (if the URB isn't first on the queue) or
+ * save its toggle value (if it is first and is currently executing).
+ *
+ * Returns 0 if the URB should not yet be given back, 1 otherwise.
  */
-static void uhci_save_toggle(struct uhci_qh *qh, struct urb *urb)
+static int uhci_cleanup_queue(struct uhci_hcd *uhci, struct uhci_qh *qh,
+		struct urb *urb)
 {
-	struct urb_priv *urbp = (struct urb_priv *) urb->hcpriv;
+	struct urb_priv *urbp = urb->hcpriv;
 	struct uhci_td *td;
+	int ret = 1;
+
+	/* Isochronous pipes don't use toggles and their TD link pointers
+	 * get adjusted during uhci_urb_dequeue().  But since their queues
+	 * cannot truly be stopped, we have to watch out for dequeues
+	 * occurring after the nominal unlink frame. */
+	if (qh->type == USB_ENDPOINT_XFER_ISOC) {
+		ret = (uhci->frame_number + uhci->is_stopped !=
+				qh->unlink_frame);
+		goto done;
+	}
+
+	/* If the URB isn't first on its queue, adjust the link pointer
+	 * of the last TD in the previous URB.  The toggle doesn't need
+	 * to be saved since this URB can't be executing yet. */
+	if (qh->queue.next != &urbp->node) {
+		struct urb_priv *purbp;
+		struct uhci_td *ptd;
+
+		purbp = list_entry(urbp->node.prev, struct urb_priv, node);
+		WARN_ON(list_empty(&purbp->td_list));
+		ptd = list_entry(purbp->td_list.prev, struct uhci_td,
+				list);
+		td = list_entry(urbp->td_list.prev, struct uhci_td,
+				list);
+		ptd->link = td->link;
+		goto done;
+	}
 
 	/* If the QH element pointer is UHCI_PTR_TERM then then currently
 	 * executing URB has already been unlinked, so this one isn't it. */
-	if (qh_element(qh) == UHCI_PTR_TERM ||
-				qh->queue.next != &urbp->node)
-		return;
+	if (qh_element(qh) == UHCI_PTR_TERM)
+		goto done;
 	qh->element = UHCI_PTR_TERM;
 
-	/* Only bulk and interrupt pipes have to worry about toggles */
-	if (!(usb_pipetype(urb->pipe) == PIPE_BULK ||
-			usb_pipetype(urb->pipe) == PIPE_INTERRUPT))
-		return;
+	/* Control pipes have to worry about toggles */
+	if (qh->type == USB_ENDPOINT_XFER_CONTROL)
+		goto done;
 
-	/* Find the first active TD; that's the device's toggle state */
-	list_for_each_entry(td, &urbp->td_list, list) {
-		if (td_status(td) & TD_CTRL_ACTIVE) {
-			qh->needs_fixup = 1;
-			qh->initial_toggle = uhci_toggle(td_token(td));
-			return;
-		}
-	}
+	/* Save the next toggle value */
+	WARN_ON(list_empty(&urbp->td_list));
+	td = list_entry(urbp->td_list.next, struct uhci_td, list);
+	qh->needs_fixup = 1;
+	qh->initial_toggle = uhci_toggle(td_token(td));
 
-	WARN_ON(1);
+done:
+	return ret;
 }
 
 /*
@@ -305,6 +413,10 @@ static void uhci_activate_qh(struct uhci_hcd *uhci, struct uhci_qh *qh)
 		qh->element = cpu_to_le32(td->dma_handle);
 	}
 
+	/* Treat the queue as if it has just advanced */
+	qh->wait_expired = 0;
+	qh->advance_jiffies = jiffies;
+
 	if (qh->state == QH_STATE_ACTIVE)
 		return;
 	qh->state = QH_STATE_ACTIVE;
@@ -370,6 +482,12 @@ static void uhci_make_qh_idle(struct uhci_hcd *uhci, struct uhci_qh *qh)
 	list_move(&qh->node, &uhci->idle_qh_list);
 	qh->state = QH_STATE_IDLE;
 
+	/* Now that the QH is idle, its post_td isn't being used */
+	if (qh->post_td) {
+		uhci_free_td(uhci, qh->post_td);
+		qh->post_td = NULL;
+	}
+
 	/* If anyone is waiting for a QH to become idle, wake them up */
 	if (uhci->num_waiting)
 		wake_up_all(&uhci->waitqh);
@@ -395,21 +513,6 @@ static inline struct urb_priv *uhci_alloc_urb_priv(struct uhci_hcd *uhci,
 	return urbp;
 }
 
-static void uhci_add_td_to_urb(struct urb *urb, struct uhci_td *td)
-{
-	struct urb_priv *urbp = (struct urb_priv *)urb->hcpriv;
-
-	list_add_tail(&td->list, &urbp->td_list);
-}
-
-static void uhci_remove_td_from_urb(struct uhci_td *td)
-{
-	if (list_empty(&td->list))
-		return;
-
-	list_del_init(&td->list);
-}
-
 static void uhci_free_urb_priv(struct uhci_hcd *uhci,
 		struct urb_priv *urbp)
 {
@@ -419,48 +522,15 @@ static void uhci_free_urb_priv(struct uhci_hcd *uhci,
 		dev_warn(uhci_dev(uhci), "urb %p still on QH's list!\n",
 				urbp->urb);
 
-	uhci_get_current_frame_number(uhci);
-	if (uhci->frame_number + uhci->is_stopped != uhci->td_remove_age) {
-		uhci_free_pending_tds(uhci);
-		uhci->td_remove_age = uhci->frame_number;
-	}
-
-	/* Check to see if the remove list is empty. Set the IOC bit */
-	/* to force an interrupt so we can remove the TDs. */
-	if (list_empty(&uhci->td_remove_list))
-		uhci_set_next_interrupt(uhci);
-
 	list_for_each_entry_safe(td, tmp, &urbp->td_list, list) {
-		uhci_remove_td_from_urb(td);
-		list_add(&td->remove_list, &uhci->td_remove_list);
+		uhci_remove_td_from_urbp(td);
+		uhci_free_td(uhci, td);
 	}
 
 	urbp->urb->hcpriv = NULL;
 	kmem_cache_free(uhci_up_cachep, urbp);
 }
 
-static void uhci_inc_fsbr(struct uhci_hcd *uhci, struct urb *urb)
-{
-	struct urb_priv *urbp = (struct urb_priv *)urb->hcpriv;
-
-	if ((!(urb->transfer_flags & URB_NO_FSBR)) && !urbp->fsbr) {
-		urbp->fsbr = 1;
-		if (!uhci->fsbr++ && !uhci->fsbrtimeout)
-			uhci->skel_term_qh->link = cpu_to_le32(uhci->skel_fs_control_qh->dma_handle) | UHCI_PTR_QH;
-	}
-}
-
-static void uhci_dec_fsbr(struct uhci_hcd *uhci, struct urb *urb)
-{
-	struct urb_priv *urbp = (struct urb_priv *)urb->hcpriv;
-
-	if ((!(urb->transfer_flags & URB_NO_FSBR)) && urbp->fsbr) {
-		urbp->fsbr = 0;
-		if (!--uhci->fsbr)
-			uhci->fsbrtimeout = jiffies + FSBR_DELAY;
-	}
-}
-
 /*
  * Map status to standard result codes
  *
@@ -487,7 +557,6 @@ static int uhci_map_status(int status, int dir_out)
 		return -ENOSR;
 	if (status & TD_CTRL_STALLED)			/* Stalled */
 		return -EPIPE;
-	WARN_ON(status & TD_CTRL_ACTIVE);		/* Active */
 	return 0;
 }
 
@@ -503,6 +572,7 @@ static int uhci_submit_control(struct uhci_hcd *uhci, struct urb *urb,
 	int len = urb->transfer_buffer_length;
 	dma_addr_t data = urb->transfer_dma;
 	__le32 *plink;
+	struct urb_priv *urbp = urb->hcpriv;
 
 	/* The "pipe" thing contains the destination in bits 8--18 */
 	destination = (urb->pipe & PIPE_DEVEP_MASK) | USB_PID_SETUP;
@@ -516,7 +586,7 @@ static int uhci_submit_control(struct uhci_hcd *uhci, struct urb *urb,
 	 * Build the TD for the control request setup packet
 	 */
 	td = qh->dummy_td;
-	uhci_add_td_to_urb(urb, td);
+	uhci_add_td_to_urbp(td, urbp);
 	uhci_fill_td(td, status, destination | uhci_explen(8),
 			urb->setup_dma);
 	plink = &td->link;
@@ -548,7 +618,7 @@ static int uhci_submit_control(struct uhci_hcd *uhci, struct urb *urb,
 		/* Alternate Data0/1 (start with Data1) */
 		destination ^= TD_TOKEN_TOGGLE;
 	
-		uhci_add_td_to_urb(urb, td);
+		uhci_add_td_to_urbp(td, urbp);
 		uhci_fill_td(td, status, destination | uhci_explen(pktsze),
 				data);
 		plink = &td->link;
@@ -579,7 +649,7 @@ static int uhci_submit_control(struct uhci_hcd *uhci, struct urb *urb,
 
 	status &= ~TD_CTRL_SPD;
 
-	uhci_add_td_to_urb(urb, td);
+	uhci_add_td_to_urbp(td, urbp);
 	uhci_fill_td(td, status | TD_CTRL_IOC,
 			destination | uhci_explen(0), 0);
 	plink = &td->link;
@@ -606,145 +676,19 @@ static int uhci_submit_control(struct uhci_hcd *uhci, struct urb *urb,
 		qh->skel = uhci->skel_ls_control_qh;
 	else {
 		qh->skel = uhci->skel_fs_control_qh;
-		uhci_inc_fsbr(uhci, urb);
+		uhci_add_fsbr(uhci, urb);
 	}
+
+	urb->actual_length = -8;	/* Account for the SETUP packet */
 	return 0;
 
 nomem:
 	/* Remove the dummy TD from the td_list so it doesn't get freed */
-	uhci_remove_td_from_urb(qh->dummy_td);
+	uhci_remove_td_from_urbp(qh->dummy_td);
 	return -ENOMEM;
 }
 
 /*
- * If control-IN transfer was short, the status packet wasn't sent.
- * This routine changes the element pointer in the QH to point at the
- * status TD.  It's safe to do this even while the QH is live, because
- * the hardware only updates the element pointer following a successful
- * transfer.  The inactive TD for the short packet won't cause an update,
- * so the pointer won't get overwritten.  The next time the controller
- * sees this QH, it will send the status packet.
- */
-static int usb_control_retrigger_status(struct uhci_hcd *uhci, struct urb *urb)
-{
-	struct urb_priv *urbp = (struct urb_priv *)urb->hcpriv;
-	struct uhci_td *td;
-
-	urbp->short_transfer = 1;
-
-	td = list_entry(urbp->td_list.prev, struct uhci_td, list);
-	urbp->qh->element = cpu_to_le32(td->dma_handle);
-
-	return -EINPROGRESS;
-}
-
-
-static int uhci_result_control(struct uhci_hcd *uhci, struct urb *urb)
-{
-	struct list_head *tmp, *head;
-	struct urb_priv *urbp = urb->hcpriv;
-	struct uhci_td *td;
-	unsigned int status;
-	int ret = 0;
-
-	head = &urbp->td_list;
-	if (urbp->short_transfer) {
-		tmp = head->prev;
-		goto status_stage;
-	}
-
-	urb->actual_length = 0;
-
-	tmp = head->next;
-	td = list_entry(tmp, struct uhci_td, list);
-
-	/* The first TD is the SETUP stage, check the status, but skip */
-	/*  the count */
-	status = uhci_status_bits(td_status(td));
-	if (status & TD_CTRL_ACTIVE)
-		return -EINPROGRESS;
-
-	if (status)
-		goto td_error;
-
-	/* The rest of the TDs (but the last) are data */
-	tmp = tmp->next;
-	while (tmp != head && tmp->next != head) {
-		unsigned int ctrlstat;
-
-		td = list_entry(tmp, struct uhci_td, list);
-		tmp = tmp->next;
-
-		ctrlstat = td_status(td);
-		status = uhci_status_bits(ctrlstat);
-		if (status & TD_CTRL_ACTIVE)
-			return -EINPROGRESS;
-
-		urb->actual_length += uhci_actual_length(ctrlstat);
-
-		if (status)
-			goto td_error;
-
-		/* Check to see if we received a short packet */
-		if (uhci_actual_length(ctrlstat) <
-				uhci_expected_length(td_token(td))) {
-			if (urb->transfer_flags & URB_SHORT_NOT_OK) {
-				ret = -EREMOTEIO;
-				goto err;
-			}
-
-			return usb_control_retrigger_status(uhci, urb);
-		}
-	}
-
-status_stage:
-	td = list_entry(tmp, struct uhci_td, list);
-
-	/* Control status stage */
-	status = td_status(td);
-
-#ifdef I_HAVE_BUGGY_APC_BACKUPS
-	/* APC BackUPS Pro kludge */
-	/* It tries to send all of the descriptor instead of the amount */
-	/*  we requested */
-	if (status & TD_CTRL_IOC &&	/* IOC is masked out by uhci_status_bits */
-	    status & TD_CTRL_ACTIVE &&
-	    status & TD_CTRL_NAK)
-		return 0;
-#endif
-
-	status = uhci_status_bits(status);
-	if (status & TD_CTRL_ACTIVE)
-		return -EINPROGRESS;
-
-	if (status)
-		goto td_error;
-
-	return 0;
-
-td_error:
-	ret = uhci_map_status(status, uhci_packetout(td_token(td)));
-
-err:
-	if ((debug == 1 && ret != -EPIPE) || debug > 1) {
-		/* Some debugging code */
-		dev_dbg(uhci_dev(uhci), "%s: failed with status %x\n",
-				__FUNCTION__, status);
-
-		if (errbuf) {
-			/* Print the chain for debugging purposes */
-			uhci_show_qh(urbp->qh, errbuf, ERRBUF_LEN, 0);
-			lprintk(errbuf);
-		}
-	}
-
-	/* Note that the queue has stopped */
-	urbp->qh->element = UHCI_PTR_TERM;
-	urbp->qh->is_stopped = 1;
-	return ret;
-}
-
-/*
  * Common submit for bulk and interrupt
  */
 static int uhci_submit_common(struct uhci_hcd *uhci, struct urb *urb,
@@ -756,6 +700,7 @@ static int uhci_submit_common(struct uhci_hcd *uhci, struct urb *urb,
 	int len = urb->transfer_buffer_length;
 	dma_addr_t data = urb->transfer_dma;
 	__le32 *plink;
+	struct urb_priv *urbp = urb->hcpriv;
 	unsigned int toggle;
 
 	if (len < 0)
@@ -793,7 +738,7 @@ static int uhci_submit_common(struct uhci_hcd *uhci, struct urb *urb,
 				goto nomem;
 			*plink = cpu_to_le32(td->dma_handle);
 		}
-		uhci_add_td_to_urb(urb, td);
+		uhci_add_td_to_urbp(td, urbp);
 		uhci_fill_td(td, status,
 				destination | uhci_explen(pktsze) |
 					(toggle << TD_TOKEN_TOGGLE_SHIFT),
@@ -821,7 +766,7 @@ static int uhci_submit_common(struct uhci_hcd *uhci, struct urb *urb,
 			goto nomem;
 		*plink = cpu_to_le32(td->dma_handle);
 
-		uhci_add_td_to_urb(urb, td);
+		uhci_add_td_to_urbp(td, urbp);
 		uhci_fill_td(td, status,
 				destination | uhci_explen(0) |
 					(toggle << TD_TOKEN_TOGGLE_SHIFT),
@@ -851,6 +796,7 @@ static int uhci_submit_common(struct uhci_hcd *uhci, struct urb *urb,
 	wmb();
 	qh->dummy_td->status |= __constant_cpu_to_le32(TD_CTRL_ACTIVE);
 	qh->dummy_td = td;
+	qh->period = urb->interval;
 
 	usb_settoggle(urb->dev, usb_pipeendpoint(urb->pipe),
 			usb_pipeout(urb->pipe), toggle);
@@ -858,90 +804,10 @@ static int uhci_submit_common(struct uhci_hcd *uhci, struct urb *urb,
 
 nomem:
 	/* Remove the dummy TD from the td_list so it doesn't get freed */
-	uhci_remove_td_from_urb(qh->dummy_td);
+	uhci_remove_td_from_urbp(qh->dummy_td);
 	return -ENOMEM;
 }
 
-/*
- * Common result for bulk and interrupt
- */
-static int uhci_result_common(struct uhci_hcd *uhci, struct urb *urb)
-{
-	struct urb_priv *urbp = urb->hcpriv;
-	struct uhci_td *td;
-	unsigned int status = 0;
-	int ret = 0;
-
-	urb->actual_length = 0;
-
-	list_for_each_entry(td, &urbp->td_list, list) {
-		unsigned int ctrlstat = td_status(td);
-
-		status = uhci_status_bits(ctrlstat);
-		if (status & TD_CTRL_ACTIVE)
-			return -EINPROGRESS;
-
-		urb->actual_length += uhci_actual_length(ctrlstat);
-
-		if (status)
-			goto td_error;
-
-		if (uhci_actual_length(ctrlstat) <
-				uhci_expected_length(td_token(td))) {
-			if (urb->transfer_flags & URB_SHORT_NOT_OK) {
-				ret = -EREMOTEIO;
-				goto err;
-			}
-
-			/*
-			 * This URB stopped short of its end.  We have to
-			 * fix up the toggles of the following URBs on the
-			 * queue and restart the queue.
-			 *
-			 * Do this only the first time we encounter the
-			 * short URB.
-			 */
-			if (!urbp->short_transfer) {
-				urbp->short_transfer = 1;
-				urbp->qh->initial_toggle =
-						uhci_toggle(td_token(td)) ^ 1;
-				uhci_fixup_toggles(urbp->qh, 1);
-
-				td = list_entry(urbp->td_list.prev,
-						struct uhci_td, list);
-				urbp->qh->element = td->link;
-			}
-			break;
-		}
-	}
-
-	return 0;
-
-td_error:
-	ret = uhci_map_status(status, uhci_packetout(td_token(td)));
-
-	if ((debug == 1 && ret != -EPIPE) || debug > 1) {
-		/* Some debugging code */
-		dev_dbg(uhci_dev(uhci), "%s: failed with status %x\n",
-				__FUNCTION__, status);
-
-		if (debug > 1 && errbuf) {
-			/* Print the chain for debugging purposes */
-			uhci_show_qh(urbp->qh, errbuf, ERRBUF_LEN, 0);
-			lprintk(errbuf);
-		}
-	}
-err:
-
-	/* Note that the queue has stopped and save the next toggle value */
-	urbp->qh->element = UHCI_PTR_TERM;
-	urbp->qh->is_stopped = 1;
-	urbp->qh->needs_fixup = 1;
-	urbp->qh->initial_toggle = uhci_toggle(td_token(td)) ^
-			(ret == -EREMOTEIO);
-	return ret;
-}
-
 static inline int uhci_submit_bulk(struct uhci_hcd *uhci, struct urb *urb,
 		struct uhci_qh *qh)
 {
@@ -954,22 +820,163 @@ static inline int uhci_submit_bulk(struct uhci_hcd *uhci, struct urb *urb,
 	qh->skel = uhci->skel_bulk_qh;
 	ret = uhci_submit_common(uhci, urb, qh);
 	if (ret == 0)
-		uhci_inc_fsbr(uhci, urb);
+		uhci_add_fsbr(uhci, urb);
 	return ret;
 }
 
-static inline int uhci_submit_interrupt(struct uhci_hcd *uhci, struct urb *urb,
+static int uhci_submit_interrupt(struct uhci_hcd *uhci, struct urb *urb,
 		struct uhci_qh *qh)
 {
+	int exponent;
+
 	/* USB 1.1 interrupt transfers only involve one packet per interval.
 	 * Drivers can submit URBs of any length, but longer ones will need
 	 * multiple intervals to complete.
 	 */
-	qh->skel = uhci->skelqh[__interval_to_skel(urb->interval)];
+
+	/* Figure out which power-of-two queue to use */
+	for (exponent = 7; exponent >= 0; --exponent) {
+		if ((1 << exponent) <= urb->interval)
+			break;
+	}
+	if (exponent < 0)
+		return -EINVAL;
+	urb->interval = 1 << exponent;
+
+	if (qh->period == 0)
+		qh->skel = uhci->skelqh[UHCI_SKEL_INDEX(exponent)];
+	else if (qh->period != urb->interval)
+		return -EINVAL;		/* Can't change the period */
+
 	return uhci_submit_common(uhci, urb, qh);
 }
 
 /*
+ * Fix up the data structures following a short transfer
+ */
+static int uhci_fixup_short_transfer(struct uhci_hcd *uhci,
+		struct uhci_qh *qh, struct urb_priv *urbp)
+{
+	struct uhci_td *td;
+	struct list_head *tmp;
+	int ret;
+
+	td = list_entry(urbp->td_list.prev, struct uhci_td, list);
+	if (qh->type == USB_ENDPOINT_XFER_CONTROL) {
+
+		/* When a control transfer is short, we have to restart
+		 * the queue at the status stage transaction, which is
+		 * the last TD. */
+		WARN_ON(list_empty(&urbp->td_list));
+		qh->element = cpu_to_le32(td->dma_handle);
+		tmp = td->list.prev;
+		ret = -EINPROGRESS;
+
+	} else {
+
+		/* When a bulk/interrupt transfer is short, we have to
+		 * fix up the toggles of the following URBs on the queue
+		 * before restarting the queue at the next URB. */
+		qh->initial_toggle = uhci_toggle(td_token(qh->post_td)) ^ 1;
+		uhci_fixup_toggles(qh, 1);
+
+		if (list_empty(&urbp->td_list))
+			td = qh->post_td;
+		qh->element = td->link;
+		tmp = urbp->td_list.prev;
+		ret = 0;
+	}
+
+	/* Remove all the TDs we skipped over, from tmp back to the start */
+	while (tmp != &urbp->td_list) {
+		td = list_entry(tmp, struct uhci_td, list);
+		tmp = tmp->prev;
+
+		uhci_remove_td_from_urbp(td);
+		uhci_free_td(uhci, td);
+	}
+	return ret;
+}
+
+/*
+ * Common result for control, bulk, and interrupt
+ */
+static int uhci_result_common(struct uhci_hcd *uhci, struct urb *urb)
+{
+	struct urb_priv *urbp = urb->hcpriv;
+	struct uhci_qh *qh = urbp->qh;
+	struct uhci_td *td, *tmp;
+	unsigned status;
+	int ret = 0;
+
+	list_for_each_entry_safe(td, tmp, &urbp->td_list, list) {
+		unsigned int ctrlstat;
+		int len;
+
+		ctrlstat = td_status(td);
+		status = uhci_status_bits(ctrlstat);
+		if (status & TD_CTRL_ACTIVE)
+			return -EINPROGRESS;
+
+		len = uhci_actual_length(ctrlstat);
+		urb->actual_length += len;
+
+		if (status) {
+			ret = uhci_map_status(status,
+					uhci_packetout(td_token(td)));
+			if ((debug == 1 && ret != -EPIPE) || debug > 1) {
+				/* Some debugging code */
+				dev_dbg(&urb->dev->dev,
+						"%s: failed with status %x\n",
+						__FUNCTION__, status);
+
+				if (debug > 1 && errbuf) {
+					/* Print the chain for debugging */
+					uhci_show_qh(urbp->qh, errbuf,
+							ERRBUF_LEN, 0);
+					lprintk(errbuf);
+				}
+			}
+
+		} else if (len < uhci_expected_length(td_token(td))) {
+
+			/* We received a short packet */
+			if (urb->transfer_flags & URB_SHORT_NOT_OK)
+				ret = -EREMOTEIO;
+			else if (ctrlstat & TD_CTRL_SPD)
+				ret = 1;
+		}
+
+		uhci_remove_td_from_urbp(td);
+		if (qh->post_td)
+			uhci_free_td(uhci, qh->post_td);
+		qh->post_td = td;
+
+		if (ret != 0)
+			goto err;
+	}
+	return ret;
+
+err:
+	if (ret < 0) {
+		/* In case a control transfer gets an error
+		 * during the setup stage */
+		urb->actual_length = max(urb->actual_length, 0);
+
+		/* Note that the queue has stopped and save
+		 * the next toggle value */
+		qh->element = UHCI_PTR_TERM;
+		qh->is_stopped = 1;
+		qh->needs_fixup = (qh->type != USB_ENDPOINT_XFER_CONTROL);
+		qh->initial_toggle = uhci_toggle(td_token(td)) ^
+				(ret == -EREMOTEIO);
+
+	} else		/* Short packet received */
+		ret = uhci_fixup_short_transfer(uhci, qh, urbp);
+	return ret;
+}
+
+/*
  * Isochronous transfers
  */
 static int uhci_submit_isochronous(struct uhci_hcd *uhci, struct urb *urb,
@@ -980,38 +987,57 @@ static int uhci_submit_isochronous(struct uhci_hcd *uhci, struct urb *urb,
 	unsigned long destination, status;
 	struct urb_priv *urbp = (struct urb_priv *) urb->hcpriv;
 
-	if (urb->number_of_packets > 900)	/* 900? Why? */
+	/* Values must not be too big (could overflow below) */
+	if (urb->interval >= UHCI_NUMFRAMES ||
+			urb->number_of_packets >= UHCI_NUMFRAMES)
 		return -EFBIG;
 
-	status = TD_CTRL_ACTIVE | TD_CTRL_IOS;
-	destination = (urb->pipe & PIPE_DEVEP_MASK) | usb_packetid(urb->pipe);
-
-	/* Figure out the starting frame number */
-	if (urb->transfer_flags & URB_ISO_ASAP) {
-		if (list_empty(&qh->queue)) {
+	/* Check the period and figure out the starting frame number */
+	if (qh->period == 0) {
+		if (urb->transfer_flags & URB_ISO_ASAP) {
 			uhci_get_current_frame_number(uhci);
-			urb->start_frame = (uhci->frame_number + 10);
+			urb->start_frame = uhci->frame_number + 10;
+		} else {
+			i = urb->start_frame - uhci->last_iso_frame;
+			if (i <= 0 || i >= UHCI_NUMFRAMES)
+				return -EINVAL;
+		}
+	} else if (qh->period != urb->interval) {
+		return -EINVAL;		/* Can't change the period */
 
-		} else {		/* Go right after the last one */
-			struct urb *last_urb;
+	} else {	/* Pick up where the last URB leaves off */
+		if (list_empty(&qh->queue)) {
+			frame = qh->iso_frame;
+		} else {
+			struct urb *lurb;
 
-			last_urb = list_entry(qh->queue.prev,
+			lurb = list_entry(qh->queue.prev,
 					struct urb_priv, node)->urb;
-			urb->start_frame = (last_urb->start_frame +
-					last_urb->number_of_packets *
-					last_urb->interval);
+			frame = lurb->start_frame +
+					lurb->number_of_packets *
+					lurb->interval;
 		}
-	} else {
-		/* FIXME: Sanity check */
+		if (urb->transfer_flags & URB_ISO_ASAP)
+			urb->start_frame = frame;
+		else if (urb->start_frame != frame)
+			return -EINVAL;
 	}
-	urb->start_frame &= (UHCI_NUMFRAMES - 1);
+
+	/* Make sure we won't have to go too far into the future */
+	if (uhci_frame_before_eq(uhci->last_iso_frame + UHCI_NUMFRAMES,
+			urb->start_frame + urb->number_of_packets *
+				urb->interval))
+		return -EFBIG;
+
+	status = TD_CTRL_ACTIVE | TD_CTRL_IOS;
+	destination = (urb->pipe & PIPE_DEVEP_MASK) | usb_packetid(urb->pipe);
 
 	for (i = 0; i < urb->number_of_packets; i++) {
 		td = uhci_alloc_td(uhci);
 		if (!td)
 			return -ENOMEM;
 
-		uhci_add_td_to_urb(urb, td);
+		uhci_add_td_to_urbp(td, urbp);
 		uhci_fill_td(td, status, destination |
 				uhci_explen(urb->iso_frame_desc[i].length),
 				urb->transfer_dma +
@@ -1022,12 +1048,19 @@ static int uhci_submit_isochronous(struct uhci_hcd *uhci, struct urb *urb,
 	td->status |= __constant_cpu_to_le32(TD_CTRL_IOC);
 
 	qh->skel = uhci->skel_iso_qh;
+	qh->period = urb->interval;
 
 	/* Add the TDs to the frame list */
 	frame = urb->start_frame;
 	list_for_each_entry(td, &urbp->td_list, list) {
 		uhci_insert_td_in_frame_list(uhci, td, frame);
-		frame += urb->interval;
+		frame += qh->period;
+	}
+
+	if (list_empty(&qh->queue)) {
+		qh->iso_packet_desc = &urb->iso_frame_desc[0];
+		qh->iso_frame = urb->start_frame;
+		qh->iso_status = 0;
 	}
 
 	return 0;
@@ -1035,37 +1068,44 @@ static int uhci_submit_isochronous(struct uhci_hcd *uhci, struct urb *urb,
 
 static int uhci_result_isochronous(struct uhci_hcd *uhci, struct urb *urb)
 {
-	struct uhci_td *td;
-	struct urb_priv *urbp = (struct urb_priv *)urb->hcpriv;
-	int status;
-	int i, ret = 0;
-
-	urb->actual_length = urb->error_count = 0;
+	struct uhci_td *td, *tmp;
+	struct urb_priv *urbp = urb->hcpriv;
+	struct uhci_qh *qh = urbp->qh;
 
-	i = 0;
-	list_for_each_entry(td, &urbp->td_list, list) {
+	list_for_each_entry_safe(td, tmp, &urbp->td_list, list) {
+		unsigned int ctrlstat;
+		int status;
 		int actlength;
-		unsigned int ctrlstat = td_status(td);
 
-		if (ctrlstat & TD_CTRL_ACTIVE)
+		if (uhci_frame_before_eq(uhci->cur_iso_frame, qh->iso_frame))
 			return -EINPROGRESS;
 
-		actlength = uhci_actual_length(ctrlstat);
-		urb->iso_frame_desc[i].actual_length = actlength;
-		urb->actual_length += actlength;
+		uhci_remove_tds_from_frame(uhci, qh->iso_frame);
+
+		ctrlstat = td_status(td);
+		if (ctrlstat & TD_CTRL_ACTIVE) {
+			status = -EXDEV;	/* TD was added too late? */
+		} else {
+			status = uhci_map_status(uhci_status_bits(ctrlstat),
+					usb_pipeout(urb->pipe));
+			actlength = uhci_actual_length(ctrlstat);
+
+			urb->actual_length += actlength;
+			qh->iso_packet_desc->actual_length = actlength;
+			qh->iso_packet_desc->status = status;
+		}
 
-		status = uhci_map_status(uhci_status_bits(ctrlstat),
-				usb_pipeout(urb->pipe));
-		urb->iso_frame_desc[i].status = status;
 		if (status) {
 			urb->error_count++;
-			ret = status;
+			qh->iso_status = status;
 		}
 
-		i++;
+		uhci_remove_td_from_urbp(td);
+		uhci_free_td(uhci, td);
+		qh->iso_frame += qh->period;
+		++qh->iso_packet_desc;
 	}
-
-	return ret;
+	return qh->iso_status;
 }
 
 static int uhci_urb_enqueue(struct usb_hcd *hcd,
@@ -1099,14 +1139,14 @@ static int uhci_urb_enqueue(struct usb_hcd *hcd,
 	}
 	urbp->qh = qh;
 
-	switch (usb_pipetype(urb->pipe)) {
-	case PIPE_CONTROL:
+	switch (qh->type) {
+	case USB_ENDPOINT_XFER_CONTROL:
 		ret = uhci_submit_control(uhci, urb, qh);
 		break;
-	case PIPE_BULK:
+	case USB_ENDPOINT_XFER_BULK:
 		ret = uhci_submit_bulk(uhci, urb, qh);
 		break;
-	case PIPE_INTERRUPT:
+	case USB_ENDPOINT_XFER_INT:
 		if (list_empty(&qh->queue)) {
 			bustime = usb_check_bandwidth(urb->dev, urb);
 			if (bustime < 0)
@@ -1125,7 +1165,8 @@ static int uhci_urb_enqueue(struct usb_hcd *hcd,
 			ret = uhci_submit_interrupt(uhci, urb, qh);
 		}
 		break;
-	case PIPE_ISOCHRONOUS:
+	case USB_ENDPOINT_XFER_ISOC:
+		urb->error_count = 0;
 		bustime = usb_check_bandwidth(urb->dev, urb);
 		if (bustime < 0) {
 			ret = bustime;
@@ -1146,9 +1187,12 @@ static int uhci_urb_enqueue(struct usb_hcd *hcd,
 
 	/* If the new URB is the first and only one on this QH then either
 	 * the QH is new and idle or else it's unlinked and waiting to
-	 * become idle, so we can activate it right away. */
-	if (qh->queue.next == &urbp->node)
+	 * become idle, so we can activate it right away.  But only if the
+	 * queue isn't stopped. */
+	if (qh->queue.next == &urbp->node && !qh->is_stopped) {
 		uhci_activate_qh(uhci, qh);
+		uhci_urbp_wants_fsbr(uhci, urbp);
+	}
 	goto done;
 
 err_submit_failed:
@@ -1168,16 +1212,26 @@ static int uhci_urb_dequeue(struct usb_hcd *hcd, struct urb *urb)
 	struct uhci_hcd *uhci = hcd_to_uhci(hcd);
 	unsigned long flags;
 	struct urb_priv *urbp;
+	struct uhci_qh *qh;
 
 	spin_lock_irqsave(&uhci->lock, flags);
 	urbp = urb->hcpriv;
 	if (!urbp)			/* URB was never linked! */
 		goto done;
+	qh = urbp->qh;
 
 	/* Remove Isochronous TDs from the frame list ASAP */
-	if (usb_pipetype(urb->pipe) == PIPE_ISOCHRONOUS)
+	if (qh->type == USB_ENDPOINT_XFER_ISOC) {
 		uhci_unlink_isochronous_tds(uhci, urb);
-	uhci_unlink_qh(uhci, urbp->qh);
+		mb();
+
+		/* If the URB has already started, update the QH unlink time */
+		uhci_get_current_frame_number(uhci);
+		if (uhci_frame_before_eq(urb->start_frame, uhci->frame_number))
+			qh->unlink_frame = uhci->frame_number;
+	}
+
+	uhci_unlink_qh(uhci, qh);
 
 done:
 	spin_unlock_irqrestore(&uhci->lock, flags);
@@ -1194,22 +1248,17 @@ __acquires(uhci->lock)
 {
 	struct urb_priv *urbp = (struct urb_priv *) urb->hcpriv;
 
-	/* Isochronous TDs get unlinked directly from the frame list */
-	if (usb_pipetype(urb->pipe) == PIPE_ISOCHRONOUS)
-		uhci_unlink_isochronous_tds(uhci, urb);
-
-	/* If the URB isn't first on its queue, adjust the link pointer
-	 * of the last TD in the previous URB. */
-	else if (qh->queue.next != &urbp->node) {
-		struct urb_priv *purbp;
-		struct uhci_td *ptd, *ltd;
-
-		purbp = list_entry(urbp->node.prev, struct urb_priv, node);
-		ptd = list_entry(purbp->td_list.prev, struct uhci_td,
-				list);
-		ltd = list_entry(urbp->td_list.prev, struct uhci_td,
-				list);
-		ptd->link = ltd->link;
+	/* When giving back the first URB in an Isochronous queue,
+	 * reinitialize the QH's iso-related members for the next URB. */
+	if (qh->type == USB_ENDPOINT_XFER_ISOC &&
+			urbp->node.prev == &qh->queue &&
+			urbp->node.next != &qh->queue) {
+		struct urb *nurb = list_entry(urbp->node.next,
+				struct urb_priv, node)->urb;
+
+		qh->iso_packet_desc = &nurb->iso_frame_desc[0];
+		qh->iso_frame = nurb->start_frame;
+		qh->iso_status = 0;
 	}
 
 	/* Take the URB off the QH's queue.  If the queue is now empty,
@@ -1221,16 +1270,15 @@ __acquires(uhci->lock)
 		qh->needs_fixup = 0;
 	}
 
-	uhci_dec_fsbr(uhci, urb);	/* Safe since it checks */
 	uhci_free_urb_priv(uhci, urbp);
 
-	switch (usb_pipetype(urb->pipe)) {
-	case PIPE_ISOCHRONOUS:
+	switch (qh->type) {
+	case USB_ENDPOINT_XFER_ISOC:
 		/* Release bandwidth for Interrupt or Isoc. transfers */
 		if (urb->bandwidth)
 			usb_release_bandwidth(urb->dev, urb, 1);
 		break;
-	case PIPE_INTERRUPT:
+	case USB_ENDPOINT_XFER_INT:
 		/* Release bandwidth for Interrupt or Isoc. transfers */
 		/* Make sure we don't release if we have a queued URB */
 		if (list_empty(&qh->queue) && urb->bandwidth)
@@ -1252,6 +1300,7 @@ __acquires(uhci->lock)
 		uhci_unlink_qh(uhci, qh);
 
 		/* Bandwidth stuff not yet implemented */
+		qh->period = 0;
 	}
 }
 
@@ -1273,17 +1322,10 @@ static void uhci_scan_qh(struct uhci_hcd *uhci, struct uhci_qh *qh,
 		urbp = list_entry(qh->queue.next, struct urb_priv, node);
 		urb = urbp->urb;
 
-		switch (usb_pipetype(urb->pipe)) {
-		case PIPE_CONTROL:
-			status = uhci_result_control(uhci, urb);
-			break;
-		case PIPE_ISOCHRONOUS:
+		if (qh->type == USB_ENDPOINT_XFER_ISOC)
 			status = uhci_result_isochronous(uhci, urb);
-			break;
-		default:	/* PIPE_BULK or PIPE_INTERRUPT */
+		else
 			status = uhci_result_common(uhci, urb);
-			break;
-		}
 		if (status == -EINPROGRESS)
 			break;
 
@@ -1291,31 +1333,43 @@ static void uhci_scan_qh(struct uhci_hcd *uhci, struct uhci_qh *qh,
 		if (urb->status == -EINPROGRESS)	/* Not dequeued */
 			urb->status = status;
 		else
-			status = -ECONNRESET;
+			status = ECONNRESET;		/* Not -ECONNRESET */
 		spin_unlock(&urb->lock);
 
 		/* Dequeued but completed URBs can't be given back unless
 		 * the QH is stopped or has finished unlinking. */
-		if (status == -ECONNRESET &&
-				!(qh->is_stopped || QH_FINISHED_UNLINKING(qh)))
-			return;
+		if (status == ECONNRESET) {
+			if (QH_FINISHED_UNLINKING(qh))
+				qh->is_stopped = 1;
+			else if (!qh->is_stopped)
+				return;
+		}
 
 		uhci_giveback_urb(uhci, qh, urb, regs);
-		if (qh->is_stopped)
+		if (status < 0)
 			break;
 	}
 
 	/* If the QH is neither stopped nor finished unlinking (normal case),
 	 * our work here is done. */
- restart:
-	if (!(qh->is_stopped || QH_FINISHED_UNLINKING(qh)))
+	if (QH_FINISHED_UNLINKING(qh))
+		qh->is_stopped = 1;
+	else if (!qh->is_stopped)
 		return;
 
 	/* Otherwise give back each of the dequeued URBs */
+restart:
 	list_for_each_entry(urbp, &qh->queue, node) {
 		urb = urbp->urb;
 		if (urb->status != -EINPROGRESS) {
-			uhci_save_toggle(qh, urb);
+
+			/* Fix up the TD links and save the toggles for
+			 * non-Isochronous queues.  For Isochronous queues,
+			 * test for too-recent dequeues. */
+			if (!uhci_cleanup_queue(uhci, qh, urb)) {
+				qh->is_stopped = 0;
+				return;
+			}
 			uhci_giveback_urb(uhci, qh, urb, regs);
 			goto restart;
 		}
@@ -1327,6 +1381,18 @@ static void uhci_scan_qh(struct uhci_hcd *uhci, struct uhci_qh *qh,
 	if (!list_empty(&qh->queue)) {
 		if (qh->needs_fixup)
 			uhci_fixup_toggles(qh, 0);
+
+		/* If the first URB on the queue wants FSBR but its time
+		 * limit has expired, set the next TD to interrupt on
+		 * completion before reactivating the QH. */
+		urbp = list_entry(qh->queue.next, struct urb_priv, node);
+		if (urbp->fsbr && qh->wait_expired) {
+			struct uhci_td *td = list_entry(urbp->td_list.next,
+					struct uhci_td, list);
+
+			td->status |= __cpu_to_le32(TD_CTRL_IOC);
+		}
+
 		uhci_activate_qh(uhci, qh);
 	}
 
@@ -1336,15 +1402,84 @@ static void uhci_scan_qh(struct uhci_hcd *uhci, struct uhci_qh *qh,
 		uhci_make_qh_idle(uhci, qh);
 }
 
-static void uhci_free_pending_tds(struct uhci_hcd *uhci)
+/*
+ * Check for queues that have made some forward progress.
+ * Returns 0 if the queue is not Isochronous, is ACTIVE, and
+ * has not advanced since last examined; 1 otherwise.
+ *
+ * Early Intel controllers have a bug which causes qh->element sometimes
+ * not to advance when a TD completes successfully.  The queue remains
+ * stuck on the inactive completed TD.  We detect such cases and advance
+ * the element pointer by hand.
+ */
+static int uhci_advance_check(struct uhci_hcd *uhci, struct uhci_qh *qh)
 {
-	struct uhci_td *td, *tmp;
+	struct urb_priv *urbp = NULL;
+	struct uhci_td *td;
+	int ret = 1;
+	unsigned status;
 
-	list_for_each_entry_safe(td, tmp, &uhci->td_remove_list, remove_list) {
-		list_del_init(&td->remove_list);
+	if (qh->type == USB_ENDPOINT_XFER_ISOC)
+		goto done;
 
-		uhci_free_td(uhci, td);
+	/* Treat an UNLINKING queue as though it hasn't advanced.
+	 * This is okay because reactivation will treat it as though
+	 * it has advanced, and if it is going to become IDLE then
+	 * this doesn't matter anyway.  Furthermore it's possible
+	 * for an UNLINKING queue not to have any URBs at all, or
+	 * for its first URB not to have any TDs (if it was dequeued
+	 * just as it completed).  So it's not easy in any case to
+	 * test whether such queues have advanced. */
+	if (qh->state != QH_STATE_ACTIVE) {
+		urbp = NULL;
+		status = 0;
+
+	} else {
+		urbp = list_entry(qh->queue.next, struct urb_priv, node);
+		td = list_entry(urbp->td_list.next, struct uhci_td, list);
+		status = td_status(td);
+		if (!(status & TD_CTRL_ACTIVE)) {
+
+			/* We're okay, the queue has advanced */
+			qh->wait_expired = 0;
+			qh->advance_jiffies = jiffies;
+			goto done;
+		}
+		ret = 0;
+	}
+
+	/* The queue hasn't advanced; check for timeout */
+	if (qh->wait_expired)
+		goto done;
+
+	if (time_after(jiffies, qh->advance_jiffies + QH_WAIT_TIMEOUT)) {
+
+		/* Detect the Intel bug and work around it */
+		if (qh->post_td && qh_element(qh) ==
+				cpu_to_le32(qh->post_td->dma_handle)) {
+			qh->element = qh->post_td->link;
+			qh->advance_jiffies = jiffies;
+			ret = 1;
+			goto done;
+		}
+
+		qh->wait_expired = 1;
+
+		/* If the current URB wants FSBR, unlink it temporarily
+		 * so that we can safely set the next TD to interrupt on
+		 * completion.  That way we'll know as soon as the queue
+		 * starts moving again. */
+		if (urbp && urbp->fsbr && !(status & TD_CTRL_IOC))
+			uhci_unlink_qh(uhci, qh);
+
+	} else {
+		/* Unmoving but not-yet-expired queues keep FSBR alive */
+		if (urbp)
+			uhci_urbp_wants_fsbr(uhci, urbp);
 	}
+
+done:
+	return ret;
 }
 
 /*
@@ -1361,14 +1496,13 @@ static void uhci_scan_schedule(struct uhci_hcd *uhci, struct pt_regs *regs)
 		return;
 	}
 	uhci->scan_in_progress = 1;
- rescan:
+rescan:
 	uhci->need_rescan = 0;
+	uhci->fsbr_is_wanted = 0;
 
 	uhci_clear_next_interrupt(uhci);
 	uhci_get_current_frame_number(uhci);
-
-	if (uhci->frame_number + uhci->is_stopped != uhci->td_remove_age)
-		uhci_free_pending_tds(uhci);
+	uhci->cur_iso_frame = uhci->frame_number;
 
 	/* Go through all the QH queues and process the URBs in each one */
 	for (i = 0; i < UHCI_NUM_SKELQH - 1; ++i) {
@@ -1377,33 +1511,30 @@ static void uhci_scan_schedule(struct uhci_hcd *uhci, struct pt_regs *regs)
 		while ((qh = uhci->next_qh) != uhci->skelqh[i]) {
 			uhci->next_qh = list_entry(qh->node.next,
 					struct uhci_qh, node);
-			uhci_scan_qh(uhci, qh, regs);
+
+			if (uhci_advance_check(uhci, qh)) {
+				uhci_scan_qh(uhci, qh, regs);
+				if (qh->state == QH_STATE_ACTIVE) {
+					uhci_urbp_wants_fsbr(uhci,
+	list_entry(qh->queue.next, struct urb_priv, node));
+				}
+			}
 		}
 	}
 
+	uhci->last_iso_frame = uhci->cur_iso_frame;
 	if (uhci->need_rescan)
 		goto rescan;
 	uhci->scan_in_progress = 0;
 
-	/* If the controller is stopped, we can finish these off right now */
-	if (uhci->is_stopped)
-		uhci_free_pending_tds(uhci);
+	if (uhci->fsbr_is_on && !uhci->fsbr_is_wanted &&
+			!uhci->fsbr_expiring) {
+		uhci->fsbr_expiring = 1;
+		mod_timer(&uhci->fsbr_timer, jiffies + FSBR_OFF_DELAY);
+	}
 
-	if (list_empty(&uhci->td_remove_list) &&
-			list_empty(&uhci->skel_unlink_qh->node))
+	if (list_empty(&uhci->skel_unlink_qh->node))
 		uhci_clear_next_interrupt(uhci);
 	else
 		uhci_set_next_interrupt(uhci);
 }
-
-static void check_fsbr(struct uhci_hcd *uhci)
-{
-	/* For now, don't scan URBs for FSBR timeouts.
-	 * Add it back in later... */
-
-	/* Really disable FSBR */
-	if (!uhci->fsbr && uhci->fsbrtimeout && time_after_eq(jiffies, uhci->fsbrtimeout)) {
-		uhci->fsbrtimeout = 0;
-		uhci->skel_term_qh->link = UHCI_PTR_TERM;
-	}
-}
diff --git a/drivers/usb/image/microtek.c b/drivers/usb/image/microtek.c
index 2a0e18a4874..b2bafc37c41 100644
--- a/drivers/usb/image/microtek.c
+++ b/drivers/usb/image/microtek.c
@@ -513,7 +513,7 @@ static void mts_do_sg (struct urb* transfer, struct pt_regs *regs)
 		mts_transfer_cleanup(transfer);
         }
 
-	sg = context->srb->buffer;
+	sg = context->srb->request_buffer;
 	context->fragment++;
 	mts_int_submit_urb(transfer,
 			   context->data_pipe,
@@ -549,19 +549,19 @@ mts_build_transfer_context( Scsi_Cmnd *srb, struct mts_desc* desc )
 	desc->context.fragment = 0;
 
 	if (!srb->use_sg) {
-		if ( !srb->bufflen ){
+		if ( !srb->request_bufflen ){
 			desc->context.data = NULL;
 			desc->context.data_length = 0;
 			return;
 		} else {
-			desc->context.data = srb->buffer;
-			desc->context.data_length = srb->bufflen;
+			desc->context.data = srb->request_buffer;
+			desc->context.data_length = srb->request_bufflen;
 			MTS_DEBUG("length = %d or %d\n",
 				  srb->request_bufflen, srb->bufflen);
 		}
 	} else {
 		MTS_DEBUG("Using scatter/gather\n");
-		sg = srb->buffer;
+		sg = srb->request_buffer;
 		desc->context.data = page_address(sg[0].page) + sg[0].offset;
 		desc->context.data_length = sg[0].length;
 	}
diff --git a/drivers/usb/input/acecad.c b/drivers/usb/input/acecad.c
index df29b8078b5..18c10e150ef 100644
--- a/drivers/usb/input/acecad.c
+++ b/drivers/usb/input/acecad.c
@@ -27,11 +27,9 @@
 
 #include <linux/kernel.h>
 #include <linux/slab.h>
-#include <linux/input.h>
 #include <linux/module.h>
 #include <linux/init.h>
-#include <linux/usb.h>
-#include <linux/usb_input.h>
+#include <linux/usb/input.h>
 
 /*
  * Version Information
diff --git a/drivers/usb/input/aiptek.c b/drivers/usb/input/aiptek.c
index a6693b0d1c4..b138dae2b05 100644
--- a/drivers/usb/input/aiptek.c
+++ b/drivers/usb/input/aiptek.c
@@ -73,11 +73,9 @@
 #include <linux/jiffies.h>
 #include <linux/kernel.h>
 #include <linux/slab.h>
-#include <linux/input.h>
 #include <linux/module.h>
 #include <linux/init.h>
-#include <linux/usb.h>
-#include <linux/usb_input.h>
+#include <linux/usb/input.h>
 #include <linux/sched.h>
 #include <asm/uaccess.h>
 #include <asm/unaligned.h>
diff --git a/drivers/usb/input/appletouch.c b/drivers/usb/input/appletouch.c
index c222ed13dea..36855062eac 100644
--- a/drivers/usb/input/appletouch.c
+++ b/drivers/usb/input/appletouch.c
@@ -1,5 +1,5 @@
 /*
- * Apple USB Touchpad (for post-February 2005 PowerBooks) driver
+ * Apple USB Touchpad (for post-February 2005 PowerBooks and MacBooks) driver
  *
  * Copyright (C) 2001-2004 Greg Kroah-Hartman (greg@kroah.com)
  * Copyright (C) 2005      Johannes Berg (johannes@sipsolutions.net)
@@ -7,6 +7,7 @@
  * Copyright (C) 2005      Frank Arnold (frank@scirocco-5v-turbo.de)
  * Copyright (C) 2005      Peter Osterlund (petero2@telia.com)
  * Copyright (C) 2005      Michael Hanselmann (linux-kernel@hansmi.ch)
+ * Copyright (C) 2006      Nicolas Boichat (nicolas@boichat.ch)
  *
  * Thanks to Alex Harper <basilisk@foobox.net> for his inputs.
  *
@@ -32,9 +33,7 @@
 #include <linux/init.h>
 #include <linux/slab.h>
 #include <linux/module.h>
-#include <linux/usb.h>
-#include <linux/input.h>
-#include <linux/usb_input.h>
+#include <linux/usb/input.h>
 
 /* Apple has powerbooks which have the keyboard with different Product IDs */
 #define APPLE_VENDOR_ID		0x05AC
@@ -44,6 +43,11 @@
 #define GEYSER_ISO_PRODUCT_ID	0x0215
 #define GEYSER_JIS_PRODUCT_ID	0x0216
 
+/* MacBook devices */
+#define GEYSER3_ANSI_PRODUCT_ID	0x0217
+#define GEYSER3_ISO_PRODUCT_ID	0x0218
+#define GEYSER3_JIS_PRODUCT_ID	0x0219
+
 #define ATP_DEVICE(prod)					\
 	.match_flags = USB_DEVICE_ID_MATCH_DEVICE |		\
 		       USB_DEVICE_ID_MATCH_INT_CLASS |		\
@@ -65,6 +69,10 @@ static struct usb_device_id atp_table [] = {
 	{ ATP_DEVICE(GEYSER_ISO_PRODUCT_ID) },
 	{ ATP_DEVICE(GEYSER_JIS_PRODUCT_ID) },
 
+	{ ATP_DEVICE(GEYSER3_ANSI_PRODUCT_ID) },
+	{ ATP_DEVICE(GEYSER3_ISO_PRODUCT_ID) },
+	{ ATP_DEVICE(GEYSER3_JIS_PRODUCT_ID) },
+
 	/* Terminating entry */
 	{ }
 };
@@ -101,6 +109,13 @@ MODULE_DEVICE_TABLE (usb, atp_table);
  */
 #define ATP_THRESHOLD	 5
 
+/* MacBook Pro (Geyser 3) initialization constants */
+#define ATP_GEYSER3_MODE_READ_REQUEST_ID 1
+#define ATP_GEYSER3_MODE_WRITE_REQUEST_ID 9
+#define ATP_GEYSER3_MODE_REQUEST_VALUE 0x300
+#define ATP_GEYSER3_MODE_REQUEST_INDEX 0
+#define ATP_GEYSER3_MODE_VENDOR_VALUE 0x04
+
 /* Structure to hold all of our device specific stuff */
 struct atp {
 	char			phys[64];
@@ -147,13 +162,22 @@ MODULE_PARM_DESC(debug, "Activate debugging output");
 /* Checks if the device a Geyser 2 (ANSI, ISO, JIS) */
 static inline int atp_is_geyser_2(struct atp *dev)
 {
-	int16_t productId = le16_to_cpu(dev->udev->descriptor.idProduct);
+	u16 productId = le16_to_cpu(dev->udev->descriptor.idProduct);
 
 	return (productId == GEYSER_ANSI_PRODUCT_ID) ||
 		(productId == GEYSER_ISO_PRODUCT_ID) ||
 		(productId == GEYSER_JIS_PRODUCT_ID);
 }
 
+static inline int atp_is_geyser_3(struct atp *dev)
+{
+	u16 productId = le16_to_cpu(dev->udev->descriptor.idProduct);
+
+	return (productId == GEYSER3_ANSI_PRODUCT_ID) ||
+		(productId == GEYSER3_ISO_PRODUCT_ID) ||
+		(productId == GEYSER3_JIS_PRODUCT_ID);
+}
+
 static int atp_calculate_abs(int *xy_sensors, int nb_sensors, int fact,
 			     int *z, int *fingers)
 {
@@ -219,12 +243,33 @@ static void atp_complete(struct urb* urb, struct pt_regs* regs)
 
 	/* drop incomplete datasets */
 	if (dev->urb->actual_length != dev->datalen) {
-		dprintk("appletouch: incomplete data package.\n");
+		dprintk("appletouch: incomplete data package"
+			" (first byte: %d, length: %d).\n",
+			dev->data[0], dev->urb->actual_length);
 		goto exit;
 	}
 
 	/* reorder the sensors values */
-	if (atp_is_geyser_2(dev)) {
+	if (atp_is_geyser_3(dev)) {
+		memset(dev->xy_cur, 0, sizeof(dev->xy_cur));
+
+		/*
+		 * The values are laid out like this:
+		 * -, Y1, Y2, -, Y3, Y4, -, ..., -, X1, X2, -, X3, X4, ...
+		 * '-' is an unused value.
+		 */
+
+		/* read X values */
+		for (i = 0, j = 19; i < 20; i += 2, j += 3) {
+			dev->xy_cur[i] = dev->data[j + 1];
+			dev->xy_cur[i + 1] = dev->data[j + 2];
+		}
+		/* read Y values */
+		for (i = 0, j = 1; i < 9; i += 2, j += 3) {
+			dev->xy_cur[ATP_XSENSORS + i] = dev->data[j + 1];
+			dev->xy_cur[ATP_XSENSORS + i + 1] = dev->data[j + 2];
+		}
+	} else if (atp_is_geyser_2(dev)) {
 		memset(dev->xy_cur, 0, sizeof(dev->xy_cur));
 
 		/*
@@ -267,6 +312,9 @@ static void atp_complete(struct urb* urb, struct pt_regs* regs)
 		dev->x_old = dev->y_old = -1;
 		memcpy(dev->xy_old, dev->xy_cur, sizeof(dev->xy_old));
 
+		if (atp_is_geyser_3(dev)) /* No 17" Macbooks (yet) */
+			goto exit;
+
 		/* 17" Powerbooks have extra X sensors */
 		for (i = (atp_is_geyser_2(dev)?15:16); i < ATP_XSENSORS; i++) {
 			if (!dev->xy_cur[i]) continue;
@@ -414,7 +462,50 @@ static int atp_probe(struct usb_interface *iface, const struct usb_device_id *id
 	dev->udev = udev;
 	dev->input = input_dev;
 	dev->overflowwarn = 0;
-	dev->datalen = (atp_is_geyser_2(dev)?64:81);
+	if (atp_is_geyser_3(dev))
+		dev->datalen = 64;
+	else if (atp_is_geyser_2(dev))
+		dev->datalen = 64;
+	else
+		dev->datalen = 81;
+
+	if (atp_is_geyser_3(dev)) {
+		/*
+		 * By default Geyser 3 device sends standard USB HID mouse
+		 * packets (Report ID 2). This code changes device mode, so it
+		 * sends raw sensor reports (Report ID 5).
+		 */
+		char data[8];
+		int size;
+
+		size = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0),
+			ATP_GEYSER3_MODE_READ_REQUEST_ID,
+			USB_DIR_IN | USB_TYPE_CLASS | USB_RECIP_INTERFACE,
+			ATP_GEYSER3_MODE_REQUEST_VALUE,
+			ATP_GEYSER3_MODE_REQUEST_INDEX, &data, 8, 5000);
+
+		if (size != 8) {
+			err("Could not do mode read request from device"
+							" (Geyser 3 mode)");
+			goto err_free_devs;
+		}
+
+		/* Apply the mode switch */
+		data[0] = ATP_GEYSER3_MODE_VENDOR_VALUE;
+
+		size = usb_control_msg(udev, usb_sndctrlpipe(udev, 0),
+			ATP_GEYSER3_MODE_WRITE_REQUEST_ID,
+			USB_DIR_OUT | USB_TYPE_CLASS | USB_RECIP_INTERFACE,
+			ATP_GEYSER3_MODE_REQUEST_VALUE,
+			ATP_GEYSER3_MODE_REQUEST_INDEX, &data, 8, 5000);
+
+		if (size != 8) {
+			err("Could not do mode write request to device"
+							" (Geyser 3 mode)");
+			goto err_free_devs;
+		}
+		printk("appletouch Geyser 3 inited.\n");
+	}
 
 	dev->urb = usb_alloc_urb(0, GFP_KERNEL);
 	if (!dev->urb) {
@@ -447,7 +538,15 @@ static int atp_probe(struct usb_interface *iface, const struct usb_device_id *id
 
 	set_bit(EV_ABS, input_dev->evbit);
 
-	if (atp_is_geyser_2(dev)) {
+	if (atp_is_geyser_3(dev)) {
+		/*
+		 * MacBook have 20 X sensors, 10 Y sensors
+		 */
+		input_set_abs_params(input_dev, ABS_X, 0,
+				     ((20 - 1) * ATP_XFACT) - 1, ATP_FUZZ, 0);
+		input_set_abs_params(input_dev, ABS_Y, 0,
+				     ((10 - 1) * ATP_YFACT) - 1, ATP_FUZZ, 0);
+	} else if (atp_is_geyser_2(dev)) {
 		/*
 		 * Oct 2005 15" PowerBooks have 15 X sensors, 17" are detected
 		 * later.
diff --git a/drivers/usb/input/ati_remote.c b/drivers/usb/input/ati_remote.c
index 99f986cb6e9..07c8c0e665d 100644
--- a/drivers/usb/input/ati_remote.c
+++ b/drivers/usb/input/ati_remote.c
@@ -92,9 +92,7 @@
 #include <linux/slab.h>
 #include <linux/module.h>
 #include <linux/moduleparam.h>
-#include <linux/input.h>
-#include <linux/usb.h>
-#include <linux/usb_input.h>
+#include <linux/usb/input.h>
 #include <linux/wait.h>
 #include <linux/jiffies.h>
 
diff --git a/drivers/usb/input/ati_remote2.c b/drivers/usb/input/ati_remote2.c
index ab1a1ae24be..ea71de81ca6 100644
--- a/drivers/usb/input/ati_remote2.c
+++ b/drivers/usb/input/ati_remote2.c
@@ -8,7 +8,7 @@
  * as published by the Free Software Foundation.
  */
 
-#include <linux/usb_input.h>
+#include <linux/usb/input.h>
 
 #define DRIVER_DESC    "ATI/Philips USB RF remote driver"
 #define DRIVER_VERSION "0.1"
diff --git a/drivers/usb/input/hid-core.c b/drivers/usb/input/hid-core.c
index 435273e7c85..b9fb9687f92 100644
--- a/drivers/usb/input/hid-core.c
+++ b/drivers/usb/input/hid-core.c
@@ -944,21 +944,28 @@ static void hid_reset(void *_hid)
 	dev_dbg(&hid->intf->dev, "resetting device\n");
 	rc = rc_lock = usb_lock_device_for_reset(hid->dev, hid->intf);
 	if (rc_lock >= 0) {
-		rc = usb_reset_device(hid->dev);
+		rc = usb_reset_composite_device(hid->dev, hid->intf);
 		if (rc_lock)
 			usb_unlock_device(hid->dev);
 	}
 	clear_bit(HID_RESET_PENDING, &hid->iofl);
 
-	if (rc == 0) {
-		hid->retry_delay = 0;
-		if (hid_start_in(hid))
+	switch (rc) {
+	case 0:
+		if (!test_bit(HID_IN_RUNNING, &hid->iofl))
 			hid_io_error(hid);
-	} else if (!(rc == -ENODEV || rc == -EHOSTUNREACH || rc == -EINTR))
+		break;
+	default:
 		err("can't reset device, %s-%s/input%d, status %d",
 				hid->dev->bus->bus_name,
 				hid->dev->devpath,
 				hid->ifnum, rc);
+		/* FALLTHROUGH */
+	case -EHOSTUNREACH:
+	case -ENODEV:
+	case -EINTR:
+		break;
+	}
 }
 
 /* Main I/O error handler */
@@ -1374,9 +1381,6 @@ void hid_close(struct hid_device *hid)
 
 #define USB_VENDOR_ID_PANJIT		0x134c
 
-#define USB_VENDOR_ID_SILVERCREST	0x062a
-#define USB_DEVICE_ID_SILVERCREST_KB	0x0201
-
 /*
  * Initialize all reports
  */
@@ -1461,9 +1465,6 @@ void hid_init_reports(struct hid_device *hid)
 #define USB_VENDOR_ID_ONTRAK		0x0a07
 #define USB_DEVICE_ID_ONTRAK_ADU100	0x0064
 
-#define USB_VENDOR_ID_TANGTOP		0x0d3d
-#define USB_DEVICE_ID_TANGTOP_USBPS2	0x0001
-
 #define USB_VENDOR_ID_ESSENTIAL_REALITY	0x0d7f
 #define USB_DEVICE_ID_ESSENTIAL_REALITY_P5 0x0100
 
@@ -1520,12 +1521,6 @@ void hid_init_reports(struct hid_device *hid)
 #define USB_DEVICE_ID_MCC_PMD1024LS	0x0076
 #define USB_DEVICE_ID_MCC_PMD1208LS	0x007a
 
-#define USB_VENDOR_ID_CHICONY		0x04f2
-#define USB_DEVICE_ID_CHICONY_USBHUB_KB	0x0100
-
-#define USB_VENDOR_ID_BTC		0x046e
-#define USB_DEVICE_ID_BTC_KEYBOARD	0x5303
-
 #define USB_VENDOR_ID_VERNIER		0x08f7
 #define USB_DEVICE_ID_VERNIER_LABPRO	0x0001
 #define USB_DEVICE_ID_VERNIER_GOTEMP	0x0002
@@ -1549,20 +1544,13 @@ void hid_init_reports(struct hid_device *hid)
 #define USB_DEVICE_ID_LD_MACHINETEST	0x2040
 
 #define USB_VENDOR_ID_APPLE		0x05ac
-#define USB_DEVICE_ID_APPLE_POWERMOUSE	0x0304
+#define USB_DEVICE_ID_APPLE_MIGHTYMOUSE	0x0304
 
 #define USB_VENDOR_ID_CHERRY		0x046a
 #define USB_DEVICE_ID_CHERRY_CYMOTION	0x0023
 
-#define USB_VENDOR_ID_HP		0x03f0
-#define USB_DEVICE_ID_HP_USBHUB_KB	0x020c
-
-#define USB_VENDOR_ID_IBM		0x04b3
-#define USB_DEVICE_ID_IBM_USBHUB_KB	0x3005
-
-#define USB_VENDOR_ID_CREATIVELABS	0x062a
-#define USB_DEVICE_ID_CREATIVELABS_SILVERCREST	0x0201
-
+#define USB_VENDOR_ID_YEALINK		0x6993
+#define USB_DEVICE_ID_YEALINK_P1K_P4K_B2K	0xb001
 /*
  * Alphabetically sorted blacklist by quirk type.
  */
@@ -1671,6 +1659,7 @@ static const struct hid_blacklist {
 	{ USB_VENDOR_ID_WACOM, USB_DEVICE_ID_WACOM_DTF + 3, HID_QUIRK_IGNORE },
 	{ USB_VENDOR_ID_WISEGROUP, USB_DEVICE_ID_4_PHIDGETSERVO_20, HID_QUIRK_IGNORE },
 	{ USB_VENDOR_ID_WISEGROUP, USB_DEVICE_ID_1_PHIDGETSERVO_20, HID_QUIRK_IGNORE },
+	{ USB_VENDOR_ID_YEALINK, USB_DEVICE_ID_YEALINK_P1K_P4K_B2K, HID_QUIRK_IGNORE },
 
 	{ USB_VENDOR_ID_ACECAD, USB_DEVICE_ID_ACECAD_FLAIR, HID_QUIRK_IGNORE },
 	{ USB_VENDOR_ID_ACECAD, USB_DEVICE_ID_ACECAD_302, HID_QUIRK_IGNORE },
@@ -1680,16 +1669,9 @@ static const struct hid_blacklist {
 	{ USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_2PORTKVM, HID_QUIRK_NOGET },
 	{ USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_4PORTKVM, HID_QUIRK_NOGET },
 	{ USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_4PORTKVMC, HID_QUIRK_NOGET },
-	{ USB_VENDOR_ID_BTC, USB_DEVICE_ID_BTC_KEYBOARD, HID_QUIRK_NOGET},
-	{ USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_USBHUB_KB, HID_QUIRK_NOGET},
-	{ USB_VENDOR_ID_CREATIVELABS, USB_DEVICE_ID_CREATIVELABS_SILVERCREST, HID_QUIRK_NOGET },
-	{ USB_VENDOR_ID_HP, USB_DEVICE_ID_HP_USBHUB_KB, HID_QUIRK_NOGET },
-	{ USB_VENDOR_ID_IBM, USB_DEVICE_ID_IBM_USBHUB_KB, HID_QUIRK_NOGET },
-	{ USB_VENDOR_ID_TANGTOP, USB_DEVICE_ID_TANGTOP_USBPS2, HID_QUIRK_NOGET },
 	{ USB_VENDOR_ID_WISEGROUP, USB_DEVICE_ID_DUAL_USB_JOYPAD, HID_QUIRK_NOGET | HID_QUIRK_MULTI_INPUT },
-	{ USB_VENDOR_ID_SILVERCREST, USB_DEVICE_ID_SILVERCREST_KB, HID_QUIRK_NOGET },
 
-	{ USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_POWERMOUSE, HID_QUIRK_2WHEEL_POWERMOUSE },
+	{ USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_MIGHTYMOUSE, HID_QUIRK_MIGHTYMOUSE | HID_QUIRK_INVERT_HWHEEL },
 	{ USB_VENDOR_ID_A4TECH, USB_DEVICE_ID_A4TECH_WCP32PU, HID_QUIRK_2WHEEL_MOUSE_HACK_7 },
 	{ USB_VENDOR_ID_CYPRESS, USB_DEVICE_ID_CYPRESS_MOUSE, HID_QUIRK_2WHEEL_MOUSE_HACK_5 },
 
@@ -1711,6 +1693,9 @@ static const struct hid_blacklist {
 	{ USB_VENDOR_ID_APPLE, 0x0214, HID_QUIRK_POWERBOOK_HAS_FN },
 	{ USB_VENDOR_ID_APPLE, 0x0215, HID_QUIRK_POWERBOOK_HAS_FN },
 	{ USB_VENDOR_ID_APPLE, 0x0216, HID_QUIRK_POWERBOOK_HAS_FN },
+	{ USB_VENDOR_ID_APPLE, 0x0217, HID_QUIRK_POWERBOOK_HAS_FN },
+	{ USB_VENDOR_ID_APPLE, 0x0218, HID_QUIRK_POWERBOOK_HAS_FN },
+	{ USB_VENDOR_ID_APPLE, 0x0219, HID_QUIRK_POWERBOOK_HAS_FN },
 	{ USB_VENDOR_ID_APPLE, 0x030A, HID_QUIRK_POWERBOOK_HAS_FN },
 	{ USB_VENDOR_ID_APPLE, 0x030B, HID_QUIRK_POWERBOOK_HAS_FN },
 
@@ -1794,6 +1779,14 @@ static struct hid_device *usb_hid_configure(struct usb_interface *intf)
 			(hid_blacklist[n].idProduct == le16_to_cpu(dev->descriptor.idProduct)))
 				quirks = hid_blacklist[n].quirks;
 
+	/* Many keyboards and mice don't like to be polled for reports,
+	 * so we will always set the HID_QUIRK_NOGET flag for them. */
+	if (interface->desc.bInterfaceSubClass == USB_INTERFACE_SUBCLASS_BOOT) {
+		if (interface->desc.bInterfaceProtocol == USB_INTERFACE_PROTOCOL_KEYBOARD ||
+			interface->desc.bInterfaceProtocol == USB_INTERFACE_PROTOCOL_MOUSE)
+				quirks |= HID_QUIRK_NOGET;
+	}
+
 	if (quirks & HID_QUIRK_IGNORE)
 		return NULL;
 
@@ -2080,11 +2073,29 @@ static int hid_resume(struct usb_interface *intf)
 	int status;
 
 	clear_bit(HID_SUSPENDED, &hid->iofl);
+	hid->retry_delay = 0;
 	status = hid_start_in(hid);
 	dev_dbg(&intf->dev, "resume status %d\n", status);
 	return status;
 }
 
+/* Treat USB reset pretty much the same as suspend/resume */
+static void hid_pre_reset(struct usb_interface *intf)
+{
+	/* FIXME: What if the interface is already suspended? */
+	hid_suspend(intf, PMSG_ON);
+}
+
+static void hid_post_reset(struct usb_interface *intf)
+{
+	struct usb_device *dev = interface_to_usbdev (intf);
+
+	hid_set_idle(dev, intf->cur_altsetting->desc.bInterfaceNumber, 0, 0);
+	/* FIXME: Any more reinitialization needed? */
+
+	hid_resume(intf);
+}
+
 static struct usb_device_id hid_usb_ids [] = {
 	{ .match_flags = USB_DEVICE_ID_MATCH_INT_CLASS,
 		.bInterfaceClass = USB_INTERFACE_CLASS_HID },
@@ -2099,6 +2110,8 @@ static struct usb_driver hid_driver = {
 	.disconnect =	hid_disconnect,
 	.suspend =	hid_suspend,
 	.resume =	hid_resume,
+	.pre_reset =	hid_pre_reset,
+	.post_reset =	hid_post_reset,
 	.id_table =	hid_usb_ids,
 };
 
diff --git a/drivers/usb/input/hid-input.c b/drivers/usb/input/hid-input.c
index 25bc85f8ce3..028e1ad89f5 100644
--- a/drivers/usb/input/hid-input.c
+++ b/drivers/usb/input/hid-input.c
@@ -29,9 +29,7 @@
 #include <linux/module.h>
 #include <linux/slab.h>
 #include <linux/kernel.h>
-#include <linux/input.h>
-#include <linux/usb.h>
-#include <linux/usb_input.h>
+#include <linux/usb/input.h>
 
 #undef DEBUG
 
@@ -567,16 +565,14 @@ static void hidinput_configure_usage(struct hid_input *hidinput, struct hid_fiel
 			break;
 	}
 
-	set_bit(usage->type, input->evbit);
-
-	while (usage->code <= max && test_and_set_bit(usage->code, bit))
-		usage->code = find_next_zero_bit(bit, max + 1, usage->code);
-
-	if (usage->code > max)
-		goto ignore;
-
-	if (((device->quirks & (HID_QUIRK_2WHEEL_POWERMOUSE)) && (usage->hid == 0x00010032)))
-		map_rel(REL_HWHEEL);
+	if (device->quirks & HID_QUIRK_MIGHTYMOUSE) {
+		if (usage->hid == HID_GD_Z)
+			map_rel(REL_HWHEEL);
+		else if (usage->code == BTN_1)
+			map_key(BTN_2);
+		else if (usage->code == BTN_2)
+			map_key(BTN_1);
+	}
 
 	if ((device->quirks & (HID_QUIRK_2WHEEL_MOUSE_HACK_7 | HID_QUIRK_2WHEEL_MOUSE_HACK_5)) &&
 		 (usage->type == EV_REL) && (usage->code == REL_WHEEL))
@@ -586,6 +582,15 @@ static void hidinput_configure_usage(struct hid_input *hidinput, struct hid_fiel
 		|| ((device->quirks & HID_QUIRK_2WHEEL_MOUSE_HACK_7) && (usage->hid == 0x00090007)))
 		goto ignore;
 
+	set_bit(usage->type, input->evbit);
+
+	while (usage->code <= max && test_and_set_bit(usage->code, bit))
+		usage->code = find_next_zero_bit(bit, max + 1, usage->code);
+
+	if (usage->code > max)
+		goto ignore;
+
+
 	if (usage->type == EV_ABS) {
 
 		int a = field->logical_minimum;
@@ -647,6 +652,11 @@ void hidinput_hid_event(struct hid_device *hid, struct hid_field *field, struct
 		return;
 	}
 
+	if ((hid->quirks & HID_QUIRK_INVERT_HWHEEL) && (usage->code == REL_HWHEEL)) {
+		input_event(input, usage->type, usage->code, -value);
+		return;
+	}
+
 	if ((hid->quirks & HID_QUIRK_2WHEEL_MOUSE_HACK_ON) && (usage->code == REL_WHEEL)) {
 		input_event(input, usage->type, REL_HWHEEL, value);
 		return;
diff --git a/drivers/usb/input/hid.h b/drivers/usb/input/hid.h
index 9c62837b5b8..778e575de35 100644
--- a/drivers/usb/input/hid.h
+++ b/drivers/usb/input/hid.h
@@ -41,6 +41,14 @@
 #define USB_INTERFACE_CLASS_HID		3
 
 /*
+ * USB HID interface subclass and protocol codes
+ */
+
+#define USB_INTERFACE_SUBCLASS_BOOT	1
+#define USB_INTERFACE_PROTOCOL_KEYBOARD	1
+#define USB_INTERFACE_PROTOCOL_MOUSE	2
+
+/*
  * HID class requests
  */
 
@@ -247,10 +255,11 @@ struct hid_item {
 #define HID_QUIRK_2WHEEL_MOUSE_HACK_7		0x00000080
 #define HID_QUIRK_2WHEEL_MOUSE_HACK_5		0x00000100
 #define HID_QUIRK_2WHEEL_MOUSE_HACK_ON		0x00000200
-#define HID_QUIRK_2WHEEL_POWERMOUSE		0x00000400
+#define HID_QUIRK_MIGHTYMOUSE			0x00000400
 #define HID_QUIRK_CYMOTION			0x00000800
 #define HID_QUIRK_POWERBOOK_HAS_FN		0x00001000
 #define HID_QUIRK_POWERBOOK_FN_ON		0x00002000
+#define HID_QUIRK_INVERT_HWHEEL			0x00004000
 
 /*
  * This is the global environment of the parser. This information is
diff --git a/drivers/usb/input/itmtouch.c b/drivers/usb/input/itmtouch.c
index 7618ae5c104..5c570cc703f 100644
--- a/drivers/usb/input/itmtouch.c
+++ b/drivers/usb/input/itmtouch.c
@@ -42,11 +42,9 @@
 #include <linux/config.h>
 #include <linux/kernel.h>
 #include <linux/slab.h>
-#include <linux/input.h>
 #include <linux/module.h>
 #include <linux/init.h>
-#include <linux/usb.h>
-#include <linux/usb_input.h>
+#include <linux/usb/input.h>
 
 /* only an 8 byte buffer necessary for a single packet */
 #define ITM_BUFSIZE			8
diff --git a/drivers/usb/input/kbtab.c b/drivers/usb/input/kbtab.c
index f6d5cead542..604ade356ea 100644
--- a/drivers/usb/input/kbtab.c
+++ b/drivers/usb/input/kbtab.c
@@ -1,12 +1,9 @@
 #include <linux/kernel.h>
 #include <linux/slab.h>
-#include <linux/input.h>
 #include <linux/module.h>
 #include <linux/init.h>
-#include <linux/usb.h>
-#include <linux/usb_input.h>
+#include <linux/usb/input.h>
 #include <asm/unaligned.h>
-#include <asm/byteorder.h>
 
 /*
  * Version Information
diff --git a/drivers/usb/input/keyspan_remote.c b/drivers/usb/input/keyspan_remote.c
index 3d911976f37..70af985b5db 100644
--- a/drivers/usb/input/keyspan_remote.c
+++ b/drivers/usb/input/keyspan_remote.c
@@ -18,9 +18,7 @@
 #include <linux/slab.h>
 #include <linux/module.h>
 #include <linux/moduleparam.h>
-#include <linux/input.h>
-#include <linux/usb.h>
-#include <linux/usb_input.h>
+#include <linux/usb/input.h>
 
 #define DRIVER_VERSION	"v0.1"
 #define DRIVER_AUTHOR	"Michael Downey <downey@zymeta.com>"
diff --git a/drivers/usb/input/mtouchusb.c b/drivers/usb/input/mtouchusb.c
index f018953a548..4fdee4db072 100644
--- a/drivers/usb/input/mtouchusb.c
+++ b/drivers/usb/input/mtouchusb.c
@@ -42,11 +42,9 @@
 #include <linux/config.h>
 #include <linux/kernel.h>
 #include <linux/slab.h>
-#include <linux/input.h>
 #include <linux/module.h>
 #include <linux/init.h>
-#include <linux/usb.h>
-#include <linux/usb_input.h>
+#include <linux/usb/input.h>
 
 #define MTOUCHUSB_MIN_XC                0x0
 #define MTOUCHUSB_MAX_RAW_XC            0x4000
diff --git a/drivers/usb/input/powermate.c b/drivers/usb/input/powermate.c
index fdf0f788062..b3c0d0c3eae 100644
--- a/drivers/usb/input/powermate.c
+++ b/drivers/usb/input/powermate.c
@@ -30,12 +30,10 @@
 
 #include <linux/kernel.h>
 #include <linux/slab.h>
-#include <linux/input.h>
 #include <linux/module.h>
 #include <linux/init.h>
 #include <linux/spinlock.h>
-#include <linux/usb.h>
-#include <linux/usb_input.h>
+#include <linux/usb/input.h>
 
 #define POWERMATE_VENDOR	0x077d	/* Griffin Technology, Inc. */
 #define POWERMATE_PRODUCT_NEW	0x0410	/* Griffin PowerMate */
diff --git a/drivers/usb/input/touchkitusb.c b/drivers/usb/input/touchkitusb.c
index 697c5e573a1..da7b0bf51af 100644
--- a/drivers/usb/input/touchkitusb.c
+++ b/drivers/usb/input/touchkitusb.c
@@ -27,11 +27,9 @@
 #include <linux/config.h>
 #include <linux/kernel.h>
 #include <linux/slab.h>
-#include <linux/input.h>
 #include <linux/module.h>
 #include <linux/init.h>
-#include <linux/usb.h>
-#include <linux/usb_input.h>
+#include <linux/usb/input.h>
 
 #define TOUCHKIT_MIN_XC			0x0
 #define TOUCHKIT_MAX_XC			0x07ff
diff --git a/drivers/usb/input/usbkbd.c b/drivers/usb/input/usbkbd.c
index 2f3edc26cb5..5067a6ae650 100644
--- a/drivers/usb/input/usbkbd.c
+++ b/drivers/usb/input/usbkbd.c
@@ -29,10 +29,8 @@
 #include <linux/kernel.h>
 #include <linux/slab.h>
 #include <linux/module.h>
-#include <linux/input.h>
 #include <linux/init.h>
-#include <linux/usb.h>
-#include <linux/usb_input.h>
+#include <linux/usb/input.h>
 
 /*
  * Version Information
diff --git a/drivers/usb/input/usbmouse.c b/drivers/usb/input/usbmouse.c
index af526135d21..446935b671d 100644
--- a/drivers/usb/input/usbmouse.c
+++ b/drivers/usb/input/usbmouse.c
@@ -28,11 +28,9 @@
 
 #include <linux/kernel.h>
 #include <linux/slab.h>
-#include <linux/input.h>
 #include <linux/module.h>
 #include <linux/init.h>
-#include <linux/usb.h>
-#include <linux/usb_input.h>
+#include <linux/usb/input.h>
 
 /*
  * Version Information
diff --git a/drivers/usb/input/usbtouchscreen.c b/drivers/usb/input/usbtouchscreen.c
index e9a07c1e905..3b175aa482c 100644
--- a/drivers/usb/input/usbtouchscreen.c
+++ b/drivers/usb/input/usbtouchscreen.c
@@ -39,7 +39,7 @@
 #include <linux/module.h>
 #include <linux/init.h>
 #include <linux/usb.h>
-#include <linux/usb_input.h>
+#include <linux/usb/input.h>
 
 
 #define DRIVER_VERSION		"v0.3"
diff --git a/drivers/usb/input/wacom.c b/drivers/usb/input/wacom.c
index cf84c6096f2..369461a70b7 100644
--- a/drivers/usb/input/wacom.c
+++ b/drivers/usb/input/wacom.c
@@ -69,13 +69,10 @@
 
 #include <linux/kernel.h>
 #include <linux/slab.h>
-#include <linux/input.h>
 #include <linux/module.h>
 #include <linux/init.h>
-#include <linux/usb.h>
-#include <linux/usb_input.h>
+#include <linux/usb/input.h>
 #include <asm/unaligned.h>
-#include <asm/byteorder.h>
 
 /*
  * Version Information
diff --git a/drivers/usb/input/xpad.c b/drivers/usb/input/xpad.c
index e278489a80c..cfd4a4e0433 100644
--- a/drivers/usb/input/xpad.c
+++ b/drivers/usb/input/xpad.c
@@ -56,13 +56,11 @@
 
 #include <linux/config.h>
 #include <linux/kernel.h>
-#include <linux/input.h>
 #include <linux/init.h>
 #include <linux/slab.h>
 #include <linux/module.h>
 #include <linux/smp_lock.h>
-#include <linux/usb.h>
-#include <linux/usb_input.h>
+#include <linux/usb/input.h>
 
 #define DRIVER_VERSION "v0.0.5"
 #define DRIVER_AUTHOR "Marko Friedemann <mfr@bmx-chemnitz.de>"
diff --git a/drivers/usb/input/yealink.c b/drivers/usb/input/yealink.c
index 37d2f0ba031..24aedbb20f0 100644
--- a/drivers/usb/input/yealink.c
+++ b/drivers/usb/input/yealink.c
@@ -48,13 +48,11 @@
 
 #include <linux/config.h>
 #include <linux/kernel.h>
-#include <linux/input.h>
 #include <linux/init.h>
 #include <linux/slab.h>
 #include <linux/module.h>
 #include <linux/rwsem.h>
-#include <linux/usb.h>
-#include <linux/usb_input.h>
+#include <linux/usb/input.h>
 
 #include "map_to_7segment.h"
 #include "yealink.h"
diff --git a/drivers/usb/misc/Kconfig b/drivers/usb/misc/Kconfig
index 8ba6a701e9c..daa486dde8c 100644
--- a/drivers/usb/misc/Kconfig
+++ b/drivers/usb/misc/Kconfig
@@ -88,6 +88,20 @@ config USB_LED
 	  To compile this driver as a module, choose M here: the
 	  module will be called usbled.
 
+config USB_CY7C63
+	tristate "Cypress CY7C63xxx USB driver support"
+	depends on USB
+	help
+	  Say Y here if you want to connect a Cypress CY7C63xxx
+	  micro controller to your computer's USB port. This driver
+	  supports the pre-programmed devices (incl. firmware) by
+	  AK Modul-Bus Computer GmbH.
+
+	  Please see: http://www.ak-modul-bus.de/stat/mikrocontroller.html
+
+	  To compile this driver as a module, choose M here: the
+	  module will be called cy7c63.
+
 config USB_CYTHERM
 	tristate "Cypress USB thermometer driver support"
 	depends on USB
@@ -137,6 +151,15 @@ config USB_IDMOUSE
 
 	  See also <http://www.fs.tum.de/~echtler/idmouse/>.
 
+config USB_APPLEDISPLAY
+	tristate "Apple Cinema Display support"
+	depends on USB
+	select BACKLIGHT_LCD_SUPPORT
+	select BACKLIGHT_CLASS_DEVICE
+	help
+	  Say Y here if you want to control the backlight of Apple Cinema
+	  Displays over USB. This driver provides a sysfs interface.
+
 source "drivers/usb/misc/sisusbvga/Kconfig"
 
 config USB_LD
diff --git a/drivers/usb/misc/Makefile b/drivers/usb/misc/Makefile
index 6c693bc68e2..f25a9722729 100644
--- a/drivers/usb/misc/Makefile
+++ b/drivers/usb/misc/Makefile
@@ -4,6 +4,7 @@
 #
 
 obj-$(CONFIG_USB_AUERSWALD)	+= auerswald.o
+obj-$(CONFIG_USB_CY7C63)	+= cy7c63.o
 obj-$(CONFIG_USB_CYTHERM)	+= cytherm.o
 obj-$(CONFIG_USB_EMI26)		+= emi26.o
 obj-$(CONFIG_USB_EMI62)		+= emi62.o
@@ -17,6 +18,7 @@ obj-$(CONFIG_USB_PHIDGETSERVO)	+= phidgetservo.o
 obj-$(CONFIG_USB_RIO500)	+= rio500.o
 obj-$(CONFIG_USB_TEST)		+= usbtest.o
 obj-$(CONFIG_USB_USS720)	+= uss720.o
+obj-$(CONFIG_USB_APPLEDISPLAY)	+= appledisplay.o
 
 obj-$(CONFIG_USB_SISUSBVGA)	+= sisusbvga/
 
diff --git a/drivers/usb/misc/appledisplay.c b/drivers/usb/misc/appledisplay.c
new file mode 100644
index 00000000000..bfde82f5d18
--- /dev/null
+++ b/drivers/usb/misc/appledisplay.c
@@ -0,0 +1,383 @@
+/*
+ * Apple Cinema Display driver
+ *
+ * Copyright (C) 2006  Michael Hanselmann (linux-kernel@hansmi.ch)
+ *
+ * Thanks to Caskey L. Dickson for his work with acdctl.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+ */
+
+#include <linux/config.h>
+#include <linux/kernel.h>
+#include <linux/errno.h>
+#include <linux/init.h>
+#include <linux/module.h>
+#include <linux/usb.h>
+#include <linux/backlight.h>
+#include <linux/timer.h>
+#include <linux/workqueue.h>
+#include <asm/atomic.h>
+#include <asm/semaphore.h>
+
+#define APPLE_VENDOR_ID		0x05AC
+
+#define USB_REQ_GET_REPORT	0x01
+#define USB_REQ_SET_REPORT	0x09
+
+#define ACD_USB_TIMEOUT		250
+
+#define ACD_USB_EDID		0x0302
+#define ACD_USB_BRIGHTNESS	0x0310
+
+#define ACD_BTN_NONE		0
+#define ACD_BTN_BRIGHT_UP	3
+#define ACD_BTN_BRIGHT_DOWN	4
+
+#define ACD_URB_BUFFER_LEN	2
+#define ACD_MSG_BUFFER_LEN	2
+
+#define APPLEDISPLAY_DEVICE(prod)				\
+	.match_flags = USB_DEVICE_ID_MATCH_DEVICE |		\
+		       USB_DEVICE_ID_MATCH_INT_CLASS |		\
+		       USB_DEVICE_ID_MATCH_INT_PROTOCOL,	\
+	.idVendor = APPLE_VENDOR_ID,				\
+	.idProduct = (prod),					\
+	.bInterfaceClass = USB_CLASS_HID,			\
+	.bInterfaceProtocol = 0x00
+
+/* table of devices that work with this driver */
+static struct usb_device_id appledisplay_table [] = {
+	{ APPLEDISPLAY_DEVICE(0x9218) },
+	{ APPLEDISPLAY_DEVICE(0x9219) },
+	{ APPLEDISPLAY_DEVICE(0x921d) },
+
+	/* Terminating entry */
+	{ }
+};
+MODULE_DEVICE_TABLE(usb, appledisplay_table);
+
+/* Structure to hold all of our device specific stuff */
+struct appledisplay {
+	struct usb_device *udev;	/* usb device */
+	struct urb *urb;		/* usb request block */
+	struct backlight_device *bd;	/* backlight device */
+	char *urbdata;			/* interrupt URB data buffer */
+	char *msgdata;			/* control message data buffer */
+
+	struct work_struct work;
+	int button_pressed;
+	spinlock_t lock;
+};
+
+static atomic_t count_displays = ATOMIC_INIT(0);
+static struct workqueue_struct *wq;
+
+static void appledisplay_complete(struct urb *urb, struct pt_regs *regs)
+{
+	struct appledisplay *pdata = urb->context;
+	unsigned long flags;
+	int retval;
+
+	switch (urb->status) {
+	case 0:
+		/* success */
+		break;
+	case -EOVERFLOW:
+		printk(KERN_ERR "appletouch: OVERFLOW with data "
+			"length %d, actual length is %d\n",
+			ACD_URB_BUFFER_LEN, pdata->urb->actual_length);
+	case -ECONNRESET:
+	case -ENOENT:
+	case -ESHUTDOWN:
+		/* This urb is terminated, clean up */
+		dbg("%s - urb shutting down with status: %d",
+			__FUNCTION__, urb->status);
+		return;
+	default:
+		dbg("%s - nonzero urb status received: %d",
+			__FUNCTION__, urb->status);
+		goto exit;
+	}
+
+	spin_lock_irqsave(&pdata->lock, flags);
+
+	switch(pdata->urbdata[1]) {
+	case ACD_BTN_BRIGHT_UP:
+	case ACD_BTN_BRIGHT_DOWN:
+		pdata->button_pressed = 1;
+		queue_work(wq, &pdata->work);
+		break;
+	case ACD_BTN_NONE:
+	default:
+		pdata->button_pressed = 0;
+		break;
+	}
+
+	spin_unlock_irqrestore(&pdata->lock, flags);
+
+exit:
+	retval = usb_submit_urb(pdata->urb, GFP_ATOMIC);
+	if (retval) {
+		err("%s - usb_submit_urb failed with result %d",
+			__FUNCTION__, retval);
+	}
+}
+
+static int appledisplay_bl_update_status(struct backlight_device *bd)
+{
+	struct appledisplay *pdata = class_get_devdata(&bd->class_dev);
+	int retval;
+
+	pdata->msgdata[0] = 0x10;
+	pdata->msgdata[1] = bd->props->brightness;
+
+	retval = usb_control_msg(
+		pdata->udev,
+		usb_sndctrlpipe(pdata->udev, 0),
+		USB_REQ_SET_REPORT,
+		USB_DIR_OUT | USB_TYPE_CLASS | USB_RECIP_INTERFACE,
+		ACD_USB_BRIGHTNESS,
+		0,
+		pdata->msgdata, 2,
+		ACD_USB_TIMEOUT);
+
+	return retval;
+}
+
+static int appledisplay_bl_get_brightness(struct backlight_device *bd)
+{
+	struct appledisplay *pdata = class_get_devdata(&bd->class_dev);
+	int retval;
+
+	retval = usb_control_msg(
+		pdata->udev,
+		usb_rcvctrlpipe(pdata->udev, 0),
+		USB_REQ_GET_REPORT,
+		USB_DIR_IN | USB_TYPE_CLASS | USB_RECIP_INTERFACE,
+		ACD_USB_BRIGHTNESS,
+		0,
+		pdata->msgdata, 2,
+		ACD_USB_TIMEOUT);
+
+	if (retval < 0)
+		return retval;
+	else
+		return pdata->msgdata[1];
+}
+
+static struct backlight_properties appledisplay_bl_data = {
+	.owner		= THIS_MODULE,
+	.get_brightness	= appledisplay_bl_get_brightness,
+	.update_status	= appledisplay_bl_update_status,
+	.max_brightness	= 0xFF
+};
+
+static void appledisplay_work(void *private)
+{
+	struct appledisplay *pdata = private;
+	int retval;
+
+	up(&pdata->bd->sem);
+	retval = appledisplay_bl_get_brightness(pdata->bd);
+	if (retval >= 0)
+		pdata->bd->props->brightness = retval;
+	down(&pdata->bd->sem);
+
+	/* Poll again in about 125ms if there's still a button pressed */
+	if (pdata->button_pressed)
+		schedule_delayed_work(&pdata->work, HZ / 8);
+}
+
+static int appledisplay_probe(struct usb_interface *iface,
+	const struct usb_device_id *id)
+{
+	struct appledisplay *pdata;
+	struct usb_device *udev = interface_to_usbdev(iface);
+	struct usb_host_interface *iface_desc;
+	struct usb_endpoint_descriptor *endpoint;
+	int int_in_endpointAddr = 0;
+	int i, retval = -ENOMEM, brightness;
+	char bl_name[20];
+
+	/* set up the endpoint information */
+	/* use only the first interrupt-in endpoint */
+	iface_desc = iface->cur_altsetting;
+	for (i = 0; i < iface_desc->desc.bNumEndpoints; i++) {
+		endpoint = &iface_desc->endpoint[i].desc;
+		if (!int_in_endpointAddr &&
+		    (endpoint->bEndpointAddress & USB_DIR_IN) &&
+		    ((endpoint->bmAttributes & USB_ENDPOINT_XFERTYPE_MASK) ==
+		     USB_ENDPOINT_XFER_INT)) {
+			/* we found an interrupt in endpoint */
+			int_in_endpointAddr = endpoint->bEndpointAddress;
+			break;
+		}
+	}
+	if (!int_in_endpointAddr) {
+		err("Could not find int-in endpoint");
+		return -EIO;
+	}
+
+	/* allocate memory for our device state and initialize it */
+	pdata = kzalloc(sizeof(struct appledisplay), GFP_KERNEL);
+	if (!pdata) {
+		retval = -ENOMEM;
+		err("Out of memory");
+		goto error;
+	}
+
+	pdata->udev = udev;
+
+	spin_lock_init(&pdata->lock);
+	INIT_WORK(&pdata->work, appledisplay_work, pdata);
+
+	/* Allocate buffer for control messages */
+	pdata->msgdata = kmalloc(ACD_MSG_BUFFER_LEN, GFP_KERNEL);
+	if (!pdata->msgdata) {
+		retval = -ENOMEM;
+		err("appledisplay: Allocating buffer for control messages "
+			"failed");
+		goto error;
+	}
+
+	/* Allocate interrupt URB */
+	pdata->urb = usb_alloc_urb(0, GFP_KERNEL);
+	if (!pdata->urb) {
+		retval = -ENOMEM;
+		err("appledisplay: Allocating URB failed");
+		goto error;
+	}
+
+	/* Allocate buffer for interrupt data */
+	pdata->urbdata = usb_buffer_alloc(pdata->udev, ACD_URB_BUFFER_LEN,
+		GFP_KERNEL, &pdata->urb->transfer_dma);
+	if (!pdata->urbdata) {
+		retval = -ENOMEM;
+		err("appledisplay: Allocating URB buffer failed");
+		goto error;
+	}
+
+	/* Configure interrupt URB */
+	usb_fill_int_urb(pdata->urb, udev,
+		usb_rcvintpipe(udev, int_in_endpointAddr),
+		pdata->urbdata, ACD_URB_BUFFER_LEN, appledisplay_complete,
+		pdata, 1);
+	if (usb_submit_urb(pdata->urb, GFP_KERNEL)) {
+		retval = -EIO;
+		err("appledisplay: Submitting URB failed");
+		goto error;
+	}
+
+	/* Register backlight device */
+	snprintf(bl_name, sizeof(bl_name), "appledisplay%d",
+		atomic_inc_return(&count_displays) - 1);
+	pdata->bd = backlight_device_register(bl_name, pdata,
+						&appledisplay_bl_data);
+	if (IS_ERR(pdata->bd)) {
+		err("appledisplay: Backlight registration failed");
+		goto error;
+	}
+
+	/* Try to get brightness */
+	up(&pdata->bd->sem);
+	brightness = appledisplay_bl_get_brightness(pdata->bd);
+	down(&pdata->bd->sem);
+
+	if (brightness < 0) {
+		retval = brightness;
+		err("appledisplay: Error while getting initial brightness: %d", retval);
+		goto error;
+	}
+
+	/* Set brightness in backlight device */
+	up(&pdata->bd->sem);
+	pdata->bd->props->brightness = brightness;
+	down(&pdata->bd->sem);
+
+	/* save our data pointer in the interface device */
+	usb_set_intfdata(iface, pdata);
+
+	printk(KERN_INFO "appledisplay: Apple Cinema Display connected\n");
+
+	return 0;
+
+error:
+	if (pdata) {
+		if (pdata->urb) {
+			usb_kill_urb(pdata->urb);
+			if (pdata->urbdata)
+				usb_buffer_free(pdata->udev, ACD_URB_BUFFER_LEN,
+					pdata->urbdata, pdata->urb->transfer_dma);
+			usb_free_urb(pdata->urb);
+		}
+		if (pdata->bd)
+			backlight_device_unregister(pdata->bd);
+		kfree(pdata->msgdata);
+	}
+	usb_set_intfdata(iface, NULL);
+	kfree(pdata);
+	return retval;
+}
+
+static void appledisplay_disconnect(struct usb_interface *iface)
+{
+	struct appledisplay *pdata = usb_get_intfdata(iface);
+
+	if (pdata) {
+		usb_kill_urb(pdata->urb);
+		cancel_delayed_work(&pdata->work);
+		backlight_device_unregister(pdata->bd);
+		usb_buffer_free(pdata->udev, ACD_URB_BUFFER_LEN,
+			pdata->urbdata, pdata->urb->transfer_dma);
+		usb_free_urb(pdata->urb);
+		kfree(pdata->msgdata);
+		kfree(pdata);
+	}
+
+	printk(KERN_INFO "appledisplay: Apple Cinema Display disconnected\n");
+}
+
+static struct usb_driver appledisplay_driver = {
+	.name		= "appledisplay",
+	.probe		= appledisplay_probe,
+	.disconnect	= appledisplay_disconnect,
+	.id_table	= appledisplay_table,
+};
+
+static int __init appledisplay_init(void)
+{
+	wq = create_singlethread_workqueue("appledisplay");
+	if (!wq) {
+		err("Could not create work queue\n");
+		return -ENOMEM;
+	}
+
+	return usb_register(&appledisplay_driver);
+}
+
+static void __exit appledisplay_exit(void)
+{
+	flush_workqueue(wq);
+	destroy_workqueue(wq);
+	usb_deregister(&appledisplay_driver);
+}
+
+MODULE_AUTHOR("Michael Hanselmann");
+MODULE_DESCRIPTION("Apple Cinema Display driver");
+MODULE_LICENSE("GPL");
+
+module_init(appledisplay_init);
+module_exit(appledisplay_exit);
diff --git a/drivers/usb/misc/cy7c63.c b/drivers/usb/misc/cy7c63.c
new file mode 100644
index 00000000000..8a1c10b89b7
--- /dev/null
+++ b/drivers/usb/misc/cy7c63.c
@@ -0,0 +1,244 @@
+/*
+* cy7c63.c
+*
+* Copyright (c) 2006 Oliver Bock (bock@fh-wolfenbuettel.de)
+*
+*	This driver is based on the Cypress Thermometer USB Driver by
+*	Marcus Maul and the 2.0 version of Greg Kroah-Hartman's
+*	USB Skeleton driver.
+*
+*	Is is a generic driver for the Cypress CY7C63000 family.
+*	For the time being it enables you to toggle the single I/O ports
+*	of the device.
+*
+*	Supported vendors:	AK Modul-Bus Computer GmbH
+*	Supported devices:	CY7C63001A-PC (to be continued...)
+*	Supported functions:	Read/Write Ports (to be continued...)
+*
+*	Chipsets families:	CY7C63000, CY7C63001, CY7C63100, CY7C63101
+*
+*
+*	This program is free software; you can redistribute it and/or
+*	modify it under the terms of the GNU General Public License as
+*	published by the Free Software Foundation, version 2.
+*/
+
+#include <linux/init.h>
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <linux/usb.h>
+
+#define DRIVER_AUTHOR		"Oliver Bock (bock@fh-wolfenbuettel.de)"
+#define DRIVER_DESC		"Cypress CY7C63xxx USB driver"
+
+#define CY7C63_VENDOR_ID	0xa2c
+#define CY7C63_PRODUCT_ID	0x8
+
+#define CY7C63_READ_PORT	0x4
+#define CY7C63_WRITE_PORT	0x5
+#define CY7C63_READ_RAM		0x2
+#define CY7C63_WRITE_RAM	0x3
+#define CY7C63_READ_ROM		0x1
+
+#define CY7C63_READ_PORT_ID0	0
+#define CY7C63_WRITE_PORT_ID0	0
+#define CY7C63_READ_PORT_ID1	0x2
+#define CY7C63_WRITE_PORT_ID1	1
+
+#define CY7C63_MAX_REQSIZE	8
+
+
+/* table of devices that work with this driver */
+static struct usb_device_id cy7c63_table [] = {
+	{ USB_DEVICE(CY7C63_VENDOR_ID, CY7C63_PRODUCT_ID) },
+	{ }
+};
+MODULE_DEVICE_TABLE(usb, cy7c63_table);
+
+/* structure to hold all of our device specific stuff */
+struct cy7c63 {
+	struct usb_device *	udev;
+	char 			port0;
+	char			port1;
+};
+
+/* used to send usb control messages to device */
+int vendor_command(struct cy7c63 *dev, unsigned char request,
+			 unsigned char address, unsigned char data) {
+
+	int retval = 0;
+	unsigned int pipe;
+	unsigned char *iobuf;
+
+	/* allocate some memory for the i/o buffer*/
+	iobuf = kzalloc(CY7C63_MAX_REQSIZE, GFP_KERNEL);
+	if (!iobuf) {
+		dev_err(&dev->udev->dev, "Out of memory!\n");
+		retval = -ENOMEM;
+		goto error;
+	}
+
+	dev_dbg(&dev->udev->dev, "Sending usb_control_msg (data: %d)\n", data);
+
+	/* prepare usb control message and send it upstream */
+	pipe = usb_rcvctrlpipe(dev->udev, 0);
+	retval = usb_control_msg(dev->udev, pipe, request,
+				USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_OTHER,
+				address, data, iobuf, CY7C63_MAX_REQSIZE,
+				USB_CTRL_GET_TIMEOUT);
+
+	/* store returned data (more READs to be added!) */
+	switch (request) {
+		case CY7C63_READ_PORT:
+			if (address == CY7C63_READ_PORT_ID0) {
+				dev->port0 = iobuf[1];
+				dev_dbg(&dev->udev->dev,
+					"READ_PORT0 returned: %d\n",dev->port0);
+			}
+			else if (address == CY7C63_READ_PORT_ID1) {
+				dev->port1 = iobuf[1];
+				dev_dbg(&dev->udev->dev,
+					"READ_PORT1 returned: %d\n",dev->port1);
+			}
+			break;
+	}
+
+	kfree(iobuf);
+error:
+	return retval;
+}
+
+#define get_set_port(num,read_id,write_id) \
+static ssize_t set_port##num(struct device *dev, struct device_attribute *attr,	\
+					const char *buf, size_t count) {	\
+										\
+	int value;								\
+	int result = 0;								\
+										\
+	struct usb_interface *intf = to_usb_interface(dev);			\
+	struct cy7c63 *cyp = usb_get_intfdata(intf);				\
+										\
+	dev_dbg(&cyp->udev->dev, "WRITE_PORT%d called\n", num);			\
+										\
+	/* validate input data */						\
+	if (sscanf(buf, "%d", &value) < 1) {					\
+		result = -EINVAL;						\
+		goto error;							\
+	}									\
+	if (value>255 || value<0) {						\
+		result = -EINVAL;						\
+		goto error;							\
+	}									\
+										\
+	result = vendor_command(cyp, CY7C63_WRITE_PORT, write_id,		\
+					 (unsigned char)value);			\
+										\
+	dev_dbg(&cyp->udev->dev, "Result of vendor_command: %d\n\n",result);	\
+error:										\
+	return result < 0 ? result : count;					\
+}										\
+										\
+static ssize_t get_port##num(struct device *dev,				\
+				 struct device_attribute *attr, char *buf) {	\
+										\
+	int result = 0;								\
+										\
+	struct usb_interface *intf = to_usb_interface(dev);			\
+	struct cy7c63 *cyp = usb_get_intfdata(intf);				\
+										\
+	dev_dbg(&cyp->udev->dev, "READ_PORT%d called\n", num);			\
+										\
+	result = vendor_command(cyp, CY7C63_READ_PORT, read_id, 0);		\
+										\
+	dev_dbg(&cyp->udev->dev, "Result of vendor_command: %d\n\n", result);	\
+										\
+	return sprintf(buf, "%d", cyp->port##num);				\
+}										\
+static DEVICE_ATTR(port##num, S_IWUGO | S_IRUGO, get_port##num, set_port##num);
+
+get_set_port(0, CY7C63_READ_PORT_ID0, CY7C63_WRITE_PORT_ID0);
+get_set_port(1, CY7C63_READ_PORT_ID1, CY7C63_WRITE_PORT_ID1);
+
+static int cy7c63_probe(struct usb_interface *interface,
+			const struct usb_device_id *id) {
+
+	struct cy7c63 *dev = NULL;
+	int retval = -ENOMEM;
+
+	/* allocate memory for our device state and initialize it */
+	dev = kzalloc(sizeof(*dev), GFP_KERNEL);
+	if (dev == NULL) {
+		dev_err(&dev->udev->dev, "Out of memory!\n");
+		goto error;
+	}
+
+	dev->udev = usb_get_dev(interface_to_usbdev(interface));
+
+	/* save our data pointer in this interface device */
+	usb_set_intfdata(interface, dev);
+
+	/* create device attribute files */
+	device_create_file(&interface->dev, &dev_attr_port0);
+	device_create_file(&interface->dev, &dev_attr_port1);
+
+	/* let the user know what node this device is now attached to */
+	dev_info(&interface->dev,
+		"Cypress CY7C63xxx device now attached\n");
+
+	retval = 0;
+error:
+	return retval;
+}
+
+static void cy7c63_disconnect(struct usb_interface *interface) {
+
+	struct cy7c63 *dev;
+
+	dev = usb_get_intfdata(interface);
+	usb_set_intfdata(interface, NULL);
+
+	/* remove device attribute files */
+	device_remove_file(&interface->dev, &dev_attr_port0);
+	device_remove_file(&interface->dev, &dev_attr_port1);
+
+	usb_put_dev(dev->udev);
+
+	dev_info(&interface->dev,
+		"Cypress CY7C63xxx device now disconnected\n");
+
+	kfree(dev);
+}
+
+static struct usb_driver cy7c63_driver = {
+	.name = "cy7c63",
+	.probe = cy7c63_probe,
+	.disconnect = cy7c63_disconnect,
+	.id_table = cy7c63_table,
+};
+
+static int __init cy7c63_init(void) {
+
+	int result;
+
+	/* register this driver with the USB subsystem */
+	result = usb_register(&cy7c63_driver);
+	if (result) {
+		err("Function usb_register failed! Error number: %d\n", result);
+	}
+
+	return result;
+}
+
+static void __exit cy7c63_exit(void) {
+
+	/* deregister this driver with the USB subsystem */
+	usb_deregister(&cy7c63_driver);
+}
+
+module_init(cy7c63_init);
+module_exit(cy7c63_exit);
+
+MODULE_AUTHOR(DRIVER_AUTHOR);
+MODULE_DESCRIPTION(DRIVER_DESC);
+
+MODULE_LICENSE("GPL");
diff --git a/drivers/usb/misc/phidgetkit.c b/drivers/usb/misc/phidgetkit.c
index 997db5d8e35..13aeea2026c 100644
--- a/drivers/usb/misc/phidgetkit.c
+++ b/drivers/usb/misc/phidgetkit.c
@@ -1,7 +1,8 @@
 /*
  * USB PhidgetInterfaceKit driver 1.0
  *
- * Copyright (C) 2004 Sean Young <sean@mess.org>
+ * Copyright (C) 2004, 2006 Sean Young <sean@mess.org>
+ * Copyright (C) 2005 Daniel Saakes <daniel@saakes.net>
  * Copyright (C) 2004 Greg Kroah-Hartman <greg@kroah.com>
  *
  * This program is free software; you can redistribute it and/or modify
@@ -25,6 +26,7 @@
 
 #define USB_VENDOR_ID_GLAB		0x06c2
 #define USB_DEVICE_ID_INTERFACEKIT004	0x0040
+#define USB_DEVICE_ID_INTERFACEKIT01616	0x0044
 #define USB_DEVICE_ID_INTERFACEKIT888	0x0045
 #define USB_DEVICE_ID_INTERFACEKIT047	0x0051
 #define USB_DEVICE_ID_INTERFACEKIT088	0x0053
@@ -32,7 +34,9 @@
 #define USB_VENDOR_ID_WISEGROUP		0x0925
 #define USB_DEVICE_ID_INTERFACEKIT884	0x8201
 
-#define MAX_INTERFACES			8
+#define MAX_INTERFACES			16
+
+#define URB_INT_SIZE			8
 
 struct driver_interfacekit {
 	int sensors;
@@ -52,19 +56,24 @@ ifkit(8, 8, 8, 0);
 ifkit(0, 4, 7, 1);
 ifkit(8, 8, 4, 0);
 ifkit(0, 8, 8, 1);
+ifkit(0, 16, 16, 0);
 
-struct phidget_interfacekit {
+struct interfacekit {
 	struct usb_device *udev;
 	struct usb_interface *intf;
 	struct driver_interfacekit *ifkit;
-	int outputs[MAX_INTERFACES];
-	int inputs[MAX_INTERFACES];
-	int sensors[MAX_INTERFACES];
+	unsigned long outputs;
+	u8 inputs[MAX_INTERFACES];
+	u16 sensors[MAX_INTERFACES];
 	u8 lcd_files_on;
 
 	struct urb *irq;
 	unsigned char *data;
 	dma_addr_t data_dma;
+
+	struct work_struct do_notify;
+	unsigned long input_events;
+	unsigned long sensor_events;
 };
 
 static struct usb_device_id id_table[] = {
@@ -76,33 +85,33 @@ static struct usb_device_id id_table[] = {
 		.driver_info = (kernel_ulong_t)&ph_047},
 	{USB_DEVICE(USB_VENDOR_ID_GLAB, USB_DEVICE_ID_INTERFACEKIT088),
 		.driver_info = (kernel_ulong_t)&ph_088},
+	{USB_DEVICE(USB_VENDOR_ID_GLAB, USB_DEVICE_ID_INTERFACEKIT01616),
+		.driver_info = (kernel_ulong_t)&ph_01616},
 	{USB_DEVICE(USB_VENDOR_ID_WISEGROUP, USB_DEVICE_ID_INTERFACEKIT884),
 		.driver_info = (kernel_ulong_t)&ph_884},
 	{}
 };
 MODULE_DEVICE_TABLE(usb, id_table);
 
-static int change_outputs(struct phidget_interfacekit *kit, int output_num, int enable)
+static int change_outputs(struct interfacekit *kit, int output_num, int enable)
 {
-	unsigned char *buffer;
+	u8 *buffer;
 	int retval;
-	int n;
+
+	if (enable)
+		set_bit(output_num, &kit->outputs);
+	else
+		clear_bit(output_num, &kit->outputs);
 
 	buffer = kzalloc(4, GFP_KERNEL);
 	if (!buffer) {
-		dev_err(&kit->udev->dev, "%s - out of memory\n",
-			__FUNCTION__);
+		dev_err(&kit->udev->dev, "%s - out of memory\n", __FUNCTION__);
 		return -ENOMEM;
 	}
+	buffer[0] = (u8)kit->outputs;
+	buffer[1] = (u8)(kit->outputs >> 8);
 
-	kit->outputs[output_num] = enable;
-	for (n=0; n<8; n++) {
-		if (kit->outputs[n]) {
-			buffer[0] |= 1 << n;
-		}
-	}
-
-	dev_dbg(&kit->udev->dev, "sending data: %02x\n", buffer[0]);
+	dev_dbg(&kit->udev->dev, "sending data: 0x%04x\n", (u16)kit->outputs);
 
 	retval = usb_control_msg(kit->udev,
 			 usb_sndctrlpipe(kit->udev, 0),
@@ -116,10 +125,10 @@ static int change_outputs(struct phidget_interfacekit *kit, int output_num, int
 	return retval < 0 ? retval : 0;
 }
 
-static int change_string(struct phidget_interfacekit *kit, const char *display, unsigned char row)
+static int change_string(struct interfacekit *kit, const char *display, unsigned char row)
 {
 	unsigned char *buffer;
-        unsigned char *form_buffer;
+	unsigned char *form_buffer;
 	int retval = -ENOMEM;
 	int i,j, len, buf_ptr;
 	
@@ -175,7 +184,7 @@ exit:
 static ssize_t lcd_line_##number(struct device *dev, struct device_attribute *attr, const char *buf, size_t count)	\
 {											\
 	struct usb_interface *intf = to_usb_interface(dev);				\
-	struct phidget_interfacekit *kit = usb_get_intfdata(intf);			\
+	struct interfacekit *kit = usb_get_intfdata(intf);				\
 	change_string(kit, buf, number - 1);						\
 	return count;									\
 }											\
@@ -186,7 +195,7 @@ set_lcd_line(2);
 static ssize_t set_backlight(struct device *dev, struct device_attribute *attr, const char *buf, size_t count)
 {
 	struct usb_interface *intf = to_usb_interface(dev);
-	struct phidget_interfacekit *kit = usb_get_intfdata(intf);
+	struct interfacekit *kit = usb_get_intfdata(intf);
 	int enabled;
 	unsigned char *buffer;
 	int retval = -ENOMEM;
@@ -220,7 +229,7 @@ exit:
 }
 static DEVICE_ATTR(backlight, S_IWUGO, NULL, set_backlight);
 
-static void remove_lcd_files(struct phidget_interfacekit *kit)
+static void remove_lcd_files(struct interfacekit *kit)
 {
 	if (kit->lcd_files_on) {
 		dev_dbg(&kit->udev->dev, "Removing lcd files\n");
@@ -233,7 +242,7 @@ static void remove_lcd_files(struct phidget_interfacekit *kit)
 static ssize_t enable_lcd_files(struct device *dev, struct device_attribute *attr, const char *buf, size_t count)
 {
 	struct usb_interface *intf = to_usb_interface(dev);
-	struct phidget_interfacekit *kit = usb_get_intfdata(intf);
+	struct interfacekit *kit = usb_get_intfdata(intf);
 	int enable;
 	
 	if (kit->ifkit->has_lcd == 0)
@@ -263,10 +272,10 @@ static DEVICE_ATTR(lcd, S_IWUGO, NULL, enable_lcd_files);
 
 static void interfacekit_irq(struct urb *urb, struct pt_regs *regs)
 {
-	struct phidget_interfacekit *kit = urb->context;
+	struct interfacekit *kit = urb->context;
 	unsigned char *buffer = kit->data;
+	int i, level, sensor;
 	int status;
-	int n;
 
 	switch (urb->status) {
 	case 0:			/* success */
@@ -280,22 +289,63 @@ static void interfacekit_irq(struct urb *urb, struct pt_regs *regs)
 		goto resubmit;
 	}
 
-	for (n=0; n<8; n++) {
-		kit->inputs[n] = buffer[1] & (1 << n) ? 1 : 0;
+	/* digital inputs */
+	if (kit->ifkit->inputs == 16) {
+		for (i=0; i < 8; i++) {
+			level = (buffer[0] >> i) & 1;
+			if (kit->inputs[i] != level) {
+				kit->inputs[i] = level;
+				set_bit(i, &kit->input_events);
+			}
+			level = (buffer[1] >> i) & 1;
+			if (kit->inputs[8 + i] != level) {
+				kit->inputs[8 + i] = level;
+				set_bit(8 + i, &kit->input_events);
+			}
+		}
+	}
+	else if (kit->ifkit->inputs == 8) {
+		for (i=0; i < 8; i++) {
+			level = (buffer[1] >> i) & 1;
+			if (kit->inputs[i] != level) {
+				kit->inputs[i] = level;
+				set_bit(i, &kit->input_events);
+			}
+		}
 	}
 
-	if (buffer[0] & 1) {
-		kit->sensors[4] = buffer[2] + (buffer[3] & 0x0f) * 256;
-		kit->sensors[5] = buffer[4] + (buffer[3] & 0xf0) * 16;
-		kit->sensors[6] = buffer[5] + (buffer[6] & 0x0f) * 256;
-		kit->sensors[7] = buffer[7] + (buffer[6] & 0xf0) * 16;
-	} else {
-		kit->sensors[0] = buffer[2] + (buffer[3] & 0x0f) * 256;
-		kit->sensors[1] = buffer[4] + (buffer[3] & 0xf0) * 16;
-		kit->sensors[2] = buffer[5] + (buffer[6] & 0x0f) * 256;
-		kit->sensors[3] = buffer[7] + (buffer[6] & 0xf0) * 16;
+	/* analog inputs */
+	if (kit->ifkit->sensors) {
+		sensor = (buffer[0] & 1) ? 4 : 0;
+
+		level = buffer[2] + (buffer[3] & 0x0f) * 256;
+		if (level != kit->sensors[sensor]) {
+			kit->sensors[sensor] = level;
+			set_bit(sensor, &kit->sensor_events);
+		}
+		sensor++;
+		level = buffer[4] + (buffer[3] & 0xf0) * 16;
+		if (level != kit->sensors[sensor]) {
+			kit->sensors[sensor] = level;
+			set_bit(sensor, &kit->sensor_events);
+		}
+		sensor++;
+		level = buffer[5] + (buffer[6] & 0x0f) * 256;
+		if (level != kit->sensors[sensor]) {
+			kit->sensors[sensor] = level;
+			set_bit(sensor, &kit->sensor_events);
+		}
+		sensor++;
+		level = buffer[7] + (buffer[6] & 0xf0) * 16;
+		if (level != kit->sensors[sensor]) {
+			kit->sensors[sensor] = level;
+			set_bit(sensor, &kit->sensor_events);
+		}
 	}
 
+	if (kit->input_events || kit->sensor_events)
+		schedule_work(&kit->do_notify);
+
 resubmit:
 	status = usb_submit_urb(urb, SLAB_ATOMIC);
 	if (status)
@@ -304,20 +354,40 @@ resubmit:
 			kit->udev->devpath, status);
 }
 
+static void do_notify(void *data)
+{
+	struct interfacekit *kit = data;
+	int i;
+	char sysfs_file[8];
+
+	for (i=0; i<kit->ifkit->inputs; i++) {
+		if (test_and_clear_bit(i, &kit->input_events)) {
+			sprintf(sysfs_file, "input%d", i + 1);
+			sysfs_notify(&kit->intf->dev.kobj, NULL, sysfs_file);
+		}
+	}
+
+	for (i=0; i<kit->ifkit->sensors; i++) {
+		if (test_and_clear_bit(i, &kit->sensor_events)) {
+			sprintf(sysfs_file, "sensor%d", i + 1);
+			sysfs_notify(&kit->intf->dev.kobj, NULL, sysfs_file);
+		}
+	}
+}
+
 #define show_set_output(value)		\
-static ssize_t set_output##value(struct device *dev, struct device_attribute *attr, const char *buf, 	\
+static ssize_t set_output##value(struct device *dev, struct device_attribute *attr, const char *buf,	\
 							size_t count)	\
 {									\
 	struct usb_interface *intf = to_usb_interface(dev);		\
-	struct phidget_interfacekit *kit = usb_get_intfdata(intf);	\
+	struct interfacekit *kit = usb_get_intfdata(intf);		\
 	int enabled;							\
 	int retval;							\
 									\
-	if (sscanf(buf, "%d", &enabled) < 1) {				\
+	if (sscanf(buf, "%d", &enabled) < 1)				\
 		return -EINVAL;						\
-	}								\
 									\
-	retval = change_outputs(kit, value - 1, enabled ? 1 : 0);	\
+	retval = change_outputs(kit, value - 1, enabled);		\
 									\
 	return retval ? retval : count;					\
 }									\
@@ -325,9 +395,9 @@ static ssize_t set_output##value(struct device *dev, struct device_attribute *at
 static ssize_t show_output##value(struct device *dev, struct device_attribute *attr, char *buf)	\
 {									\
 	struct usb_interface *intf = to_usb_interface(dev);		\
-	struct phidget_interfacekit *kit = usb_get_intfdata(intf);	\
+	struct interfacekit *kit = usb_get_intfdata(intf);		\
 									\
-	return sprintf(buf, "%d\n", kit->outputs[value - 1]);		\
+	return sprintf(buf, "%d\n", !!test_bit(value - 1, &kit->outputs));\
 }									\
 static DEVICE_ATTR(output##value, S_IWUGO | S_IRUGO,			\
 		show_output##value, set_output##value);
@@ -338,15 +408,23 @@ show_set_output(4);
 show_set_output(5);
 show_set_output(6);
 show_set_output(7);
-show_set_output(8);	/* should be MAX_INTERFACES - 1 */
+show_set_output(8);
+show_set_output(9);
+show_set_output(10);
+show_set_output(11);
+show_set_output(12);
+show_set_output(13);
+show_set_output(14);
+show_set_output(15);
+show_set_output(16);
 
 #define show_input(value)	\
 static ssize_t show_input##value(struct device *dev, struct device_attribute *attr, char *buf)	\
 {									\
 	struct usb_interface *intf = to_usb_interface(dev);		\
-	struct phidget_interfacekit *kit = usb_get_intfdata(intf);	\
+	struct interfacekit *kit = usb_get_intfdata(intf);		\
 									\
-	return sprintf(buf, "%d\n", kit->inputs[value - 1]);		\
+	return sprintf(buf, "%d\n", (int)kit->inputs[value - 1]);	\
 }									\
 static DEVICE_ATTR(input##value, S_IRUGO, show_input##value, NULL);
 
@@ -357,15 +435,23 @@ show_input(4);
 show_input(5);
 show_input(6);
 show_input(7);
-show_input(8);		/* should be MAX_INTERFACES - 1 */
+show_input(8);
+show_input(9);
+show_input(10);
+show_input(11);
+show_input(12);
+show_input(13);
+show_input(14);
+show_input(15);
+show_input(16);
 
 #define show_sensor(value)	\
 static ssize_t show_sensor##value(struct device *dev, struct device_attribute *attr, char *buf)	\
 {									\
 	struct usb_interface *intf = to_usb_interface(dev);		\
-	struct phidget_interfacekit *kit = usb_get_intfdata(intf);	\
+	struct interfacekit *kit = usb_get_intfdata(intf);		\
 									\
-	return sprintf(buf, "%d\n", kit->sensors[value - 1]);		\
+	return sprintf(buf, "%d\n", (int)kit->sensors[value - 1]);	\
 }									\
 static DEVICE_ATTR(sensor##value, S_IRUGO, show_sensor##value, NULL);
 
@@ -376,16 +462,16 @@ show_sensor(4);
 show_sensor(5);
 show_sensor(6);
 show_sensor(7);
-show_sensor(8);		/* should be MAX_INTERFACES - 1 */
+show_sensor(8);
 
 static int interfacekit_probe(struct usb_interface *intf, const struct usb_device_id *id)
 {
 	struct usb_device *dev = interface_to_usbdev(intf);
 	struct usb_host_interface *interface;
 	struct usb_endpoint_descriptor *endpoint;
-	struct phidget_interfacekit *kit;
+	struct interfacekit *kit;
 	struct driver_interfacekit *ifkit;
-	int pipe, maxp;
+	int pipe, maxp, rc = -ENOMEM;
 
 	ifkit = (struct driver_interfacekit *)id->driver_info;
 	if (!ifkit)
@@ -405,29 +491,23 @@ static int interfacekit_probe(struct usb_interface *intf, const struct usb_devic
 	maxp = usb_maxpacket(dev, pipe, usb_pipeout(pipe));
 	
 	kit = kzalloc(sizeof(*kit), GFP_KERNEL);
-	if (kit  == NULL) {
-		dev_err(&intf->dev, "%s - out of memory\n", __FUNCTION__);
-		return -ENOMEM;
-	}
-	kit->ifkit = ifkit;
+	if (!kit)
+		goto out;
 
-	kit->data = usb_buffer_alloc(dev, 8, SLAB_ATOMIC, &kit->data_dma);
-	if (!kit->data) {
-		kfree(kit);
-		return -ENOMEM;
-	}
+	kit->ifkit = ifkit;
+	kit->data = usb_buffer_alloc(dev, URB_INT_SIZE, SLAB_ATOMIC, &kit->data_dma);
+	if (!kit->data)
+		goto out;
 
 	kit->irq = usb_alloc_urb(0, GFP_KERNEL);
-	if (!kit->irq) {
-		usb_buffer_free(dev, 8, kit->data, kit->data_dma);
-		kfree(kit);
-		return -ENOMEM;
-	}
+	if (!kit->irq)
+		goto out;
 
 	kit->udev = usb_get_dev(dev);
 	kit->intf = intf;
+	INIT_WORK(&kit->do_notify, do_notify, kit);
 	usb_fill_int_urb(kit->irq, kit->udev, pipe, kit->data,
-			(maxp > 8 ? 8 : maxp),
+			maxp > URB_INT_SIZE ? URB_INT_SIZE : maxp,
 			interfacekit_irq, kit, endpoint->bInterval);
 	kit->irq->transfer_dma = kit->data_dma;
 	kit->irq->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
@@ -435,7 +515,8 @@ static int interfacekit_probe(struct usb_interface *intf, const struct usb_devic
 	usb_set_intfdata(intf, kit);
 
 	if (usb_submit_urb(kit->irq, GFP_KERNEL)) {
-		return -EIO;
+		rc = -EIO;
+		goto out;
 	}
 
 	if (ifkit->outputs >= 4) {
@@ -444,12 +525,22 @@ static int interfacekit_probe(struct usb_interface *intf, const struct usb_devic
 		device_create_file(&intf->dev, &dev_attr_output3);
 		device_create_file(&intf->dev, &dev_attr_output4);
 	}
-	if (ifkit->outputs == 8) {
+	if (ifkit->outputs >= 8) {
 		device_create_file(&intf->dev, &dev_attr_output5);
 		device_create_file(&intf->dev, &dev_attr_output6);
 		device_create_file(&intf->dev, &dev_attr_output7);
 		device_create_file(&intf->dev, &dev_attr_output8);
 	} 
+	if (ifkit->outputs == 16) {
+		device_create_file(&intf->dev, &dev_attr_output9);
+		device_create_file(&intf->dev, &dev_attr_output10);
+		device_create_file(&intf->dev, &dev_attr_output11);
+		device_create_file(&intf->dev, &dev_attr_output12);
+		device_create_file(&intf->dev, &dev_attr_output13);
+		device_create_file(&intf->dev, &dev_attr_output14);
+		device_create_file(&intf->dev, &dev_attr_output15);
+		device_create_file(&intf->dev, &dev_attr_output16);
+	}
 
 	if (ifkit->inputs >= 4) {
 		device_create_file(&intf->dev, &dev_attr_input1);
@@ -457,12 +548,22 @@ static int interfacekit_probe(struct usb_interface *intf, const struct usb_devic
 		device_create_file(&intf->dev, &dev_attr_input3);
 		device_create_file(&intf->dev, &dev_attr_input4);
 	}
-	if (ifkit->inputs == 8) {
+	if (ifkit->inputs >= 8) {
 		device_create_file(&intf->dev, &dev_attr_input5);
 		device_create_file(&intf->dev, &dev_attr_input6);
 		device_create_file(&intf->dev, &dev_attr_input7);
 		device_create_file(&intf->dev, &dev_attr_input8);
 	}
+	if (ifkit->inputs == 16) {
+		device_create_file(&intf->dev, &dev_attr_input9);
+		device_create_file(&intf->dev, &dev_attr_input10);
+		device_create_file(&intf->dev, &dev_attr_input11);
+		device_create_file(&intf->dev, &dev_attr_input12);
+		device_create_file(&intf->dev, &dev_attr_input13);
+		device_create_file(&intf->dev, &dev_attr_input14);
+		device_create_file(&intf->dev, &dev_attr_input15);
+		device_create_file(&intf->dev, &dev_attr_input16);
+	}
 
 	if (ifkit->sensors >= 4) {
 		device_create_file(&intf->dev, &dev_attr_sensor1);
@@ -475,9 +576,8 @@ static int interfacekit_probe(struct usb_interface *intf, const struct usb_devic
 		device_create_file(&intf->dev, &dev_attr_sensor6);
 		device_create_file(&intf->dev, &dev_attr_sensor7);
 	}
-	if (ifkit->sensors == 8) {
+	if (ifkit->sensors == 8)
 		device_create_file(&intf->dev, &dev_attr_sensor8);
-	}
 
 	if (ifkit->has_lcd)
 		device_create_file(&intf->dev, &dev_attr_lcd);
@@ -486,29 +586,56 @@ static int interfacekit_probe(struct usb_interface *intf, const struct usb_devic
 			ifkit->sensors, ifkit->inputs, ifkit->outputs);
 
 	return 0;
+
+out:
+	if (kit) {
+		if (kit->irq)
+			usb_free_urb(kit->irq);
+		if (kit->data)
+			usb_buffer_free(dev, URB_INT_SIZE, kit->data, kit->data_dma);
+		kfree(kit);
+	}
+
+	return rc;
 }
 
 static void interfacekit_disconnect(struct usb_interface *interface)
 {
-	struct phidget_interfacekit *kit;
+	struct interfacekit *kit;
 
 	kit = usb_get_intfdata(interface);
 	usb_set_intfdata(interface, NULL);
 	if (!kit)
 		return;
 
+	usb_kill_urb(kit->irq);
+	usb_free_urb(kit->irq);
+	usb_buffer_free(kit->udev, URB_INT_SIZE, kit->data, kit->data_dma);
+
+	cancel_delayed_work(&kit->do_notify);
+
 	if (kit->ifkit->outputs >= 4) {
 		device_remove_file(&interface->dev, &dev_attr_output1);
 		device_remove_file(&interface->dev, &dev_attr_output2);
 		device_remove_file(&interface->dev, &dev_attr_output3);
 		device_remove_file(&interface->dev, &dev_attr_output4);
 	}
-	if (kit->ifkit->outputs == 8) {
+	if (kit->ifkit->outputs >= 8) {
 		device_remove_file(&interface->dev, &dev_attr_output5);
 		device_remove_file(&interface->dev, &dev_attr_output6);
 		device_remove_file(&interface->dev, &dev_attr_output7);
 		device_remove_file(&interface->dev, &dev_attr_output8);
 	}
+	if (kit->ifkit->outputs == 16) {
+		device_remove_file(&interface->dev, &dev_attr_output9);
+		device_remove_file(&interface->dev, &dev_attr_output10);
+		device_remove_file(&interface->dev, &dev_attr_output11);
+		device_remove_file(&interface->dev, &dev_attr_output12);
+		device_remove_file(&interface->dev, &dev_attr_output13);
+		device_remove_file(&interface->dev, &dev_attr_output14);
+		device_remove_file(&interface->dev, &dev_attr_output15);
+		device_remove_file(&interface->dev, &dev_attr_output16);
+	}
 
 	if (kit->ifkit->inputs >= 4) {
 		device_remove_file(&interface->dev, &dev_attr_input1);
@@ -516,12 +643,22 @@ static void interfacekit_disconnect(struct usb_interface *interface)
 		device_remove_file(&interface->dev, &dev_attr_input3);
 		device_remove_file(&interface->dev, &dev_attr_input4);
 	}
-	if (kit->ifkit->inputs == 8) {
+	if (kit->ifkit->inputs >= 8) {
 		device_remove_file(&interface->dev, &dev_attr_input5);
 		device_remove_file(&interface->dev, &dev_attr_input6);
 		device_remove_file(&interface->dev, &dev_attr_input7);
 		device_remove_file(&interface->dev, &dev_attr_input8);
 	}
+	if (kit->ifkit->inputs == 16) {
+		device_remove_file(&interface->dev, &dev_attr_input9);
+		device_remove_file(&interface->dev, &dev_attr_input10);
+		device_remove_file(&interface->dev, &dev_attr_input11);
+		device_remove_file(&interface->dev, &dev_attr_input12);
+		device_remove_file(&interface->dev, &dev_attr_input13);
+		device_remove_file(&interface->dev, &dev_attr_input14);
+		device_remove_file(&interface->dev, &dev_attr_input15);
+		device_remove_file(&interface->dev, &dev_attr_input16);
+	}
 
 	if (kit->ifkit->sensors >= 4) {
 		device_remove_file(&interface->dev, &dev_attr_sensor1);
@@ -534,19 +671,15 @@ static void interfacekit_disconnect(struct usb_interface *interface)
 		device_remove_file(&interface->dev, &dev_attr_sensor6);
 		device_remove_file(&interface->dev, &dev_attr_sensor7);
 	}
-	if (kit->ifkit->sensors == 8) {
+	if (kit->ifkit->sensors == 8)
 		device_remove_file(&interface->dev, &dev_attr_sensor8);
-	}
+
 	if (kit->ifkit->has_lcd)
 		device_remove_file(&interface->dev, &dev_attr_lcd);
 
 	dev_info(&interface->dev, "USB PhidgetInterfaceKit %d/%d/%d detached\n",
 		kit->ifkit->sensors, kit->ifkit->inputs, kit->ifkit->outputs);
 
-	usb_kill_urb(kit->irq);
-	usb_free_urb(kit->irq);
-	usb_buffer_free(kit->udev, 8, kit->data, kit->data_dma);
-
 	usb_put_dev(kit->udev);
 	kfree(kit);
 }
diff --git a/drivers/usb/misc/sisusbvga/sisusb.c b/drivers/usb/misc/sisusbvga/sisusb.c
index 196c8794a73..738bd7c7451 100644
--- a/drivers/usb/misc/sisusbvga/sisusb.c
+++ b/drivers/usb/misc/sisusbvga/sisusb.c
@@ -37,6 +37,7 @@
  */
 
 #include <linux/config.h>
+#include <linux/mutex.h>
 #include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/signal.h>
@@ -52,6 +53,7 @@
 #include <linux/vmalloc.h>
 
 #include "sisusb.h"
+#include "sisusb_init.h"
 
 #ifdef INCL_SISUSB_CON
 #include <linux/font.h>
@@ -62,36 +64,6 @@
 /* Forward declarations / clean-up routines */
 
 #ifdef INCL_SISUSB_CON
-int	sisusb_setreg(struct sisusb_usb_data *sisusb, int port, u8 data);
-int	sisusb_getreg(struct sisusb_usb_data *sisusb, int port, u8 *data);
-int	sisusb_setidxreg(struct sisusb_usb_data *sisusb, int port, u8 index, u8 data);
-int	sisusb_getidxreg(struct sisusb_usb_data *sisusb, int port, u8 index, u8 *data);
-int	sisusb_setidxregandor(struct sisusb_usb_data *sisusb, int port, u8 idx,	u8 myand, u8 myor);
-int	sisusb_setidxregor(struct sisusb_usb_data *sisusb, int port, u8 index, u8 myor);
-int	sisusb_setidxregand(struct sisusb_usb_data *sisusb, int port, u8 idx, u8 myand);
-
-int	sisusb_writeb(struct sisusb_usb_data *sisusb, u32 adr, u8 data);
-int	sisusb_readb(struct sisusb_usb_data *sisusb, u32 adr, u8 *data);
-int	sisusb_writew(struct sisusb_usb_data *sisusb, u32 adr, u16 data);
-int	sisusb_readw(struct sisusb_usb_data *sisusb, u32 adr, u16 *data);
-int	sisusb_copy_memory(struct sisusb_usb_data *sisusb, char *src,
-			u32 dest, int length, size_t *bytes_written);
-
-int	sisusb_reset_text_mode(struct sisusb_usb_data *sisusb, int init);
-
-extern int  SiSUSBSetMode(struct SiS_Private *SiS_Pr, unsigned short ModeNo);
-extern int  SiSUSBSetVESAMode(struct SiS_Private *SiS_Pr, unsigned short VModeNo);
-
-extern void sisusb_init_concode(void);
-extern int  sisusb_console_init(struct sisusb_usb_data *sisusb, int first, int last);
-extern void sisusb_console_exit(struct sisusb_usb_data *sisusb);
-
-extern void sisusb_set_cursor(struct sisusb_usb_data *sisusb, unsigned int location);
-
-extern int  sisusbcon_do_font_op(struct sisusb_usb_data *sisusb, int set, int slot,
-		u8 *arg, int cmapsz, int ch512, int dorecalc,
-		struct vc_data *c, int fh, int uplock);
-
 static int sisusb_first_vc = 0;
 static int sisusb_last_vc = 0;
 module_param_named(first, sisusb_first_vc, int, 0);
@@ -102,7 +74,7 @@ MODULE_PARM_DESC(last, "Number of last console to take over (1 - MAX_NR_CONSOLES
 
 static struct usb_driver sisusb_driver;
 
-DECLARE_MUTEX(disconnect_sem);
+DEFINE_MUTEX(disconnect_mutex);
 
 static void
 sisusb_free_buffers(struct sisusb_usb_data *sisusb)
@@ -1359,9 +1331,6 @@ sisusb_getreg(struct sisusb_usb_data *sisusb, int port, u8 *data)
 }
 #endif
 
-#ifndef INCL_SISUSB_CON
-static
-#endif
 int
 sisusb_setidxreg(struct sisusb_usb_data *sisusb, int port, u8 index, u8 data)
 {
@@ -1371,9 +1340,6 @@ sisusb_setidxreg(struct sisusb_usb_data *sisusb, int port, u8 index, u8 data)
 	return ret;
 }
 
-#ifndef INCL_SISUSB_CON
-static
-#endif
 int
 sisusb_getidxreg(struct sisusb_usb_data *sisusb, int port, u8 index, u8 *data)
 {
@@ -1383,9 +1349,6 @@ sisusb_getidxreg(struct sisusb_usb_data *sisusb, int port, u8 index, u8 *data)
 	return ret;
 }
 
-#ifndef INCL_SISUSB_CON
-static
-#endif
 int
 sisusb_setidxregandor(struct sisusb_usb_data *sisusb, int port, u8 idx,
 							u8 myand, u8 myor)
@@ -1415,18 +1378,12 @@ sisusb_setidxregmask(struct sisusb_usb_data *sisusb, int port, u8 idx,
 	return ret;
 }
 
-#ifndef INCL_SISUSB_CON
-static
-#endif
 int
 sisusb_setidxregor(struct sisusb_usb_data *sisusb, int port, u8 index, u8 myor)
 {
 	return(sisusb_setidxregandor(sisusb, port, index, 0xff, myor));
 }
 
-#ifndef INCL_SISUSB_CON
-static
-#endif
 int
 sisusb_setidxregand(struct sisusb_usb_data *sisusb, int port, u8 idx, u8 myand)
 {
@@ -1448,6 +1405,8 @@ sisusb_readb(struct sisusb_usb_data *sisusb, u32 adr, u8 *data)
 	return(sisusb_read_memio_byte(sisusb, SISUSB_TYPE_MEM, adr, data));
 }
 
+#if 0
+
 int
 sisusb_writew(struct sisusb_usb_data *sisusb, u32 adr, u16 data)
 {
@@ -1460,6 +1419,8 @@ sisusb_readw(struct sisusb_usb_data *sisusb, u32 adr, u16 *data)
 	return(sisusb_read_memio_word(sisusb, SISUSB_TYPE_MEM, adr, data));
 }
 
+#endif  /*  0  */
+
 int
 sisusb_copy_memory(struct sisusb_usb_data *sisusb, char *src,
 			u32 dest, int length, size_t *bytes_written)
@@ -2552,39 +2513,39 @@ sisusb_open(struct inode *inode, struct file *file)
 	struct usb_interface *interface;
 	int subminor = iminor(inode);
 
-	down(&disconnect_sem);
+	mutex_lock(&disconnect_mutex);
 
 	if (!(interface = usb_find_interface(&sisusb_driver, subminor))) {
 		printk(KERN_ERR "sisusb[%d]: Failed to find interface\n",
 				subminor);
-		up(&disconnect_sem);
+		mutex_unlock(&disconnect_mutex);
 		return -ENODEV;
 	}
 
 	if (!(sisusb = usb_get_intfdata(interface))) {
-		up(&disconnect_sem);
+		mutex_unlock(&disconnect_mutex);
 		return -ENODEV;
 	}
 
-	down(&sisusb->lock);
+	mutex_lock(&sisusb->lock);
 
 	if (!sisusb->present || !sisusb->ready) {
-		up(&sisusb->lock);
-		up(&disconnect_sem);
+		mutex_unlock(&sisusb->lock);
+		mutex_unlock(&disconnect_mutex);
 		return -ENODEV;
 	}
 
 	if (sisusb->isopen) {
-		up(&sisusb->lock);
-		up(&disconnect_sem);
+		mutex_unlock(&sisusb->lock);
+		mutex_unlock(&disconnect_mutex);
 		return -EBUSY;
 	}
 
 	if (!sisusb->devinit) {
 		if (sisusb->sisusb_dev->speed == USB_SPEED_HIGH) {
 			if (sisusb_init_gfxdevice(sisusb, 0)) {
-				up(&sisusb->lock);
-				up(&disconnect_sem);
+				mutex_unlock(&sisusb->lock);
+				mutex_unlock(&disconnect_mutex);
 				printk(KERN_ERR
 					"sisusbvga[%d]: Failed to initialize "
 					"device\n",
@@ -2592,8 +2553,8 @@ sisusb_open(struct inode *inode, struct file *file)
 				return -EIO;
 			}
 		} else {
-			up(&sisusb->lock);
-			up(&disconnect_sem);
+			mutex_unlock(&sisusb->lock);
+			mutex_unlock(&disconnect_mutex);
 			printk(KERN_ERR
 				"sisusbvga[%d]: Device not attached to "
 				"USB 2.0 hub\n",
@@ -2609,9 +2570,9 @@ sisusb_open(struct inode *inode, struct file *file)
 
 	file->private_data = sisusb;
 
-	up(&sisusb->lock);
+	mutex_unlock(&sisusb->lock);
 
-	up(&disconnect_sem);
+	mutex_unlock(&disconnect_mutex);
 
 	return 0;
 }
@@ -2642,14 +2603,14 @@ sisusb_release(struct inode *inode, struct file *file)
 	struct sisusb_usb_data *sisusb;
 	int myminor;
 
-	down(&disconnect_sem);
+	mutex_lock(&disconnect_mutex);
 
 	if (!(sisusb = (struct sisusb_usb_data *)file->private_data)) {
-		up(&disconnect_sem);
+		mutex_unlock(&disconnect_mutex);
 		return -ENODEV;
 	}
 
-	down(&sisusb->lock);
+	mutex_lock(&sisusb->lock);
 
 	if (sisusb->present) {
 		/* Wait for all URBs to finish if device still present */
@@ -2662,12 +2623,12 @@ sisusb_release(struct inode *inode, struct file *file)
 	sisusb->isopen = 0;
 	file->private_data = NULL;
 
-	up(&sisusb->lock);
+	mutex_unlock(&sisusb->lock);
 
 	/* decrement the usage count on our device */
 	kref_put(&sisusb->kref, sisusb_delete);
 
-	up(&disconnect_sem);
+	mutex_unlock(&disconnect_mutex);
 
 	return 0;
 }
@@ -2685,11 +2646,11 @@ sisusb_read(struct file *file, char __user *buffer, size_t count, loff_t *ppos)
 	if (!(sisusb = (struct sisusb_usb_data *)file->private_data))
 		return -ENODEV;
 
-	down(&sisusb->lock);
+	mutex_lock(&sisusb->lock);
 
 	/* Sanity check */
 	if (!sisusb->present || !sisusb->ready || !sisusb->sisusb_dev) {
-		up(&sisusb->lock);
+		mutex_unlock(&sisusb->lock);
 		return -ENODEV;
 	}
 
@@ -2784,7 +2745,7 @@ sisusb_read(struct file *file, char __user *buffer, size_t count, loff_t *ppos)
 		    (*ppos) <= SISUSB_PCI_PSEUDO_PCIBASE + 0x5c) {
 
 		if (count != 4) {
-			up(&sisusb->lock);
+			mutex_unlock(&sisusb->lock);
 			return -EINVAL;
 		}
 
@@ -2808,7 +2769,7 @@ sisusb_read(struct file *file, char __user *buffer, size_t count, loff_t *ppos)
 
 	(*ppos) += bytes_read;
 
-	up(&sisusb->lock);
+	mutex_unlock(&sisusb->lock);
 
 	return errno ? errno : bytes_read;
 }
@@ -2827,11 +2788,11 @@ sisusb_write(struct file *file, const char __user *buffer, size_t count,
 	if (!(sisusb = (struct sisusb_usb_data *)file->private_data))
 		return -ENODEV;
 
-	down(&sisusb->lock);
+	mutex_lock(&sisusb->lock);
 
 	/* Sanity check */
 	if (!sisusb->present || !sisusb->ready || !sisusb->sisusb_dev) {
-		up(&sisusb->lock);
+		mutex_unlock(&sisusb->lock);
 		return -ENODEV;
 	}
 
@@ -2930,7 +2891,7 @@ sisusb_write(struct file *file, const char __user *buffer, size_t count,
 		    (*ppos) <= SISUSB_PCI_PSEUDO_PCIBASE + SISUSB_PCI_PCONFSIZE) {
 
 		if (count != 4) {
-			up(&sisusb->lock);
+			mutex_unlock(&sisusb->lock);
 			return -EINVAL;
 		}
 
@@ -2956,7 +2917,7 @@ sisusb_write(struct file *file, const char __user *buffer, size_t count,
 
 	(*ppos) += bytes_written;
 
-	up(&sisusb->lock);
+	mutex_unlock(&sisusb->lock);
 
 	return errno ? errno : bytes_written;
 }
@@ -2970,11 +2931,11 @@ sisusb_lseek(struct file *file, loff_t offset, int orig)
 	if (!(sisusb = (struct sisusb_usb_data *)file->private_data))
 		return -ENODEV;
 
-	down(&sisusb->lock);
+	mutex_lock(&sisusb->lock);
 
 	/* Sanity check */
 	if (!sisusb->present || !sisusb->ready || !sisusb->sisusb_dev) {
-		up(&sisusb->lock);
+		mutex_unlock(&sisusb->lock);
 		return -ENODEV;
 	}
 
@@ -2994,7 +2955,7 @@ sisusb_lseek(struct file *file, loff_t offset, int orig)
 			ret = -EINVAL;
 	}
 
-	up(&sisusb->lock);
+	mutex_unlock(&sisusb->lock);
 	return ret;
 }
 
@@ -3136,7 +3097,7 @@ sisusb_ioctl(struct inode *inode, struct file *file, unsigned int cmd,
 	if (!(sisusb = (struct sisusb_usb_data *)file->private_data))
 		return -ENODEV;
 
-	down(&sisusb->lock);
+	mutex_lock(&sisusb->lock);
 
 	/* Sanity check */
 	if (!sisusb->present || !sisusb->ready || !sisusb->sisusb_dev) {
@@ -3193,7 +3154,7 @@ sisusb_ioctl(struct inode *inode, struct file *file, unsigned int cmd,
 	}
 
 err_out:
-	up(&sisusb->lock);
+	mutex_unlock(&sisusb->lock);
 	return retval;
 }
 
@@ -3258,7 +3219,7 @@ static int sisusb_probe(struct usb_interface *intf,
 	}
 	kref_init(&sisusb->kref);
 
-	init_MUTEX(&(sisusb->lock));
+	mutex_init(&(sisusb->lock));
 
 	/* Register device */
 	if ((retval = usb_register_dev(intf, &usb_sisusb_class))) {
@@ -3429,9 +3390,9 @@ static void sisusb_disconnect(struct usb_interface *intf)
 	 * protect all other routines from the disconnect
 	 * case, not the other way round.
 	 */
-	down(&disconnect_sem);
+	mutex_lock(&disconnect_mutex);
 
-	down(&sisusb->lock);
+	mutex_lock(&sisusb->lock);
 
 	/* Wait for all URBs to complete and kill them in case (MUST do) */
 	if (!sisusb_wait_all_out_complete(sisusb))
@@ -3462,12 +3423,12 @@ static void sisusb_disconnect(struct usb_interface *intf)
 	sisusb->present = 0;
 	sisusb->ready = 0;
 
-	up(&sisusb->lock);
+	mutex_unlock(&sisusb->lock);
 
 	/* decrement our usage count */
 	kref_put(&sisusb->kref, sisusb_delete);
 
-	up(&disconnect_sem);
+	mutex_unlock(&disconnect_mutex);
 
 	printk(KERN_INFO "sisusbvga[%d]: Disconnected\n", minor);
 }
diff --git a/drivers/usb/misc/sisusbvga/sisusb.h b/drivers/usb/misc/sisusbvga/sisusb.h
index a716825d1f9..8e1120a6480 100644
--- a/drivers/usb/misc/sisusbvga/sisusb.h
+++ b/drivers/usb/misc/sisusbvga/sisusb.h
@@ -41,6 +41,8 @@
 #define SISUSB_NEW_CONFIG_COMPAT
 #endif
 
+#include <linux/mutex.h>
+
 /* For older kernels, support for text consoles is by default
  * off. To ensable text console support, change the following:
  */
@@ -60,11 +62,9 @@
 #define INCL_SISUSB_CON		1
 #endif
 
-#ifdef INCL_SISUSB_CON
 #include <linux/console.h>
 #include <linux/vt_kern.h>
 #include "sisusb_struct.h"
-#endif
 
 /* USB related */
 
@@ -116,7 +116,7 @@ struct sisusb_usb_data {
 	struct usb_interface *interface;
 	struct kref kref;
 	wait_queue_head_t wait_q;	/* for syncind and timeouts */
-	struct semaphore lock;		/* general race avoidance */
+	struct mutex lock;		/* general race avoidance */
 	unsigned int ifnum;		/* interface number of the USB device */
 	int minor;			/* minor (for logging clarity) */
 	int isopen;			/* !=0 if open */
diff --git a/drivers/usb/misc/sisusbvga/sisusb_con.c b/drivers/usb/misc/sisusbvga/sisusb_con.c
index be5c1a25ae2..fb48feca835 100644
--- a/drivers/usb/misc/sisusbvga/sisusb_con.c
+++ b/drivers/usb/misc/sisusbvga/sisusb_con.c
@@ -48,6 +48,7 @@
  */
 
 #include <linux/config.h>
+#include <linux/mutex.h>
 #include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/signal.h>
@@ -69,27 +70,9 @@
 #include <linux/vmalloc.h>
 
 #include "sisusb.h"
+#include "sisusb_init.h"
 
 #ifdef INCL_SISUSB_CON
-extern int sisusb_setreg(struct sisusb_usb_data *, int, u8);
-extern int sisusb_getreg(struct sisusb_usb_data *, int, u8 *);
-extern int sisusb_setidxreg(struct sisusb_usb_data *, int, u8, u8);
-extern int sisusb_getidxreg(struct sisusb_usb_data *, int, u8, u8 *);
-extern int sisusb_setidxregor(struct sisusb_usb_data *, int, u8, u8);
-extern int sisusb_setidxregand(struct sisusb_usb_data *, int, u8, u8);
-extern int sisusb_setidxregandor(struct sisusb_usb_data *, int, u8, u8, u8);
-
-extern int sisusb_writeb(struct sisusb_usb_data *sisusb, u32 adr, u8 data);
-extern int sisusb_readb(struct sisusb_usb_data *sisusb, u32 adr, u8 *data);
-extern int sisusb_writew(struct sisusb_usb_data *sisusb, u32 adr, u16 data);
-extern int sisusb_readw(struct sisusb_usb_data *sisusb, u32 adr, u16 *data);
-extern int sisusb_copy_memory(struct sisusb_usb_data *sisusb, char *src,
-			u32 dest, int length, size_t *bytes_written);
-
-extern void sisusb_delete(struct kref *kref);
-extern int sisusb_reset_text_mode(struct sisusb_usb_data *sisusb, int init);
-
-extern int SiSUSBSetMode(struct SiS_Private *SiS_Pr, unsigned short ModeNo);
 
 #define sisusbcon_writew(val, addr)	(*(addr) = (val))
 #define sisusbcon_readw(addr)		(*(addr))
@@ -102,8 +85,6 @@ static struct sisusb_usb_data *mysisusbs[MAX_NR_CONSOLES];
 /* Forward declaration */
 static const struct consw sisusb_con;
 
-extern struct semaphore disconnect_sem;
-
 static inline void
 sisusbcon_memsetw(u16 *s, u16 c, unsigned int count)
 {
@@ -194,11 +175,11 @@ sisusb_get_sisusb_lock_and_check(unsigned short console)
 	if (!(sisusb = sisusb_get_sisusb(console)))
 		return NULL;
 
-	down(&sisusb->lock);
+	mutex_lock(&sisusb->lock);
 
 	if (!sisusb_sisusb_valid(sisusb) ||
 	    !sisusb->havethisconsole[console]) {
-		up(&sisusb->lock);
+		mutex_unlock(&sisusb->lock);
 		return NULL;
 	}
 
@@ -236,18 +217,18 @@ sisusbcon_init(struct vc_data *c, int init)
 	 * are set up/restored.
 	 */
 
-	down(&disconnect_sem);
+	mutex_lock(&disconnect_mutex);
 
 	if (!(sisusb = sisusb_get_sisusb(c->vc_num))) {
-		up(&disconnect_sem);
+		mutex_unlock(&disconnect_mutex);
 		return;
 	}
 
-	down(&sisusb->lock);
+	mutex_lock(&sisusb->lock);
 
 	if (!sisusb_sisusb_valid(sisusb)) {
-		up(&sisusb->lock);
-		up(&disconnect_sem);
+		mutex_unlock(&sisusb->lock);
+		mutex_unlock(&disconnect_mutex);
 		return;
 	}
 
@@ -284,9 +265,9 @@ sisusbcon_init(struct vc_data *c, int init)
 	if (!*c->vc_uni_pagedir_loc)
 		con_set_default_unimap(c);
 
-	up(&sisusb->lock);
+	mutex_unlock(&sisusb->lock);
 
-	up(&disconnect_sem);
+	mutex_unlock(&disconnect_mutex);
 
 	if (init) {
 		c->vc_cols = cols;
@@ -306,14 +287,14 @@ sisusbcon_deinit(struct vc_data *c)
 	 * and others, ie not under our control.
 	 */
 
-	down(&disconnect_sem);
+	mutex_lock(&disconnect_mutex);
 
 	if (!(sisusb = sisusb_get_sisusb(c->vc_num))) {
-		up(&disconnect_sem);
+		mutex_unlock(&disconnect_mutex);
 		return;
 	}
 
-	down(&sisusb->lock);
+	mutex_lock(&sisusb->lock);
 
 	/* Clear ourselves in mysisusbs */
 	mysisusbs[c->vc_num] = NULL;
@@ -332,12 +313,12 @@ sisusbcon_deinit(struct vc_data *c)
 		}
 	}
 
-	up(&sisusb->lock);
+	mutex_unlock(&sisusb->lock);
 
 	/* decrement the usage count on our sisusb */
 	kref_put(&sisusb->kref, sisusb_delete);
 
-	up(&disconnect_sem);
+	mutex_unlock(&disconnect_mutex);
 }
 
 /* interface routine */
@@ -417,7 +398,7 @@ sisusbcon_putc(struct vc_data *c, int ch, int y, int x)
 #endif
 
 	if (sisusb_is_inactive(c, sisusb)) {
-		up(&sisusb->lock);
+		mutex_unlock(&sisusb->lock);
 		return;
 	}
 
@@ -425,7 +406,7 @@ sisusbcon_putc(struct vc_data *c, int ch, int y, int x)
 	sisusb_copy_memory(sisusb, (char *)SISUSB_VADDR(x, y),
 				(u32)SISUSB_HADDR(x, y), 2, &written);
 
-	up(&sisusb->lock);
+	mutex_unlock(&sisusb->lock);
 }
 
 /* Interface routine */
@@ -453,14 +434,14 @@ sisusbcon_putcs(struct vc_data *c, const unsigned short *s,
 		sisusbcon_writew(sisusbcon_readw(s++), dest++);
 
 	if (sisusb_is_inactive(c, sisusb)) {
-		up(&sisusb->lock);
+		mutex_unlock(&sisusb->lock);
 		return;
 	}
 
 	sisusb_copy_memory(sisusb, (char *)SISUSB_VADDR(x, y),
 				(u32)SISUSB_HADDR(x, y), count * 2, &written);
 
-	up(&sisusb->lock);
+	mutex_unlock(&sisusb->lock);
 }
 
 /* Interface routine */
@@ -504,7 +485,7 @@ sisusbcon_clear(struct vc_data *c, int y, int x, int height, int width)
 	}
 
 	if (sisusb_is_inactive(c, sisusb)) {
-		up(&sisusb->lock);
+		mutex_unlock(&sisusb->lock);
 		return;
 	}
 
@@ -514,7 +495,7 @@ sisusbcon_clear(struct vc_data *c, int y, int x, int height, int width)
 	sisusb_copy_memory(sisusb, (unsigned char *)SISUSB_VADDR(x, y),
 				(u32)SISUSB_HADDR(x, y), length, &written);
 
-	up(&sisusb->lock);
+	mutex_unlock(&sisusb->lock);
 }
 
 /* Interface routine */
@@ -576,7 +557,7 @@ sisusbcon_bmove(struct vc_data *c, int sy, int sx,
 #endif
 
 	if (sisusb_is_inactive(c, sisusb)) {
-		up(&sisusb->lock);
+		mutex_unlock(&sisusb->lock);
 		return;
 	}
 
@@ -586,7 +567,7 @@ sisusbcon_bmove(struct vc_data *c, int sy, int sx,
 	sisusb_copy_memory(sisusb, (unsigned char *)SISUSB_VADDR(dx, dy),
 				(u32)SISUSB_HADDR(dx, dy), length, &written);
 
-	up(&sisusb->lock);
+	mutex_unlock(&sisusb->lock);
 }
 
 /* interface routine */
@@ -609,7 +590,7 @@ sisusbcon_switch(struct vc_data *c)
 
 	/* Don't write to screen if in gfx mode */
 	if (sisusb_is_inactive(c, sisusb)) {
-		up(&sisusb->lock);
+		mutex_unlock(&sisusb->lock);
 		return 0;
 	}
 
@@ -618,7 +599,7 @@ sisusbcon_switch(struct vc_data *c)
 	 * as origin.
 	 */
 	if (c->vc_origin == (unsigned long)c->vc_screenbuf) {
-		up(&sisusb->lock);
+		mutex_unlock(&sisusb->lock);
 		printk(KERN_DEBUG "sisusb: ASSERT ORIGIN != SCREENBUF!\n");
 		return 0;
 	}
@@ -635,7 +616,7 @@ sisusbcon_switch(struct vc_data *c)
 				(u32)SISUSB_HADDR(0, 0),
 				length, &written);
 
-	up(&sisusb->lock);
+	mutex_unlock(&sisusb->lock);
 
 	return 0;
 }
@@ -657,7 +638,7 @@ sisusbcon_save_screen(struct vc_data *c)
 	/* sisusb->lock is down */
 
 	if (sisusb_is_inactive(c, sisusb)) {
-		up(&sisusb->lock);
+		mutex_unlock(&sisusb->lock);
 		return;
 	}
 
@@ -669,7 +650,7 @@ sisusbcon_save_screen(struct vc_data *c)
 	sisusbcon_memcpyw((u16 *)c->vc_screenbuf, (u16 *)c->vc_origin,
 								length);
 
-	up(&sisusb->lock);
+	mutex_unlock(&sisusb->lock);
 }
 
 /* interface routine */
@@ -690,7 +671,7 @@ sisusbcon_set_palette(struct vc_data *c, unsigned char *table)
 	/* sisusb->lock is down */
 
 	if (sisusb_is_inactive(c, sisusb)) {
-		up(&sisusb->lock);
+		mutex_unlock(&sisusb->lock);
 		return -EINVAL;
 	}
 
@@ -705,7 +686,7 @@ sisusbcon_set_palette(struct vc_data *c, unsigned char *table)
 			break;
 	}
 
-	up(&sisusb->lock);
+	mutex_unlock(&sisusb->lock);
 
 	return 0;
 }
@@ -728,7 +709,7 @@ sisusbcon_blank(struct vc_data *c, int blank, int mode_switch)
 		sisusb->is_gfx = blank ? 1 : 0;
 
 	if (sisusb_is_inactive(c, sisusb)) {
-		up(&sisusb->lock);
+		mutex_unlock(&sisusb->lock);
 		return 0;
 	}
 
@@ -777,7 +758,7 @@ sisusbcon_blank(struct vc_data *c, int blank, int mode_switch)
 			cr63  = 0x40;
 			break;
 		default:
-			up(&sisusb->lock);
+			mutex_unlock(&sisusb->lock);
 			return -EINVAL;
 		}
 
@@ -788,7 +769,7 @@ sisusbcon_blank(struct vc_data *c, int blank, int mode_switch)
 
 	}
 
-	up(&sisusb->lock);
+	mutex_unlock(&sisusb->lock);
 
 	return ret;
 }
@@ -809,7 +790,7 @@ sisusbcon_scrolldelta(struct vc_data *c, int lines)
 	/* sisusb->lock is down */
 
 	if (sisusb_is_inactive(c, sisusb)) {
-		up(&sisusb->lock);
+		mutex_unlock(&sisusb->lock);
 		return 0;
 	}
 
@@ -849,7 +830,7 @@ sisusbcon_scrolldelta(struct vc_data *c, int lines)
 
 	sisusbcon_set_start_address(sisusb, c);
 
-	up(&sisusb->lock);
+	mutex_unlock(&sisusb->lock);
 
 	return 1;
 }
@@ -867,7 +848,7 @@ sisusbcon_cursor(struct vc_data *c, int mode)
 	/* sisusb->lock is down */
 
 	if (sisusb_is_inactive(c, sisusb)) {
-		up(&sisusb->lock);
+		mutex_unlock(&sisusb->lock);
 		return;
 	}
 
@@ -879,7 +860,7 @@ sisusbcon_cursor(struct vc_data *c, int mode)
 	if (mode == CM_ERASE) {
 		sisusb_setidxregor(sisusb, SISCR, 0x0a, 0x20);
 		sisusb->sisusb_cursor_size_to = -1;
-		up(&sisusb->lock);
+		mutex_unlock(&sisusb->lock);
 		return;
 	}
 
@@ -919,7 +900,7 @@ sisusbcon_cursor(struct vc_data *c, int mode)
 		sisusb->sisusb_cursor_size_to   = to;
 	}
 
-	up(&sisusb->lock);
+	mutex_unlock(&sisusb->lock);
 }
 
 static int
@@ -961,7 +942,7 @@ sisusbcon_scroll_area(struct vc_data *c, struct sisusb_usb_data *sisusb,
 	sisusb_copy_memory(sisusb, (char *)SISUSB_VADDR(0, t),
 				(u32)SISUSB_HADDR(0, t), length, &written);
 
-	up(&sisusb->lock);
+	mutex_unlock(&sisusb->lock);
 
 	return 1;
 }
@@ -994,7 +975,7 @@ sisusbcon_scroll(struct vc_data *c, int t, int b, int dir, int lines)
 	/* sisusb->lock is down */
 
 	if (sisusb_is_inactive(c, sisusb)) {
-		up(&sisusb->lock);
+		mutex_unlock(&sisusb->lock);
 		return 0;
 	}
 
@@ -1084,7 +1065,7 @@ sisusbcon_scroll(struct vc_data *c, int t, int b, int dir, int lines)
 
 	c->vc_pos = c->vc_pos - oldorigin + c->vc_origin;
 
-	up(&sisusb->lock);
+	mutex_unlock(&sisusb->lock);
 
 	return 1;
 }
@@ -1106,7 +1087,7 @@ sisusbcon_set_origin(struct vc_data *c)
 	/* sisusb->lock is down */
 
 	if (sisusb_is_inactive(c, sisusb) || sisusb->con_blanked) {
-		up(&sisusb->lock);
+		mutex_unlock(&sisusb->lock);
 		return 0;
 	}
 
@@ -1116,7 +1097,7 @@ sisusbcon_set_origin(struct vc_data *c)
 
 	sisusb->con_rolled_over = 0;
 
-	up(&sisusb->lock);
+	mutex_unlock(&sisusb->lock);
 
 	return 1;
 }
@@ -1133,7 +1114,7 @@ sisusbcon_resize(struct vc_data *c, unsigned int newcols, unsigned int newrows)
 
 	fh = sisusb->current_font_height;
 
-	up(&sisusb->lock);
+	mutex_unlock(&sisusb->lock);
 
 	/* We are quite unflexible as regards resizing. The vt code
 	 * handles sizes where the line length isn't equal the pitch
@@ -1167,7 +1148,7 @@ sisusbcon_do_font_op(struct sisusb_usb_data *sisusb, int set, int slot,
 
 	if ((slot != 0 && slot != 2) || !fh) {
 		if (uplock)
-			up(&sisusb->lock);
+			mutex_unlock(&sisusb->lock);
 		return -EINVAL;
 	}
 
@@ -1327,7 +1308,7 @@ sisusbcon_do_font_op(struct sisusb_usb_data *sisusb, int set, int slot,
 	}
 
 	if (uplock)
-		up(&sisusb->lock);
+		mutex_unlock(&sisusb->lock);
 
 	if (dorecalc && c) {
 		int i, rows = c->vc_scan_lines / fh;
@@ -1351,7 +1332,7 @@ sisusbcon_do_font_op(struct sisusb_usb_data *sisusb, int set, int slot,
 
 font_op_error:
 	if (uplock)
-		up(&sisusb->lock);
+		mutex_unlock(&sisusb->lock);
 
 	return -EIO;
 }
@@ -1417,19 +1398,19 @@ sisusbcon_font_get(struct vc_data *c, struct console_font *font)
 	font->charcount = 256;
 
 	if (!font->data) {
-		up(&sisusb->lock);
+		mutex_unlock(&sisusb->lock);
 		return 0;
 	}
 
 	if (!sisusb->font_backup) {
-		up(&sisusb->lock);
+		mutex_unlock(&sisusb->lock);
 		return -ENODEV;
 	}
 
 	/* Copy 256 chars only, like vgacon */
 	memcpy(font->data, sisusb->font_backup, 256 * 32);
 
-	up(&sisusb->lock);
+	mutex_unlock(&sisusb->lock);
 
 	return 0;
 }
@@ -1486,7 +1467,7 @@ static int sisusbdummycon_dummy(void)
 
 #define SISUSBCONDUMMY	(void *)sisusbdummycon_dummy
 
-const struct consw sisusb_dummy_con = {
+static const struct consw sisusb_dummy_con = {
 	.owner =		THIS_MODULE,
 	.con_startup =		sisusbdummycon_startup,
 	.con_init =		sisusbdummycon_init,
@@ -1512,14 +1493,14 @@ sisusb_console_init(struct sisusb_usb_data *sisusb, int first, int last)
 {
 	int i, ret, minor = sisusb->minor;
 
-	down(&disconnect_sem);
+	mutex_lock(&disconnect_mutex);
 
-	down(&sisusb->lock);
+	mutex_lock(&sisusb->lock);
 
 	/* Erm.. that should not happen */
 	if (sisusb->haveconsole || !sisusb->SiS_Pr) {
-		up(&sisusb->lock);
-		up(&disconnect_sem);
+		mutex_unlock(&sisusb->lock);
+		mutex_unlock(&disconnect_mutex);
 		return 1;
 	}
 
@@ -1529,15 +1510,15 @@ sisusb_console_init(struct sisusb_usb_data *sisusb, int first, int last)
 	if (first > last ||
 	    first > MAX_NR_CONSOLES ||
 	    last > MAX_NR_CONSOLES) {
-		up(&sisusb->lock);
-		up(&disconnect_sem);
+		mutex_unlock(&sisusb->lock);
+		mutex_unlock(&disconnect_mutex);
 		return 1;
 	}
 
 	/* If gfxcore not initialized or no consoles given, quit graciously */
 	if (!sisusb->gfxinit || first < 1 || last < 1) {
-		up(&sisusb->lock);
-		up(&disconnect_sem);
+		mutex_unlock(&sisusb->lock);
+		mutex_unlock(&disconnect_mutex);
 		return 0;
 	}
 
@@ -1547,8 +1528,8 @@ sisusb_console_init(struct sisusb_usb_data *sisusb, int first, int last)
 
 	/* Set up text mode (and upload  default font) */
 	if (sisusb_reset_text_mode(sisusb, 1)) {
-		up(&sisusb->lock);
-		up(&disconnect_sem);
+		mutex_unlock(&sisusb->lock);
+		mutex_unlock(&disconnect_mutex);
 		printk(KERN_ERR
 			"sisusbvga[%d]: Failed to set up text mode\n",
 			minor);
@@ -1571,16 +1552,16 @@ sisusb_console_init(struct sisusb_usb_data *sisusb, int first, int last)
 
 	/* Allocate screen buffer */
 	if (!(sisusb->scrbuf = (unsigned long)vmalloc(sisusb->scrbuf_size))) {
-		up(&sisusb->lock);
-		up(&disconnect_sem);
+		mutex_unlock(&sisusb->lock);
+		mutex_unlock(&disconnect_mutex);
 		printk(KERN_ERR
 			"sisusbvga[%d]: Failed to allocate screen buffer\n",
 			minor);
 		return 1;
 	}
 
-	up(&sisusb->lock);
-	up(&disconnect_sem);
+	mutex_unlock(&sisusb->lock);
+	mutex_unlock(&disconnect_mutex);
 
 	/* Now grab the desired console(s) */
 	ret = take_over_console(&sisusb_con, first - 1, last - 1, 0);
diff --git a/drivers/usb/misc/sisusbvga/sisusb_init.c b/drivers/usb/misc/sisusbvga/sisusb_init.c
index 044fa4482f9..968f0d38cff 100644
--- a/drivers/usb/misc/sisusbvga/sisusb_init.c
+++ b/drivers/usb/misc/sisusbvga/sisusb_init.c
@@ -74,6 +74,7 @@ SiSUSB_InitPtr(struct SiS_Private *SiS_Pr)
 /*            HELPER: Get ModeID             */
 /*********************************************/
 
+#if 0
 unsigned short
 SiSUSB_GetModeID(int HDisplay, int VDisplay, int Depth)
 {
@@ -157,6 +158,7 @@ SiSUSB_GetModeID(int HDisplay, int VDisplay, int Depth)
 
 	return ModeIndex;
 }
+#endif  /*  0  */
 
 /*********************************************/
 /*          HELPER: SetReg, GetReg           */
@@ -233,7 +235,7 @@ SiS_DisplayOn(struct SiS_Private *SiS_Pr)
 /*        HELPER: Init Port Addresses        */
 /*********************************************/
 
-void
+static void
 SiSUSBRegInit(struct SiS_Private *SiS_Pr, unsigned long BaseAddr)
 {
 	SiS_Pr->SiS_P3c4 = BaseAddr + 0x14;
diff --git a/drivers/usb/misc/sisusbvga/sisusb_init.h b/drivers/usb/misc/sisusbvga/sisusb_init.h
index 5b11577835c..f05f83268af 100644
--- a/drivers/usb/misc/sisusbvga/sisusb_init.h
+++ b/drivers/usb/misc/sisusbvga/sisusb_init.h
@@ -690,7 +690,7 @@ static const struct SiS_CRT1Table SiSUSB_CRT1Table[] =
    0x41}}   /* 0x54 */
 };
 
-static struct SiS_VCLKData SiSUSB_VCLKData[] =
+static const struct SiS_VCLKData SiSUSB_VCLKData[] =
 {
 	{ 0x1b,0xe1, 25}, /* 0x00 */
 	{ 0x4e,0xe4, 28}, /* 0x01 */
@@ -808,8 +808,8 @@ static struct SiS_VCLKData SiSUSB_VCLKData[] =
 	{ 0x2b,0xc2, 35}  /* 0x71 768@576@60 */
 };
 
-void		SiSUSBRegInit(struct SiS_Private *SiS_Pr, unsigned long BaseAddr);
-unsigned short	SiSUSB_GetModeID(int HDisplay, int VDisplay, int Depth);
+extern struct mutex disconnect_mutex;
+
 int		SiSUSBSetMode(struct SiS_Private *SiS_Pr, unsigned short ModeNo);
 int		SiSUSBSetVESAMode(struct SiS_Private *SiS_Pr, unsigned short VModeNo);
 
@@ -826,5 +826,19 @@ extern int	sisusb_setidxregor(struct sisusb_usb_data *sisusb, int port,
 extern int	sisusb_setidxregand(struct sisusb_usb_data *sisusb, int port,
 					u8 idx, u8 myand);
 
+void sisusb_delete(struct kref *kref);
+int sisusb_writeb(struct sisusb_usb_data *sisusb, u32 adr, u8 data);
+int sisusb_readb(struct sisusb_usb_data *sisusb, u32 adr, u8 *data);
+int sisusb_copy_memory(struct sisusb_usb_data *sisusb, char *src,
+		       u32 dest, int length, size_t *bytes_written);
+int sisusb_reset_text_mode(struct sisusb_usb_data *sisusb, int init);
+int sisusbcon_do_font_op(struct sisusb_usb_data *sisusb, int set, int slot,
+			 u8 *arg, int cmapsz, int ch512, int dorecalc,
+			 struct vc_data *c, int fh, int uplock);
+void sisusb_set_cursor(struct sisusb_usb_data *sisusb, unsigned int location);
+int sisusb_console_init(struct sisusb_usb_data *sisusb, int first, int last);
+void sisusb_console_exit(struct sisusb_usb_data *sisusb);
+void sisusb_init_concode(void);
+
 #endif
 
diff --git a/drivers/usb/misc/sisusbvga/sisusb_struct.h b/drivers/usb/misc/sisusbvga/sisusb_struct.h
index 94edd4726c4..f325ecb29a6 100644
--- a/drivers/usb/misc/sisusbvga/sisusb_struct.h
+++ b/drivers/usb/misc/sisusbvga/sisusb_struct.h
@@ -161,7 +161,7 @@ struct SiS_Private
 	const struct SiS_Ext		*SiS_EModeIDTable;
 	const struct SiS_Ext2		*SiS_RefIndex;
 	const struct SiS_CRT1Table	*SiS_CRT1Table;
-	struct SiS_VCLKData		*SiS_VCLKData;
+	const struct SiS_VCLKData	*SiS_VCLKData;
 	const struct SiS_ModeResInfo	*SiS_ModeResInfo;
 };
 
diff --git a/drivers/usb/misc/usbtest.c b/drivers/usb/misc/usbtest.c
index ccc5e8238bd..81ba14c73dc 100644
--- a/drivers/usb/misc/usbtest.c
+++ b/drivers/usb/misc/usbtest.c
@@ -802,7 +802,9 @@ error:
 
 				if (u == urb || !u->dev)
 					continue;
+				spin_unlock(&ctx->lock);
 				status = usb_unlink_urb (u);
+				spin_lock(&ctx->lock);
 				switch (status) {
 				case -EINPROGRESS:
 				case -EBUSY:
@@ -1335,7 +1337,9 @@ struct iso_context {
 	unsigned		pending;
 	spinlock_t		lock;
 	struct completion	done;
+	int			submit_error;
 	unsigned long		errors;
+	unsigned long		packet_count;
 	struct usbtest_dev	*dev;
 };
 
@@ -1346,10 +1350,14 @@ static void iso_callback (struct urb *urb, struct pt_regs *regs)
 	spin_lock(&ctx->lock);
 	ctx->count--;
 
+	ctx->packet_count += urb->number_of_packets;
 	if (urb->error_count > 0)
 		ctx->errors += urb->error_count;
+	else if (urb->status != 0)
+		ctx->errors += urb->number_of_packets;
 
-	if (urb->status == 0 && ctx->count > (ctx->pending - 1)) {
+	if (urb->status == 0 && ctx->count > (ctx->pending - 1)
+			&& !ctx->submit_error) {
 		int status = usb_submit_urb (urb, GFP_ATOMIC);
 		switch (status) {
 		case 0:
@@ -1360,6 +1368,8 @@ static void iso_callback (struct urb *urb, struct pt_regs *regs)
 					status);
 			/* FALLTHROUGH */
 		case -ENODEV:			/* disconnected */
+		case -ESHUTDOWN:		/* endpoint disabled */
+			ctx->submit_error = 1;
 			break;
 		}
 	}
@@ -1369,8 +1379,8 @@ static void iso_callback (struct urb *urb, struct pt_regs *regs)
 	if (ctx->pending == 0) {
 		if (ctx->errors)
 			dev_dbg (&ctx->dev->intf->dev,
-				"iso test, %lu errors\n",
-				ctx->errors);
+				"iso test, %lu errors out of %lu\n",
+				ctx->errors, ctx->packet_count);
 		complete (&ctx->done);
 	}
 done:
@@ -1431,15 +1441,14 @@ test_iso_queue (struct usbtest_dev *dev, struct usbtest_param *param,
 	struct usb_device	*udev;
 	unsigned		i;
 	unsigned long		packets = 0;
-	int			status;
+	int			status = 0;
 	struct urb		*urbs[10];	/* FIXME no limit */
 
 	if (param->sglen > 10)
 		return -EDOM;
 
+	memset(&context, 0, sizeof context);
 	context.count = param->iterations * param->sglen;
-	context.pending = param->sglen;
-	context.errors = 0;
 	context.dev = dev;
 	init_completion (&context.done);
 	spin_lock_init (&context.lock);
@@ -1471,6 +1480,7 @@ test_iso_queue (struct usbtest_dev *dev, struct usbtest_param *param,
 
 	spin_lock_irq (&context.lock);
 	for (i = 0; i < param->sglen; i++) {
+		++context.pending;
 		status = usb_submit_urb (urbs [i], SLAB_ATOMIC);
 		if (status < 0) {
 			ERROR (dev, "submit iso[%d], error %d\n", i, status);
@@ -1481,12 +1491,26 @@ test_iso_queue (struct usbtest_dev *dev, struct usbtest_param *param,
 
 			simple_free_urb (urbs [i]);
 			context.pending--;
+			context.submit_error = 1;
+			break;
 		}
 	}
 	spin_unlock_irq (&context.lock);
 
 	wait_for_completion (&context.done);
-	return 0;
+
+	/*
+	 * Isochronous transfers are expected to fail sometimes.  As an
+	 * arbitrary limit, we will report an error if any submissions
+	 * fail or if the transfer failure rate is > 10%.
+	 */
+	if (status != 0)
+		;
+	else if (context.submit_error)
+		status = -EACCES;
+	else if (context.errors > context.packet_count / 10)
+		status = -EIO;
+	return status;
 
 fail:
 	for (i = 0; i < param->sglen; i++) {
diff --git a/drivers/usb/mon/mon_dma.c b/drivers/usb/mon/mon_dma.c
index 0a1367b760a..ddcfc01e77a 100644
--- a/drivers/usb/mon/mon_dma.c
+++ b/drivers/usb/mon/mon_dma.c
@@ -13,7 +13,10 @@
 #include <linux/usb.h>	/* Only needed for declarations in usb_mon.h */
 #include "usb_mon.h"
 
-#ifdef __i386__		/* CONFIG_ARCH_I386 does not exit */
+/*
+ * PC-compatibles, are, fortunately, sufficiently cache-coherent for this.
+ */
+#if defined(__i386__) || defined(__x86_64__) /* CONFIG_ARCH_I386 doesn't exit */
 #define MON_HAS_UNMAP 1
 
 #define phys_to_page(phys)	pfn_to_page((phys) >> PAGE_SHIFT)
diff --git a/drivers/usb/mon/mon_main.c b/drivers/usb/mon/mon_main.c
index 6ecc2730221..275a66f8305 100644
--- a/drivers/usb/mon/mon_main.c
+++ b/drivers/usb/mon/mon_main.c
@@ -97,6 +97,7 @@ static void mon_submit(struct usb_bus *ubus, struct urb *urb)
 	if (mbus->nreaders == 0)
 		goto out_locked;
 
+	mbus->cnt_events++;
 	list_for_each (pos, &mbus->r_list) {
 		r = list_entry(pos, struct mon_reader, r_link);
 		r->rnf_submit(r->r_data, urb);
@@ -113,20 +114,32 @@ out_unlocked:
 
 /*
  */
-static void mon_submit_error(struct usb_bus *ubus, struct urb *urb, int err)
+static void mon_submit_error(struct usb_bus *ubus, struct urb *urb, int error)
 {
 	struct mon_bus *mbus;
+	unsigned long flags;
+	struct list_head *pos;
+	struct mon_reader *r;
 
 	mbus = ubus->mon_bus;
 	if (mbus == NULL)
 		goto out_unlocked;
 
-	/*
-	 * XXX Capture the error code and the 'E' event.
-	 */
+	spin_lock_irqsave(&mbus->lock, flags);
+	if (mbus->nreaders == 0)
+		goto out_locked;
 
+	mbus->cnt_events++;
+	list_for_each (pos, &mbus->r_list) {
+		r = list_entry(pos, struct mon_reader, r_link);
+		r->rnf_error(r->r_data, urb, error);
+	}
+
+	spin_unlock_irqrestore(&mbus->lock, flags);
 	return;
 
+out_locked:
+	spin_unlock_irqrestore(&mbus->lock, flags);
 out_unlocked:
 	return;
 }
@@ -152,6 +165,7 @@ static void mon_complete(struct usb_bus *ubus, struct urb *urb)
 	}
 
 	spin_lock_irqsave(&mbus->lock, flags);
+	mbus->cnt_events++;
 	list_for_each (pos, &mbus->r_list) {
 		r = list_entry(pos, struct mon_reader, r_link);
 		r->rnf_complete(r->r_data, urb);
@@ -163,7 +177,6 @@ static void mon_complete(struct usb_bus *ubus, struct urb *urb)
 
 /*
  * Stop monitoring.
- * Obviously this must be well locked, so no need to play with mb's.
  */
 static void mon_stop(struct mon_bus *mbus)
 {
diff --git a/drivers/usb/mon/mon_stat.c b/drivers/usb/mon/mon_stat.c
index 6e4b165d070..1fe01d994a7 100644
--- a/drivers/usb/mon/mon_stat.c
+++ b/drivers/usb/mon/mon_stat.c
@@ -31,8 +31,8 @@ static int mon_stat_open(struct inode *inode, struct file *file)
 	mbus = inode->u.generic_ip;
 
 	sp->slen = snprintf(sp->str, STAT_BUF_SIZE,
-	    "nreaders %d text_lost %u\n",
-	    mbus->nreaders, mbus->cnt_text_lost);
+	    "nreaders %d events %u text_lost %u\n",
+	    mbus->nreaders, mbus->cnt_events, mbus->cnt_text_lost);
 
 	file->private_data = sp;
 	return 0;
diff --git a/drivers/usb/mon/mon_text.c b/drivers/usb/mon/mon_text.c
index ac043ec2b8d..e02c1a30c4c 100644
--- a/drivers/usb/mon/mon_text.c
+++ b/drivers/usb/mon/mon_text.c
@@ -26,10 +26,13 @@
 
 /*
  * This limit exists to prevent OOMs when the user process stops reading.
+ * If usbmon were available to unprivileged processes, it might be open
+ * to a local DoS. But we have to keep to root in order to prevent
+ * password sniffing from HID devices.
  */
-#define EVENT_MAX  25
+#define EVENT_MAX  (2*PAGE_SIZE / sizeof(struct mon_event_text))
 
-#define PRINTF_DFL  130
+#define PRINTF_DFL  160
 
 struct mon_event_text {
 	struct list_head e_link;
@@ -111,7 +114,7 @@ static inline char mon_text_get_data(struct mon_event_text *ep, struct urb *urb,
 	 * number of corner cases, but it seems that the following is
 	 * more or less safe.
 	 *
-	 * We do not even try to look transfer_buffer, because it can
+	 * We do not even try to look at transfer_buffer, because it can
 	 * contain non-NULL garbage in case the upper level promised to
 	 * set DMA for the HCD.
 	 */
@@ -179,6 +182,32 @@ static void mon_text_complete(void *data, struct urb *urb)
 	mon_text_event(rp, urb, 'C');
 }
 
+static void mon_text_error(void *data, struct urb *urb, int error)
+{
+	struct mon_reader_text *rp = data;
+	struct mon_event_text *ep;
+
+	if (rp->nevents >= EVENT_MAX ||
+	    (ep = kmem_cache_alloc(rp->e_slab, SLAB_ATOMIC)) == NULL) {
+		rp->r.m_bus->cnt_text_lost++;
+		return;
+	}
+
+	ep->type = 'E';
+	ep->pipe = urb->pipe;
+	ep->id = (unsigned long) urb;
+	ep->tstamp = 0;
+	ep->length = 0;
+	ep->status = error;
+
+	ep->setup_flag = '-';
+	ep->data_flag = 'E';
+
+	rp->nevents++;
+	list_add_tail(&ep->e_link, &rp->e_list);
+	wake_up(&rp->wait);
+}
+
 /*
  * Fetch next event from the circular buffer.
  */
@@ -232,6 +261,7 @@ static int mon_text_open(struct inode *inode, struct file *file)
 	rp->r.m_bus = mbus;
 	rp->r.r_data = rp;
 	rp->r.rnf_submit = mon_text_submit;
+	rp->r.rnf_error = mon_text_error;
 	rp->r.rnf_complete = mon_text_complete;
 
 	snprintf(rp->slab_name, SLAB_NAME_SZ, "mon%dt_%lx", ubus->busnum,
diff --git a/drivers/usb/mon/usb_mon.h b/drivers/usb/mon/usb_mon.h
index 8e0613c350c..33678c24ebe 100644
--- a/drivers/usb/mon/usb_mon.h
+++ b/drivers/usb/mon/usb_mon.h
@@ -27,6 +27,7 @@ struct mon_bus {
 	struct kref ref;		/* Under mon_lock */
 
 	/* Stats */
+	unsigned int cnt_events;
 	unsigned int cnt_text_lost;
 };
 
@@ -39,6 +40,7 @@ struct mon_reader {
 	void *r_data;		/* Use container_of instead? */
 
 	void (*rnf_submit)(void *data, struct urb *urb);
+	void (*rnf_error)(void *data, struct urb *urb, int error);
 	void (*rnf_complete)(void *data, struct urb *urb);
 };
 
diff --git a/drivers/usb/net/asix.c b/drivers/usb/net/asix.c
index 12b599a0b53..37111acec87 100644
--- a/drivers/usb/net/asix.c
+++ b/drivers/usb/net/asix.c
@@ -912,6 +912,10 @@ static const struct usb_device_id	products [] = {
         USB_DEVICE (0x0b95, 0x7720),
         .driver_info = (unsigned long) &ax88772_info,
 }, {
+	// ASIX AX88178 10/100/1000
+	USB_DEVICE (0x0b95, 0x1780),
+	.driver_info = (unsigned long) &ax88772_info,
+}, {
 	// Linksys USB200M Rev 2
 	USB_DEVICE (0x13b1, 0x0018),
 	.driver_info = (unsigned long) &ax88772_info,
diff --git a/drivers/usb/net/cdc_ether.c b/drivers/usb/net/cdc_ether.c
index 63f1f3ba8e0..efd195b5912 100644
--- a/drivers/usb/net/cdc_ether.c
+++ b/drivers/usb/net/cdc_ether.c
@@ -31,7 +31,7 @@
 #include <linux/workqueue.h>
 #include <linux/mii.h>
 #include <linux/usb.h>
-#include <linux/usb_cdc.h>
+#include <linux/usb/cdc.h>
 
 #include "usbnet.h"
 
@@ -455,6 +455,18 @@ static const struct usb_device_id	products [] = {
 	.driver_info		= 0,
 },
 
+/* Olympus has some models with a Zaurus-compatible option.
+ * R-1000 uses a FreeScale i.MXL cpu (ARMv4T)
+ */
+{
+	.match_flags    =   USB_DEVICE_ID_MATCH_INT_INFO
+		 | USB_DEVICE_ID_MATCH_DEVICE,
+	.idVendor               = 0x07B4,
+	.idProduct              = 0x0F02,	/* R-1000 */
+	ZAURUS_MASTER_INTERFACE,
+	.driver_info		= 0,
+},
+
 /*
  * WHITELIST!!!
  *
diff --git a/drivers/usb/net/pegasus.c b/drivers/usb/net/pegasus.c
index 7683926a1b6..ab21f960d25 100644
--- a/drivers/usb/net/pegasus.c
+++ b/drivers/usb/net/pegasus.c
@@ -163,6 +163,8 @@ static int get_registers(pegasus_t * pegasus, __u16 indx, __u16 size,
 
 	/* using ATOMIC, we'd never wake up if we slept */
 	if ((ret = usb_submit_urb(pegasus->ctrl_urb, GFP_ATOMIC))) {
+		if (ret == -ENODEV)
+			netif_device_detach(pegasus->net);
 		if (netif_msg_drv(pegasus))
 			dev_err(&pegasus->intf->dev, "%s, status %d\n",
 					__FUNCTION__, ret);
@@ -217,6 +219,8 @@ static int set_registers(pegasus_t * pegasus, __u16 indx, __u16 size,
 	set_current_state(TASK_UNINTERRUPTIBLE);
 
 	if ((ret = usb_submit_urb(pegasus->ctrl_urb, GFP_ATOMIC))) {
+		if (ret == -ENODEV)
+			netif_device_detach(pegasus->net);
 		if (netif_msg_drv(pegasus))
 			dev_err(&pegasus->intf->dev, "%s, status %d\n",
 					__FUNCTION__, ret);
@@ -268,6 +272,8 @@ static int set_register(pegasus_t * pegasus, __u16 indx, __u8 data)
 	set_current_state(TASK_UNINTERRUPTIBLE);
 
 	if ((ret = usb_submit_urb(pegasus->ctrl_urb, GFP_ATOMIC))) {
+		if (ret == -ENODEV)
+			netif_device_detach(pegasus->net);
 		if (netif_msg_drv(pegasus))
 			dev_err(&pegasus->intf->dev, "%s, status %d\n",
 					__FUNCTION__, ret);
@@ -298,10 +304,13 @@ static int update_eth_regs_async(pegasus_t * pegasus)
 			     (char *) &pegasus->dr,
 			     pegasus->eth_regs, 3, ctrl_callback, pegasus);
 
-	if ((ret = usb_submit_urb(pegasus->ctrl_urb, GFP_ATOMIC)))
+	if ((ret = usb_submit_urb(pegasus->ctrl_urb, GFP_ATOMIC))) {
+		if (ret == -ENODEV)
+			netif_device_detach(pegasus->net);
 		if (netif_msg_drv(pegasus))
 			dev_err(&pegasus->intf->dev, "%s, status %d\n",
 					__FUNCTION__, ret);
+	}
 
 	return ret;
 }
@@ -692,7 +701,10 @@ goon:
 			  usb_rcvbulkpipe(pegasus->usb, 1),
 			  pegasus->rx_skb->data, PEGASUS_MTU + 8,
 			  read_bulk_callback, pegasus);
-	if (usb_submit_urb(pegasus->rx_urb, GFP_ATOMIC)) {
+	rx_status = usb_submit_urb(pegasus->rx_urb, GFP_ATOMIC);
+	if (rx_status == -ENODEV)
+		netif_device_detach(pegasus->net);
+	else if (rx_status) {
 		pegasus->flags |= PEGASUS_RX_URB_FAIL;
 		goto tl_sched;
 	} else {
@@ -709,6 +721,7 @@ static void rx_fixup(unsigned long data)
 {
 	pegasus_t *pegasus;
 	unsigned long flags;
+	int status;
 
 	pegasus = (pegasus_t *) data;
 	if (pegasus->flags & PEGASUS_UNPLUG)
@@ -734,7 +747,10 @@ static void rx_fixup(unsigned long data)
 			  pegasus->rx_skb->data, PEGASUS_MTU + 8,
 			  read_bulk_callback, pegasus);
 try_again:
-	if (usb_submit_urb(pegasus->rx_urb, GFP_ATOMIC)) {
+	status = usb_submit_urb(pegasus->rx_urb, GFP_ATOMIC);
+	if (status == -ENODEV)
+		netif_device_detach(pegasus->net);
+	else if (status) {
 		pegasus->flags |= PEGASUS_RX_URB_FAIL;
 		tasklet_schedule(&pegasus->rx_tl);
 	} else {
@@ -836,6 +852,8 @@ static void intr_callback(struct urb *urb, struct pt_regs *regs)
 	}
 
 	status = usb_submit_urb(urb, SLAB_ATOMIC);
+	if (status == -ENODEV)
+		netif_device_detach(pegasus->net);
 	if (status && netif_msg_timer(pegasus))
 		printk(KERN_ERR "%s: can't resubmit interrupt urb, %d\n",
 				net->name, status);
@@ -874,6 +892,7 @@ static int pegasus_start_xmit(struct sk_buff *skb, struct net_device *net)
 			/* cleanup should already have been scheduled */
 			break;
 		case -ENODEV:		/* disconnect() upcoming */
+			netif_device_detach(pegasus->net);
 			break;
 		default:
 			pegasus->stats.tx_errors++;
@@ -999,6 +1018,8 @@ static int pegasus_open(struct net_device *net)
 			  pegasus->rx_skb->data, PEGASUS_MTU + 8,
 			  read_bulk_callback, pegasus);
 	if ((res = usb_submit_urb(pegasus->rx_urb, GFP_KERNEL))) {
+		if (res == -ENODEV)
+			netif_device_detach(pegasus->net);
 		if (netif_msg_ifup(pegasus))
 			pr_debug("%s: failed rx_urb, %d", net->name, res);
 		goto exit;
@@ -1009,6 +1030,8 @@ static int pegasus_open(struct net_device *net)
 			 pegasus->intr_buff, sizeof (pegasus->intr_buff),
 			 intr_callback, pegasus, pegasus->intr_interval);
 	if ((res = usb_submit_urb(pegasus->intr_urb, GFP_KERNEL))) {
+		if (res == -ENODEV)
+			netif_device_detach(pegasus->net);
 		if (netif_msg_ifup(pegasus))
 			pr_debug("%s: failed intr_urb, %d\n", net->name, res);
 		usb_kill_urb(pegasus->rx_urb);
diff --git a/drivers/usb/net/rndis_host.c b/drivers/usb/net/rndis_host.c
index 94ddfe16fdd..f551546d752 100644
--- a/drivers/usb/net/rndis_host.c
+++ b/drivers/usb/net/rndis_host.c
@@ -30,7 +30,7 @@
 #include <linux/workqueue.h>
 #include <linux/mii.h>
 #include <linux/usb.h>
-#include <linux/usb_cdc.h>
+#include <linux/usb/cdc.h>
 
 #include "usbnet.h"
 
diff --git a/drivers/usb/net/zaurus.c b/drivers/usb/net/zaurus.c
index f7ac9d6b985..813e470d060 100644
--- a/drivers/usb/net/zaurus.c
+++ b/drivers/usb/net/zaurus.c
@@ -30,7 +30,7 @@
 #include <linux/mii.h>
 #include <linux/crc32.h>
 #include <linux/usb.h>
-#include <linux/usb_cdc.h>
+#include <linux/usb/cdc.h>
 
 #include "usbnet.h"
 
@@ -109,7 +109,7 @@ static const struct driver_info	zaurus_sl5x00_info = {
 	.check_connect = always_connected,
 	.bind =		zaurus_bind,
 	.unbind =	usbnet_cdc_unbind,
-	.tx_fixup = 	zaurus_tx_fixup,
+	.tx_fixup =	zaurus_tx_fixup,
 };
 #define	ZAURUS_STRONGARM_INFO	((unsigned long)&zaurus_sl5x00_info)
 
@@ -119,7 +119,7 @@ static const struct driver_info	zaurus_pxa_info = {
 	.check_connect = always_connected,
 	.bind =		zaurus_bind,
 	.unbind =	usbnet_cdc_unbind,
-	.tx_fixup = 	zaurus_tx_fixup,
+	.tx_fixup =	zaurus_tx_fixup,
 };
 #define	ZAURUS_PXA_INFO		((unsigned long)&zaurus_pxa_info)
 
@@ -129,7 +129,7 @@ static const struct driver_info	olympus_mxl_info = {
 	.check_connect = always_connected,
 	.bind =		zaurus_bind,
 	.unbind =	usbnet_cdc_unbind,
-	.tx_fixup = 	zaurus_tx_fixup,
+	.tx_fixup =	zaurus_tx_fixup,
 };
 #define	OLYMPUS_MXL_INFO	((unsigned long)&olympus_mxl_info)
 
@@ -228,6 +228,11 @@ bad_detail:
 						detail->bDetailData[2]);
 				goto bad_desc;
 			}
+
+			/* same extra framing as for non-BLAN mode */
+			dev->net->hard_header_len += 6;
+			dev->rx_urb_size = dev->net->hard_header_len
+					+ dev->net->mtu;
 			break;
 		}
 next_desc:
@@ -258,7 +263,7 @@ static const struct driver_info	bogus_mdlm_info = {
 	.description =	"pseudo-MDLM (BLAN) device",
 	.flags =	FLAG_FRAMING_Z,
 	.check_connect = always_connected,
-	.tx_fixup = 	zaurus_tx_fixup,
+	.tx_fixup =	zaurus_tx_fixup,
 	.bind =		blan_mdlm_bind,
 };
 
@@ -367,13 +372,13 @@ static struct usb_driver zaurus_driver = {
 
 static int __init zaurus_init(void)
 {
- 	return usb_register(&zaurus_driver);
+	return usb_register(&zaurus_driver);
 }
 module_init(zaurus_init);
 
 static void __exit zaurus_exit(void)
 {
- 	usb_deregister(&zaurus_driver);
+	usb_deregister(&zaurus_driver);
 }
 module_exit(zaurus_exit);
 
diff --git a/drivers/usb/serial/Kconfig b/drivers/usb/serial/Kconfig
index 5c60be52156..8bd44fda5ea 100644
--- a/drivers/usb/serial/Kconfig
+++ b/drivers/usb/serial/Kconfig
@@ -417,7 +417,7 @@ config USB_SERIAL_MCT_U232
 	  Magic Control Technology Corp. (U232 is one of the model numbers).
 
 	  This driver also works with Sitecom U232-P25 and D-Link DU-H3SP USB
-	  BAY devices.
+	  BAY, Belkin F5U109, and Belkin F5U409 devices.
 
 	  To compile this driver as a module, choose M here: the
 	  module will be called mct_u232.
@@ -491,16 +491,22 @@ config USB_SERIAL_XIRCOM
 	  module will be called keyspan_pda.
 
 config USB_SERIAL_OPTION
-	tristate "USB Option PCMCIA serial driver"
-	depends on USB_SERIAL && USB_OHCI_HCD && PCCARD
+	tristate "USB driver for GSM modems"
+	depends on USB_SERIAL
 	help
-	  Say Y here if you want to use an Option card. This is a
-	  GSM card, controlled by three serial ports which are connected
-	  via an OHCI adapter located on a PC card.
+	  Say Y here if you have an "Option" GSM PCMCIA card
+	  (or an OEM version: branded Huawei, Audiovox, or Novatel).
+
+	  These cards feature a built-in OHCI-USB adapter and an
+	  internally-connected GSM modem. The USB bus is not
+	  accessible externally.
 
 	  To compile this driver as a module, choose M here: the
 	  module will be called option.
 
+	  If this driver doesn't recognize your device,
+	  it might be accessible via the FTDI_SIO driver.
+
 config USB_SERIAL_OMNINET
 	tristate "USB ZyXEL omni.net LCD Plus Driver (EXPERIMENTAL)"
 	depends on USB_SERIAL && EXPERIMENTAL
diff --git a/drivers/usb/serial/airprime.c b/drivers/usb/serial/airprime.c
index 694b205f9b7..94b9ba0ff87 100644
--- a/drivers/usb/serial/airprime.c
+++ b/drivers/usb/serial/airprime.c
@@ -16,9 +16,11 @@
 #include "usb-serial.h"
 
 static struct usb_device_id id_table [] = {
+	{ USB_DEVICE(0x0c88, 0x17da) }, /* Kyocera Wireless KPC650/Passport */
 	{ USB_DEVICE(0xf3d, 0x0112) },  /* AirPrime CDMA Wireless PC Card */
 	{ USB_DEVICE(0x1410, 0x1110) }, /* Novatel Wireless Merlin CDMA */
 	{ USB_DEVICE(0x1199, 0x0112) }, /* Sierra Wireless Aircard 580 */
+	{ USB_DEVICE(0x1199, 0x0218) }, /* Sierra Wireless MC5720 */
 	{ },
 };
 MODULE_DEVICE_TABLE(usb, id_table);
diff --git a/drivers/usb/serial/console.c b/drivers/usb/serial/console.c
index 8023bb7279b..f3404e10afb 100644
--- a/drivers/usb/serial/console.c
+++ b/drivers/usb/serial/console.c
@@ -202,7 +202,7 @@ static void usb_console_write(struct console *co, const char *buf, unsigned coun
 	struct usb_serial *serial;
 	int retval = -ENODEV;
 
-	if (!port)
+	if (!port || port->serial->dev->state == USB_STATE_NOTATTACHED)
 		return;
 	serial = port->serial;
 
@@ -213,17 +213,38 @@ static void usb_console_write(struct console *co, const char *buf, unsigned coun
 
 	if (!port->open_count) {
 		dbg ("%s - port not opened", __FUNCTION__);
-		goto exit;
+		return;
 	}
 
-	/* pass on to the driver specific version of this function if it is available */
-	if (serial->type->write)
-		retval = serial->type->write(port, buf, count);
-	else
-		retval = usb_serial_generic_write(port, buf, count);
-
-exit:
-	dbg("%s - return value (if we had one): %d", __FUNCTION__, retval);
+	while (count) {
+		unsigned int i;
+		unsigned int lf;
+		/* search for LF so we can insert CR if necessary */
+		for (i=0, lf=0 ; i < count ; i++) {
+			if (*(buf + i) == 10) {
+				lf = 1;
+				i++;
+				break;
+			}
+		}
+		/* pass on to the driver specific version of this function if it is available */
+		if (serial->type->write)
+			retval = serial->type->write(port, buf, i);
+		else
+			retval = usb_serial_generic_write(port, buf, i);
+		dbg("%s - return value : %d", __FUNCTION__, retval);
+		if (lf) {
+			/* append CR after LF */
+			unsigned char cr = 13;
+			if (serial->type->write)
+				retval = serial->type->write(port, &cr, 1);
+			else
+				retval = usb_serial_generic_write(port, &cr, 1);
+			dbg("%s - return value : %d", __FUNCTION__, retval);
+		}
+		buf += i;
+		count -= i;
+	}
 }
 
 static struct console usbcons = {
@@ -234,6 +255,14 @@ static struct console usbcons = {
 	.index =	-1,
 };
 
+void usb_serial_console_disconnect(struct usb_serial *serial)
+{
+	if (serial && serial->port && serial->port[0] && serial->port[0] == usbcons_info.port) {
+		usb_serial_console_exit();
+		usb_serial_put(serial);
+	}
+}
+
 void usb_serial_console_init (int serial_debug, int minor)
 {
 	debug = serial_debug;
@@ -259,6 +288,11 @@ void usb_serial_console_init (int serial_debug, int minor)
 
 void usb_serial_console_exit (void)
 {
-	unregister_console(&usbcons);
+	if (usbcons_info.port) {
+		unregister_console(&usbcons);
+		if (usbcons_info.port->open_count)
+			usbcons_info.port->open_count--;
+		usbcons_info.port = NULL;
+	}
 }
 
diff --git a/drivers/usb/serial/cp2101.c b/drivers/usb/serial/cp2101.c
index e0c2acdb3f0..f8c0cb28773 100644
--- a/drivers/usb/serial/cp2101.c
+++ b/drivers/usb/serial/cp2101.c
@@ -59,6 +59,7 @@ static struct usb_device_id id_table [] = {
 	{ USB_DEVICE(0x10AB, 0x10C5) }, /* Siemens MC60 Cable */
 	{ USB_DEVICE(0x10B5, 0xAC70) }, /* Nokia CA-42 USB */
 	{ USB_DEVICE(0x10C4, 0x803B) }, /* Pololu USB-serial converter */
+	{ USB_DEVICE(0x10C4, 0x8066) }, /* Argussoft In-System Programmer */
 	{ USB_DEVICE(0x10C4, 0x807A) }, /* Crumb128 board */
 	{ USB_DEVICE(0x10C4, 0x80CA) }, /* Degree Controls Inc */
 	{ USB_DEVICE(0x10C4, 0x80F6) }, /* Suunto sports instrument */
diff --git a/drivers/usb/serial/cyberjack.c b/drivers/usb/serial/cyberjack.c
index 2357b1d102d..1fd5c5a9f2e 100644
--- a/drivers/usb/serial/cyberjack.c
+++ b/drivers/usb/serial/cyberjack.c
@@ -469,7 +469,7 @@ static void cyberjack_write_bulk_callback (struct urb *urb, struct pt_regs *regs
 
 exit:
 	spin_unlock(&priv->lock);
-	schedule_work(&port->work);
+	usb_serial_port_softint(port);
 }
 
 static int __init cyberjack_init (void)
diff --git a/drivers/usb/serial/cypress_m8.c b/drivers/usb/serial/cypress_m8.c
index 7212fbe3b6f..5de76efe1b3 100644
--- a/drivers/usb/serial/cypress_m8.c
+++ b/drivers/usb/serial/cypress_m8.c
@@ -824,7 +824,7 @@ send:
 	priv->bytes_out += count; /* do not count the line control and size bytes */
 	spin_unlock_irqrestore(&priv->lock, flags);
 
-	schedule_work(&port->work);
+	usb_serial_port_softint(port);
 } /* cypress_send */
 
 
diff --git a/drivers/usb/serial/empeg.c b/drivers/usb/serial/empeg.c
index 63f7c78a115..afca1eae5fb 100644
--- a/drivers/usb/serial/empeg.c
+++ b/drivers/usb/serial/empeg.c
@@ -335,7 +335,7 @@ static void empeg_write_bulk_callback (struct urb *urb, struct pt_regs *regs)
 		return;
 	}
 
-	schedule_work(&port->work);
+	usb_serial_port_softint(port);
 }
 
 
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index 986d7622273..b2bfea7c815 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -500,6 +500,7 @@ static struct usb_device_id id_table_combined [] = {
 	{ USB_DEVICE(ICOM_ID1_VID, ICOM_ID1_PID) },
 	{ USB_DEVICE(PAPOUCH_VID, PAPOUCH_TMU_PID) },
 	{ USB_DEVICE(FTDI_VID, FTDI_ACG_HFDUAL_PID) },
+	{ USB_DEVICE(FTDI_VID, FTDI_YEI_SERVOCENTER31_PID) },
 	{ },					/* Optional parameter entry */
 	{ }					/* Terminating entry */
 };
@@ -1261,7 +1262,6 @@ static void ftdi_shutdown (struct usb_serial *serial)
 
 static int  ftdi_open (struct usb_serial_port *port, struct file *filp)
 { /* ftdi_open */
-	struct termios tmp_termios;
 	struct usb_device *dev = port->serial->dev;
 	struct ftdi_private *priv = usb_get_serial_port_data(port);
 	unsigned long flags;
@@ -1271,8 +1271,8 @@ static int  ftdi_open (struct usb_serial_port *port, struct file *filp)
 
 	dbg("%s", __FUNCTION__);
 
-
-	port->tty->low_latency = (priv->flags & ASYNC_LOW_LATENCY) ? 1 : 0;
+	if (port->tty)
+		port->tty->low_latency = (priv->flags & ASYNC_LOW_LATENCY) ? 1 : 0;
 
 	/* No error checking for this (will get errors later anyway) */
 	/* See ftdi_sio.h for description of what is reset */
@@ -1286,7 +1286,8 @@ static int  ftdi_open (struct usb_serial_port *port, struct file *filp)
 	   This is same behaviour as serial.c/rs_open() - Kuba */
 
 	/* ftdi_set_termios  will send usb control messages */
-	ftdi_set_termios(port, &tmp_termios);
+	if (port->tty)
+		ftdi_set_termios(port, NULL);
 
 	/* FIXME: Flow control might be enabled, so it should be checked -
 	   we have no control of defaults! */
@@ -1472,7 +1473,7 @@ static void ftdi_write_bulk_callback (struct urb *urb, struct pt_regs *regs)
 		return;
 	}
 
-	schedule_work(&port->work);
+	usb_serial_port_softint(port);
 } /* ftdi_write_bulk_callback */
 
 
@@ -1867,7 +1868,7 @@ static void ftdi_set_termios (struct usb_serial_port *port, struct termios *old_
 			err("%s urb failed to set baudrate", __FUNCTION__);
 		}
 		/* Ensure RTS and DTR are raised when baudrate changed from 0 */
-		if ((old_termios->c_cflag & CBAUD) == B0) {
+		if (!old_termios || (old_termios->c_cflag & CBAUD) == B0) {
 			set_mctrl(port, TIOCM_DTR | TIOCM_RTS);
 		}
 	}
diff --git a/drivers/usb/serial/ftdi_sio.h b/drivers/usb/serial/ftdi_sio.h
index d69a917e768..6ab2ac845bd 100644
--- a/drivers/usb/serial/ftdi_sio.h
+++ b/drivers/usb/serial/ftdi_sio.h
@@ -436,6 +436,12 @@
  */
 #define FTDI_ACG_HFDUAL_PID		0xDD20	/* HF Dual ISO Reader (RFID) */
 
+/*
+ * Yost Engineering, Inc. products (www.yostengineering.com).
+ * PID 0xE050 submitted by Aaron Prose.
+ */
+#define FTDI_YEI_SERVOCENTER31_PID	0xE050	/* YEI ServoCenter3.1 USB */
+
 /* Commands */
 #define FTDI_SIO_RESET 		0 /* Reset the port */
 #define FTDI_SIO_MODEM_CTRL 	1 /* Set the modem control register */
diff --git a/drivers/usb/serial/garmin_gps.c b/drivers/usb/serial/garmin_gps.c
index 5ec9bf5bac8..04767759cf8 100644
--- a/drivers/usb/serial/garmin_gps.c
+++ b/drivers/usb/serial/garmin_gps.c
@@ -1012,7 +1012,7 @@ static void garmin_write_bulk_callback (struct urb *urb, struct pt_regs *regs)
 		garmin_data_p->flags |= CLEAR_HALT_REQUIRED;
 	}
 
-	schedule_work(&port->work);
+	usb_serial_port_softint(port);
 }
 
 
diff --git a/drivers/usb/serial/generic.c b/drivers/usb/serial/generic.c
index c62cc287651..07a478c59fb 100644
--- a/drivers/usb/serial/generic.c
+++ b/drivers/usb/serial/generic.c
@@ -299,9 +299,7 @@ void usb_serial_generic_write_bulk_callback (struct urb *urb, struct pt_regs *re
 		return;
 	}
 
-	usb_serial_port_softint((void *)port);
-
-	schedule_work(&port->work);
+	usb_serial_port_softint(port);
 }
 EXPORT_SYMBOL_GPL(usb_serial_generic_write_bulk_callback);
 
diff --git a/drivers/usb/serial/io_edgeport.c b/drivers/usb/serial/io_edgeport.c
index b606c596810..b85d2156dfd 100644
--- a/drivers/usb/serial/io_edgeport.c
+++ b/drivers/usb/serial/io_edgeport.c
@@ -142,7 +142,7 @@ struct edgeport_port {
 
 /* This structure holds all of the individual device information */
 struct edgeport_serial {
-	char			name[MAX_NAME_LEN+1];		/* string name of this device */
+	char			name[MAX_NAME_LEN+2];		/* string name of this device */
 
 	struct edge_manuf_descriptor	manuf_descriptor;	/* the manufacturer descriptor */
 	struct edge_boot_descriptor	boot_descriptor;	/* the boot firmware descriptor */
@@ -270,7 +270,7 @@ static void get_manufacturing_desc	(struct edgeport_serial *edge_serial);
 static void get_boot_desc		(struct edgeport_serial *edge_serial);
 static void load_application_firmware	(struct edgeport_serial *edge_serial);
 
-static void unicode_to_ascii		(char *string, __le16 *unicode, int unicode_size);
+static void unicode_to_ascii(char *string, int buflen, __le16 *unicode, int unicode_size);
 
 
 // ************************************************************************
@@ -373,7 +373,7 @@ static void update_edgeport_E2PROM (struct edgeport_serial *edge_serial)
  *  Get string descriptor from device					*
  *									*
  ************************************************************************/
-static int get_string (struct usb_device *dev, int Id, char *string)
+static int get_string (struct usb_device *dev, int Id, char *string, int buflen)
 {
 	struct usb_string_descriptor StringDesc;
 	struct usb_string_descriptor *pStringDesc;
@@ -395,7 +395,7 @@ static int get_string (struct usb_device *dev, int Id, char *string)
 		return 0;
 	}
 
-	unicode_to_ascii(string,  pStringDesc->wData,     pStringDesc->bLength/2-1);
+	unicode_to_ascii(string, buflen, pStringDesc->wData, pStringDesc->bLength/2);
 
 	kfree(pStringDesc);
 	return strlen(string);
@@ -2564,16 +2564,20 @@ static void change_port_settings (struct edgeport_port *edge_port, struct termio
  *	ASCII range, but it's only for debugging...
  *	NOTE: expects the unicode in LE format
  ****************************************************************************/
-static void unicode_to_ascii (char *string, __le16 *unicode, int unicode_size)
+static void unicode_to_ascii(char *string, int buflen, __le16 *unicode, int unicode_size)
 {
 	int i;
 
-	if (unicode_size <= 0)
+	if (buflen <= 0)	/* never happens, but... */
 		return;
+	--buflen;		/* space for nul */
 
-	for (i = 0; i < unicode_size; ++i)
+	for (i = 0; i < unicode_size; i++) {
+		if (i >= buflen)
+			break;
 		string[i] = (char)(le16_to_cpu(unicode[i]));
-	string[unicode_size] = 0x00;
+	}
+	string[i] = 0x00;
 }
 
 
@@ -2603,11 +2607,17 @@ static void get_manufacturing_desc (struct edgeport_serial *edge_serial)
 		dbg("  BoardRev:       %d", edge_serial->manuf_descriptor.BoardRev);
 		dbg("  NumPorts:       %d", edge_serial->manuf_descriptor.NumPorts);
 		dbg("  DescDate:       %d/%d/%d", edge_serial->manuf_descriptor.DescDate[0], edge_serial->manuf_descriptor.DescDate[1], edge_serial->manuf_descriptor.DescDate[2]+1900);
-		unicode_to_ascii (string, edge_serial->manuf_descriptor.SerialNumber, edge_serial->manuf_descriptor.SerNumLength/2-1);
+		unicode_to_ascii(string, sizeof(string),
+		    edge_serial->manuf_descriptor.SerialNumber,
+		    edge_serial->manuf_descriptor.SerNumLength/2);
 		dbg("  SerialNumber: %s", string);
-		unicode_to_ascii (string, edge_serial->manuf_descriptor.AssemblyNumber, edge_serial->manuf_descriptor.AssemblyNumLength/2-1);
+		unicode_to_ascii(string, sizeof(string),
+		    edge_serial->manuf_descriptor.AssemblyNumber,
+		    edge_serial->manuf_descriptor.AssemblyNumLength/2);
 		dbg("  AssemblyNumber: %s", string);
-		unicode_to_ascii (string, edge_serial->manuf_descriptor.OemAssyNumber, edge_serial->manuf_descriptor.OemAssyNumLength/2-1);
+		unicode_to_ascii(string, sizeof(string),
+		    edge_serial->manuf_descriptor.OemAssyNumber,
+		    edge_serial->manuf_descriptor.OemAssyNumLength/2);
 		dbg("  OemAssyNumber:  %s", string);
 		dbg("  UartType:       %d", edge_serial->manuf_descriptor.UartType);
 		dbg("  IonPid:         %d", edge_serial->manuf_descriptor.IonPid);
@@ -2720,7 +2730,7 @@ static int edge_startup (struct usb_serial *serial)
 	struct edgeport_serial *edge_serial;
 	struct edgeport_port *edge_port;
 	struct usb_device *dev;
-	int i;
+	int i, j;
 
 	dev = serial->dev;
 
@@ -2735,11 +2745,11 @@ static int edge_startup (struct usb_serial *serial)
 	usb_set_serial_data(serial, edge_serial);
 
 	/* get the name for the device from the device */
-	if ( (i = get_string(dev, dev->descriptor.iManufacturer, &edge_serial->name[0])) != 0) {
-		edge_serial->name[i-1] = ' ';
-	}
-
-	get_string(dev, dev->descriptor.iProduct, &edge_serial->name[i]);
+	i = get_string(dev, dev->descriptor.iManufacturer,
+	    &edge_serial->name[0], MAX_NAME_LEN+1);
+	edge_serial->name[i++] = ' ';
+	get_string(dev, dev->descriptor.iProduct,
+	    &edge_serial->name[i], MAX_NAME_LEN+2 - i);
 
 	dev_info(&serial->dev->dev, "%s detected\n", edge_serial->name);
 
@@ -2784,6 +2794,10 @@ static int edge_startup (struct usb_serial *serial)
 		edge_port = kmalloc (sizeof(struct edgeport_port), GFP_KERNEL);
 		if (edge_port == NULL) {
 			dev_err(&serial->dev->dev, "%s - Out of memory\n", __FUNCTION__);
+			for (j = 0; j < i; ++j) {
+				kfree (usb_get_serial_port_data(serial->port[j]));
+				usb_set_serial_port_data(serial->port[j],  NULL);
+			}
 			usb_set_serial_data(serial, NULL);
 			kfree(edge_serial);
 			return -ENOMEM;
diff --git a/drivers/usb/serial/ipaq.c b/drivers/usb/serial/ipaq.c
index 9a5c9798956..9da6d2a8f2b 100644
--- a/drivers/usb/serial/ipaq.c
+++ b/drivers/usb/serial/ipaq.c
@@ -870,7 +870,7 @@ static void ipaq_write_bulk_callback(struct urb *urb, struct pt_regs *regs)
 		spin_unlock_irqrestore(&write_list_lock, flags);
 	}
 
-	schedule_work(&port->work);
+	usb_serial_port_softint(port);
 }
 
 static int ipaq_write_room(struct usb_serial_port *port)
diff --git a/drivers/usb/serial/ipw.c b/drivers/usb/serial/ipw.c
index e760a70242c..a4a0bfeaab0 100644
--- a/drivers/usb/serial/ipw.c
+++ b/drivers/usb/serial/ipw.c
@@ -376,7 +376,7 @@ static void ipw_write_bulk_callback(struct urb *urb, struct pt_regs *regs)
 	if (urb->status)
 		dbg("%s - nonzero write bulk status received: %d", __FUNCTION__, urb->status);
 
-	schedule_work(&port->work);
+	usb_serial_port_softint(port);
 }
 
 static int ipw_write(struct usb_serial_port *port, const unsigned char *buf, int count)
diff --git a/drivers/usb/serial/ir-usb.c b/drivers/usb/serial/ir-usb.c
index 426182ddc42..9432c730227 100644
--- a/drivers/usb/serial/ir-usb.c
+++ b/drivers/usb/serial/ir-usb.c
@@ -408,7 +408,7 @@ static void ir_write_bulk_callback (struct urb *urb, struct pt_regs *regs)
 		urb->actual_length,
 		urb->transfer_buffer);
 
-	schedule_work(&port->work);
+	usb_serial_port_softint(port);
 }
 
 static void ir_read_bulk_callback (struct urb *urb, struct pt_regs *regs)
diff --git a/drivers/usb/serial/keyspan.c b/drivers/usb/serial/keyspan.c
index 052b735c4fb..2cf6ade704e 100644
--- a/drivers/usb/serial/keyspan.c
+++ b/drivers/usb/serial/keyspan.c
@@ -481,7 +481,7 @@ static void	usa2x_outdat_callback(struct urb *urb, struct pt_regs *regs)
 	dbg ("%s - urb %d", __FUNCTION__, urb == p_priv->out_urbs[1]); 
 
 	if (port->open_count)
-		schedule_work(&port->work);
+		usb_serial_port_softint(port);
 }
 
 static void	usa26_inack_callback(struct urb *urb, struct pt_regs *regs)
diff --git a/drivers/usb/serial/kl5kusb105.c b/drivers/usb/serial/kl5kusb105.c
index 78335a5f774..65d79f630fa 100644
--- a/drivers/usb/serial/kl5kusb105.c
+++ b/drivers/usb/serial/kl5kusb105.c
@@ -569,8 +569,7 @@ static void klsi_105_write_bulk_callback ( struct urb *urb, struct pt_regs *regs
 		return;
 	}
 
-	/* from generic_write_bulk_callback */
-	schedule_work(&port->work);
+	usb_serial_port_softint(port);
 } /* klsi_105_write_bulk_completion_callback */
 
 
diff --git a/drivers/usb/serial/omninet.c b/drivers/usb/serial/omninet.c
index 238033a8709..6dcdb5f598b 100644
--- a/drivers/usb/serial/omninet.c
+++ b/drivers/usb/serial/omninet.c
@@ -320,7 +320,7 @@ static void omninet_write_bulk_callback (struct urb *urb, struct pt_regs *regs)
 		return;
 	}
 
-	schedule_work(&port->work);
+	usb_serial_port_softint(port);
 }
 
 
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index 5cf2b80add7..b0861b61bba 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -1,5 +1,5 @@
 /*
-  Option Card (PCMCIA to) USB to Serial Driver
+  USB Driver for GSM modems
 
   Copyright (C) 2005  Matthias Urlichs <smurf@smurf.noris.de>
 
@@ -28,15 +28,34 @@
   2005-09-10  v0.4.3 added HUAWEI E600 card and Audiovox AirCard
   2005-09-20  v0.4.4 increased recv buffer size: the card sometimes
                      wants to send >2000 bytes.
-  2006-04-10  v0.4.2 fixed two array overrun errors :-/
+  2006-04-10  v0.5   fixed two array overrun errors :-/
+  2006-04-21  v0.5.1 added support for Sierra Wireless MC8755
+  2006-05-15  v0.6   re-enable multi-port support
+  2006-06-01  v0.6.1 add COBRA
+  2006-06-01  v0.6.2 add backwards-compatibility stuff
+  2006-06-01  v0.6.3 add Novatel Wireless
+  2006-06-01  v0.7   Option => GSM
 
   Work sponsored by: Sigos GmbH, Germany <info@sigos.de>
 
+  This driver exists because the "normal" serial driver doesn't work too well
+  with GSM modems. Issues:
+  - data loss -- one single Receive URB is not nearly enough
+  - nonstandard flow (Option devices) and multiplex (Sierra) control
+  - controlling the baud rate doesn't make sense
+
+  This driver is named "option" because the most common device it's
+  used for is a PC-Card (with an internal OHCI-USB interface, behind
+  which the GSM interface sits), made by Option Inc.
+
+  Some of the "one port" devices actually exhibit multiple USB instances
+  on the USB bus. This is not a bug, these ports are used for different
+  device features.
 */
 
-#define DRIVER_VERSION "v0.4"
+#define DRIVER_VERSION "v0.7.0"
 #define DRIVER_AUTHOR "Matthias Urlichs <smurf@smurf.noris.de>"
-#define DRIVER_DESC "Option Card (PC-Card to) USB to Serial Driver"
+#define DRIVER_DESC "USB Driver for GSM modems"
 
 #include <linux/config.h>
 #include <linux/kernel.h>
@@ -74,22 +93,45 @@ static int  option_tiocmset(struct usb_serial_port *port, struct file *file,
 static int  option_send_setup(struct usb_serial_port *port);
 
 /* Vendor and product IDs */
-#define OPTION_VENDOR_ID			0x0AF0
-#define HUAWEI_VENDOR_ID			0x12D1
-#define AUDIOVOX_VENDOR_ID			0x0F3D
-
-#define OPTION_PRODUCT_OLD		0x5000
-#define OPTION_PRODUCT_FUSION	0x6000
-#define OPTION_PRODUCT_FUSION2	0x6300
-#define HUAWEI_PRODUCT_E600     0x1001
-#define AUDIOVOX_PRODUCT_AIRCARD 0x0112
+#define OPTION_VENDOR_ID                0x0AF0
+#define HUAWEI_VENDOR_ID                0x12D1
+#define AUDIOVOX_VENDOR_ID              0x0F3D
+#define SIERRAWIRELESS_VENDOR_ID        0x1199
+#define NOVATELWIRELESS_VENDOR_ID       0x1410
+
+#define OPTION_PRODUCT_OLD              0x5000
+#define OPTION_PRODUCT_FUSION           0x6000
+#define OPTION_PRODUCT_FUSION2          0x6300
+#define OPTION_PRODUCT_COBRA            0x6500
+#define HUAWEI_PRODUCT_E600             0x1001
+#define AUDIOVOX_PRODUCT_AIRCARD        0x0112
+#define SIERRAWIRELESS_PRODUCT_MC8755   0x6802
+#define NOVATELWIRELESS_PRODUCT_U740    0x1400
 
 static struct usb_device_id option_ids[] = {
 	{ USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_OLD) },
 	{ USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_FUSION) },
 	{ USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_FUSION2) },
+	{ USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_COBRA) },
 	{ USB_DEVICE(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E600) },
 	{ USB_DEVICE(AUDIOVOX_VENDOR_ID, AUDIOVOX_PRODUCT_AIRCARD) },
+	{ USB_DEVICE(SIERRAWIRELESS_VENDOR_ID, SIERRAWIRELESS_PRODUCT_MC8755) },
+	{ USB_DEVICE(NOVATELWIRELESS_VENDOR_ID,NOVATELWIRELESS_PRODUCT_U740) },
+	{ } /* Terminating entry */
+};
+
+static struct usb_device_id option_ids1[] = {
+	{ USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_OLD) },
+	{ USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_FUSION) },
+	{ USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_FUSION2) },
+	{ USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_COBRA) },
+	{ USB_DEVICE(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E600) },
+	{ USB_DEVICE(AUDIOVOX_VENDOR_ID, AUDIOVOX_PRODUCT_AIRCARD) },
+	{ USB_DEVICE(NOVATELWIRELESS_VENDOR_ID,NOVATELWIRELESS_PRODUCT_U740) },
+	{ } /* Terminating entry */
+};
+static struct usb_device_id option_ids3[] = {
+	{ USB_DEVICE(SIERRAWIRELESS_VENDOR_ID, SIERRAWIRELESS_PRODUCT_MC8755) },
 	{ } /* Terminating entry */
 };
 
@@ -111,12 +153,39 @@ static struct usb_serial_driver option_3port_device = {
 		.owner =	THIS_MODULE,
 		.name =		"option",
 	},
-	.description       = "Option 3G data card",
-	.id_table          = option_ids,
+	.description       = "GSM modem (3-port)",
+	.id_table          = option_ids3,
 	.num_interrupt_in  = NUM_DONT_CARE,
 	.num_bulk_in       = NUM_DONT_CARE,
 	.num_bulk_out      = NUM_DONT_CARE,
-	.num_ports         = 1, /* 3, but the card reports its ports separately */
+	.num_ports         = 3,
+	.open              = option_open,
+	.close             = option_close,
+	.write             = option_write,
+	.write_room        = option_write_room,
+	.chars_in_buffer   = option_chars_in_buffer,
+	.throttle          = option_rx_throttle,
+	.unthrottle        = option_rx_unthrottle,
+	.set_termios       = option_set_termios,
+	.break_ctl         = option_break_ctl,
+	.tiocmget          = option_tiocmget,
+	.tiocmset          = option_tiocmset,
+	.attach            = option_startup,
+	.shutdown          = option_shutdown,
+	.read_int_callback = option_instat_callback,
+};
+
+static struct usb_serial_driver option_1port_device = {
+	.driver = {
+		.owner =	THIS_MODULE,
+		.name =		"option",
+	},
+	.description       = "GSM modem (1-port)",
+	.id_table          = option_ids1,
+	.num_interrupt_in  = NUM_DONT_CARE,
+	.num_bulk_in       = NUM_DONT_CARE,
+	.num_bulk_out      = NUM_DONT_CARE,
+	.num_ports         = 1,
 	.open              = option_open,
 	.close             = option_close,
 	.write             = option_write,
@@ -170,6 +239,9 @@ struct option_port_private {
 static int __init option_init(void)
 {
 	int retval;
+	retval = usb_serial_register(&option_1port_device);
+	if (retval)
+		goto failed_1port_device_register;
 	retval = usb_serial_register(&option_3port_device);
 	if (retval)
 		goto failed_3port_device_register;
@@ -184,6 +256,8 @@ static int __init option_init(void)
 failed_driver_register:
 	usb_serial_deregister (&option_3port_device);
 failed_3port_device_register:
+	usb_serial_deregister (&option_1port_device);
+failed_1port_device_register:
 	return retval;
 }
 
@@ -191,6 +265,7 @@ static void __exit option_exit(void)
 {
 	usb_deregister (&option_driver);
 	usb_serial_deregister (&option_3port_device);
+	usb_serial_deregister (&option_1port_device);
 }
 
 module_init(option_init);
@@ -365,8 +440,7 @@ static void option_outdat_callback(struct urb *urb, struct pt_regs *regs)
 
 	port = (struct usb_serial_port *) urb->context;
 
-	if (port->open_count)
-		schedule_work(&port->work);
+	usb_serial_port_softint(port);
 }
 
 static void option_instat_callback(struct urb *urb, struct pt_regs *regs)
@@ -573,27 +647,30 @@ static struct urb *option_setup_urb(struct usb_serial *serial, int endpoint,
 /* Setup urbs */
 static void option_setup_urbs(struct usb_serial *serial)
 {
-	int j;
+	int i,j;
 	struct usb_serial_port *port;
 	struct option_port_private *portdata;
 
 	dbg("%s", __FUNCTION__);
 
-	port = serial->port[0];
-	portdata = usb_get_serial_port_data(port);
+
+	for (i = 0; i < serial->num_ports; i++) {
+		port = serial->port[i];
+		portdata = usb_get_serial_port_data(port);
 
 	/* Do indat endpoints first */
-	for (j = 0; j < N_IN_URB; ++j) {
-		portdata->in_urbs[j] = option_setup_urb (serial,
-                  port->bulk_in_endpointAddress, USB_DIR_IN, port,
-                  portdata->in_buffer[j], IN_BUFLEN, option_indat_callback);
-	}
+		for (j = 0; j < N_IN_URB; ++j) {
+			portdata->in_urbs[j] = option_setup_urb (serial,
+                  	port->bulk_in_endpointAddress, USB_DIR_IN, port,
+                  	portdata->in_buffer[j], IN_BUFLEN, option_indat_callback);
+		}
 
-	/* outdat endpoints */
-	for (j = 0; j < N_OUT_URB; ++j) {
-		portdata->out_urbs[j] = option_setup_urb (serial,
-                  port->bulk_out_endpointAddress, USB_DIR_OUT, port,
-                  portdata->out_buffer[j], OUT_BUFLEN, option_outdat_callback);
+		/* outdat endpoints */
+		for (j = 0; j < N_OUT_URB; ++j) {
+			portdata->out_urbs[j] = option_setup_urb (serial,
+                  	port->bulk_out_endpointAddress, USB_DIR_OUT, port,
+                  	portdata->out_buffer[j], OUT_BUFLEN, option_outdat_callback);
+		}
 	}
 }
 
diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c
index c96714bb1cb..d8870438720 100644
--- a/drivers/usb/serial/pl2303.c
+++ b/drivers/usb/serial/pl2303.c
@@ -314,7 +314,7 @@ static void pl2303_send(struct usb_serial_port *port)
 		// TODO: reschedule pl2303_send
 	}
 
-	schedule_work(&port->work);
+	usb_serial_port_softint(port);
 }
 
 static int pl2303_write_room(struct usb_serial_port *port)
@@ -600,7 +600,7 @@ static void pl2303_close (struct usb_serial_port *port, struct file *filp)
 	unsigned int c_cflag;
 	int bps;
 	long timeout;
-	wait_queue_t wait;						\
+	wait_queue_t wait;
 
 	dbg("%s - port %d", __FUNCTION__, port->number);
 
diff --git a/drivers/usb/serial/usb-serial.c b/drivers/usb/serial/usb-serial.c
index 9c36f0ece20..a30135c7cfe 100644
--- a/drivers/usb/serial/usb-serial.c
+++ b/drivers/usb/serial/usb-serial.c
@@ -162,12 +162,19 @@ static void destroy_serial(struct kref *kref)
 		}
 	}
 
+	flush_scheduled_work();		/* port->work */
+
 	usb_put_dev(serial->dev);
 
 	/* free up any memory that we allocated */
 	kfree (serial);
 }
 
+void usb_serial_put(struct usb_serial *serial)
+{
+	kref_put(&serial->kref, destroy_serial);
+}
+
 /*****************************************************************************
  * Driver tty interface functions
  *****************************************************************************/
@@ -201,12 +208,12 @@ static int serial_open (struct tty_struct *tty, struct file * filp)
 	 
 	++port->open_count;
 
-	if (port->open_count == 1) {
+	/* set up our port structure making the tty driver
+	 * remember our port object, and us it */
+	tty->driver_data = port;
+	port->tty = tty;
 
-		/* set up our port structure making the tty driver
-		 * remember our port object, and us it */
-		tty->driver_data = port;
-		port->tty = tty;
+	if (port->open_count == 1) {
 
 		/* lock this module before we call it
 		 * this may fail, which means we must bail out,
@@ -230,9 +237,11 @@ bailout_module_put:
 	module_put(serial->type->driver.owner);
 bailout_mutex_unlock:
 	port->open_count = 0;
+	tty->driver_data = NULL;
+	port->tty = NULL;
 	mutex_unlock(&port->mutex);
 bailout_kref_put:
-	kref_put(&serial->kref, destroy_serial);
+	usb_serial_put(serial);
 	return retval;
 }
 
@@ -268,7 +277,7 @@ static void serial_close(struct tty_struct *tty, struct file * filp)
 	}
 
 	mutex_unlock(&port->mutex);
-	kref_put(&port->serial->kref, destroy_serial);
+	usb_serial_put(port->serial);
 }
 
 static int serial_write (struct tty_struct * tty, const unsigned char *buf, int count)
@@ -276,7 +285,7 @@ static int serial_write (struct tty_struct * tty, const unsigned char *buf, int
 	struct usb_serial_port *port = tty->driver_data;
 	int retval = -EINVAL;
 
-	if (!port)
+	if (!port || port->serial->dev->state == USB_STATE_NOTATTACHED)
 		goto exit;
 
 	dbg("%s - port %d, %d byte(s)", __FUNCTION__, port->number, count);
@@ -296,7 +305,7 @@ exit:
 static int serial_write_room (struct tty_struct *tty) 
 {
 	struct usb_serial_port *port = tty->driver_data;
-	int retval = -EINVAL;
+	int retval = -ENODEV;
 
 	if (!port)
 		goto exit;
@@ -318,7 +327,7 @@ exit:
 static int serial_chars_in_buffer (struct tty_struct *tty) 
 {
 	struct usb_serial_port *port = tty->driver_data;
-	int retval = -EINVAL;
+	int retval = -ENODEV;
 
 	if (!port)
 		goto exit;
@@ -473,7 +482,7 @@ static int serial_read_proc (char *page, char **start, off_t off, int count, int
 			begin += length;
 			length = 0;
 		}
-		kref_put(&serial->kref, destroy_serial);
+		usb_serial_put(serial);
 	}
 	*eof = 1;
 done:
@@ -488,19 +497,18 @@ static int serial_tiocmget (struct tty_struct *tty, struct file *file)
 	struct usb_serial_port *port = tty->driver_data;
 
 	if (!port)
-		goto exit;
+		return -ENODEV;
 
 	dbg("%s - port %d", __FUNCTION__, port->number);
 
 	if (!port->open_count) {
 		dbg("%s - port not open", __FUNCTION__);
-		goto exit;
+		return -ENODEV;
 	}
 
 	if (port->serial->type->tiocmget)
 		return port->serial->type->tiocmget(port, file);
 
-exit:
 	return -EINVAL;
 }
 
@@ -510,23 +518,32 @@ static int serial_tiocmset (struct tty_struct *tty, struct file *file,
 	struct usb_serial_port *port = tty->driver_data;
 
 	if (!port)
-		goto exit;
+		return -ENODEV;
 
 	dbg("%s - port %d", __FUNCTION__, port->number);
 
 	if (!port->open_count) {
 		dbg("%s - port not open", __FUNCTION__);
-		goto exit;
+		return -ENODEV;
 	}
 
 	if (port->serial->type->tiocmset)
 		return port->serial->type->tiocmset(port, file, set, clear);
 
-exit:
 	return -EINVAL;
 }
 
-void usb_serial_port_softint(void *private)
+/*
+ * We would be calling tty_wakeup here, but unfortunately some line
+ * disciplines have an annoying habit of calling tty->write from
+ * the write wakeup callback (e.g. n_hdlc.c).
+ */
+void usb_serial_port_softint(struct usb_serial_port *port)
+{
+	schedule_work(&port->work);
+}
+
+static void usb_serial_port_work(void *private)
 {
 	struct usb_serial_port *port = private;
 	struct tty_struct *tty;
@@ -789,7 +806,7 @@ int usb_serial_probe(struct usb_interface *interface,
 		port->serial = serial;
 		spin_lock_init(&port->lock);
 		mutex_init(&port->mutex);
-		INIT_WORK(&port->work, usb_serial_port_softint, port);
+		INIT_WORK(&port->work, usb_serial_port_work, port);
 		serial->port[i] = port;
 	}
 
@@ -985,6 +1002,7 @@ void usb_serial_disconnect(struct usb_interface *interface)
 	struct device *dev = &interface->dev;
 	struct usb_serial_port *port;
 
+	usb_serial_console_disconnect(serial);
 	dbg ("%s", __FUNCTION__);
 
 	usb_set_intfdata (interface, NULL);
@@ -996,7 +1014,7 @@ void usb_serial_disconnect(struct usb_interface *interface)
 		}
 		/* let the last holder of this object 
 		 * cause it to be cleaned up */
-		kref_put(&serial->kref, destroy_serial);
+		usb_serial_put(serial);
 	}
 	dev_info(dev, "device disconnected\n");
 }
diff --git a/drivers/usb/serial/usb-serial.h b/drivers/usb/serial/usb-serial.h
index dc89d871046..d53ea9b11e8 100644
--- a/drivers/usb/serial/usb-serial.h
+++ b/drivers/usb/serial/usb-serial.h
@@ -236,7 +236,7 @@ struct usb_serial_driver {
 
 extern int  usb_serial_register(struct usb_serial_driver *driver);
 extern void usb_serial_deregister(struct usb_serial_driver *driver);
-extern void usb_serial_port_softint(void *private);
+extern void usb_serial_port_softint(struct usb_serial_port *port);
 
 extern int usb_serial_probe(struct usb_interface *iface, const struct usb_device_id *id);
 extern void usb_serial_disconnect(struct usb_interface *iface);
@@ -248,13 +248,16 @@ extern int ezusb_set_reset (struct usb_serial *serial, unsigned char reset_bit);
 #ifdef CONFIG_USB_SERIAL_CONSOLE
 extern void usb_serial_console_init (int debug, int minor);
 extern void usb_serial_console_exit (void);
+extern void usb_serial_console_disconnect(struct usb_serial *serial);
 #else
 static inline void usb_serial_console_init (int debug, int minor) { }
 static inline void usb_serial_console_exit (void) { }
+static inline void usb_serial_console_disconnect(struct usb_serial *serial) {}
 #endif
 
 /* Functions needed by other parts of the usbserial core */
 extern struct usb_serial *usb_serial_get_by_index (unsigned int minor);
+extern void usb_serial_put(struct usb_serial *serial);
 extern int usb_serial_generic_open (struct usb_serial_port *port, struct file *filp);
 extern int usb_serial_generic_write (struct usb_serial_port *port, const unsigned char *buf, int count);
 extern void usb_serial_generic_close (struct usb_serial_port *port, struct file *filp);
diff --git a/drivers/usb/serial/visor.c b/drivers/usb/serial/visor.c
index f5c3841d484..9e89b8d54f7 100644
--- a/drivers/usb/serial/visor.c
+++ b/drivers/usb/serial/visor.c
@@ -480,7 +480,7 @@ static void visor_write_bulk_callback (struct urb *urb, struct pt_regs *regs)
 	--priv->outstanding_urbs;
 	spin_unlock_irqrestore(&priv->lock, flags);
 
-	schedule_work(&port->work);
+	usb_serial_port_softint(port);
 }
 
 
diff --git a/drivers/usb/serial/whiteheat.c b/drivers/usb/serial/whiteheat.c
index f806553cd9a..5b06fa36609 100644
--- a/drivers/usb/serial/whiteheat.c
+++ b/drivers/usb/serial/whiteheat.c
@@ -388,7 +388,7 @@ static int whiteheat_attach (struct usb_serial *serial)
 	if (ret) {
 		err("%s: Couldn't send command [%d]", serial->type->description, ret);
 		goto no_firmware;
-	} else if (alen != sizeof(command)) {
+	} else if (alen != 2) {
 		err("%s: Send command incomplete [%d]", serial->type->description, alen);
 		goto no_firmware;
 	}
@@ -400,7 +400,7 @@ static int whiteheat_attach (struct usb_serial *serial)
 	if (ret) {
 		err("%s: Couldn't get results [%d]", serial->type->description, ret);
 		goto no_firmware;
-	} else if (alen != sizeof(result)) {
+	} else if (alen != sizeof(*hw_info) + 1) {
 		err("%s: Get results incomplete [%d]", serial->type->description, alen);
 		goto no_firmware;
 	} else if (result[0] != command[0]) {
@@ -1089,9 +1089,7 @@ static void whiteheat_write_callback(struct urb *urb, struct pt_regs *regs)
 		return;
 	}
 
-	usb_serial_port_softint((void *)port);
-
-	schedule_work(&port->work);
+	usb_serial_port_softint(port);
 }
 
 
diff --git a/drivers/usb/storage/onetouch.c b/drivers/usb/storage/onetouch.c
index 55ee2d36d58..026a587eb8d 100644
--- a/drivers/usb/storage/onetouch.c
+++ b/drivers/usb/storage/onetouch.c
@@ -34,9 +34,8 @@
 #include <linux/init.h>
 #include <linux/slab.h>
 #include <linux/module.h>
-#include <linux/usb.h>
 #include <linux/usb_ch9.h>
-#include <linux/usb_input.h>
+#include <linux/usb/input.h>
 #include "usb.h"
 #include "onetouch.h"
 #include "debug.h"
diff --git a/drivers/usb/storage/scsiglue.c b/drivers/usb/storage/scsiglue.c
index 5f11e19eaae..5715291ba54 100644
--- a/drivers/usb/storage/scsiglue.c
+++ b/drivers/usb/storage/scsiglue.c
@@ -286,11 +286,7 @@ static int bus_reset(struct scsi_cmnd *srb)
 	int result;
 
 	US_DEBUGP("%s called\n", __FUNCTION__);
-
-	mutex_lock(&(us->dev_mutex));
 	result = usb_stor_port_reset(us);
-	mutex_unlock(&us->dev_mutex);
-
 	return result < 0 ? FAILED : SUCCESS;
 }
 
diff --git a/drivers/usb/storage/shuttle_usbat.c b/drivers/usb/storage/shuttle_usbat.c
index f2bc5c9e23d..8fcec01dc62 100644
--- a/drivers/usb/storage/shuttle_usbat.c
+++ b/drivers/usb/storage/shuttle_usbat.c
@@ -131,28 +131,30 @@ static int usbat_write(struct us_data *us,
  * Convenience function to perform a bulk read
  */
 static int usbat_bulk_read(struct us_data *us,
-							 unsigned char *data,
-							 unsigned int len)
+			   unsigned char *data,
+			   unsigned int len,
+			   int use_sg)
 {
 	if (len == 0)
 		return USB_STOR_XFER_GOOD;
 
 	US_DEBUGP("usbat_bulk_read: len = %d\n", len);
-	return usb_stor_bulk_transfer_buf(us, us->recv_bulk_pipe, data, len, NULL);
+	return usb_stor_bulk_transfer_sg(us, us->recv_bulk_pipe, data, len, use_sg, NULL);
 }
 
 /*
  * Convenience function to perform a bulk write
  */
 static int usbat_bulk_write(struct us_data *us,
-							unsigned char *data,
-							unsigned int len)
+			    unsigned char *data,
+			    unsigned int len,
+			    int use_sg)
 {
 	if (len == 0)
 		return USB_STOR_XFER_GOOD;
 
 	US_DEBUGP("usbat_bulk_write:  len = %d\n", len);
-	return usb_stor_bulk_transfer_buf(us, us->send_bulk_pipe, data, len, NULL);
+	return usb_stor_bulk_transfer_sg(us, us->send_bulk_pipe, data, len, use_sg, NULL);
 }
 
 /*
@@ -317,7 +319,8 @@ static int usbat_wait_not_busy(struct us_data *us, int minutes)
  */
 static int usbat_read_block(struct us_data *us,
 			    unsigned char *content,
-			    unsigned short len)
+			    unsigned short len,
+			    int use_sg)
 {
 	int result;
 	unsigned char *command = us->iobuf;
@@ -338,7 +341,7 @@ static int usbat_read_block(struct us_data *us,
 	if (result != USB_STOR_XFER_GOOD)
 		return USB_STOR_TRANSPORT_ERROR;
 
-	result = usbat_bulk_read(us, content, len);
+	result = usbat_bulk_read(us, content, len, use_sg);
 	return (result == USB_STOR_XFER_GOOD ?
 			USB_STOR_TRANSPORT_GOOD : USB_STOR_TRANSPORT_ERROR);
 }
@@ -350,7 +353,8 @@ static int usbat_write_block(struct us_data *us,
 			     unsigned char access,
 			     unsigned char *content,
 			     unsigned short len,
-			     int minutes)
+			     int minutes,
+			     int use_sg)
 {
 	int result;
 	unsigned char *command = us->iobuf;
@@ -372,7 +376,7 @@ static int usbat_write_block(struct us_data *us,
 	if (result != USB_STOR_XFER_GOOD)
 		return USB_STOR_TRANSPORT_ERROR;
 
-	result = usbat_bulk_write(us, content, len);
+	result = usbat_bulk_write(us, content, len, use_sg);
 	if (result != USB_STOR_XFER_GOOD)
 		return USB_STOR_TRANSPORT_ERROR;
 
@@ -465,7 +469,7 @@ static int usbat_hp8200e_rw_block_test(struct us_data *us,
 				data[1+(j<<1)] = data_out[j];
 			}
 
-			result = usbat_bulk_write(us, data, num_registers*2);
+			result = usbat_bulk_write(us, data, num_registers*2, 0);
 			if (result != USB_STOR_XFER_GOOD)
 				return USB_STOR_TRANSPORT_ERROR;
 
@@ -583,7 +587,7 @@ static int usbat_multiple_write(struct us_data *us,
 	}
 
 	/* Send the data */
-	result = usbat_bulk_write(us, data, num_registers*2);
+	result = usbat_bulk_write(us, data, num_registers*2, 0);
 	if (result != USB_STOR_XFER_GOOD)
 		return USB_STOR_TRANSPORT_ERROR;
 
@@ -606,8 +610,9 @@ static int usbat_multiple_write(struct us_data *us,
  * other related details) are defined beforehand with _set_shuttle_features().
  */
 static int usbat_read_blocks(struct us_data *us,
-							 unsigned char *buffer,
-							 int len)
+			     unsigned char *buffer,
+			     int len,
+			     int use_sg)
 {
 	int result;
 	unsigned char *command = us->iobuf;
@@ -627,7 +632,7 @@ static int usbat_read_blocks(struct us_data *us,
 		return USB_STOR_TRANSPORT_FAILED;
 	
 	/* Read the blocks we just asked for */
-	result = usbat_bulk_read(us, buffer, len);
+	result = usbat_bulk_read(us, buffer, len, use_sg);
 	if (result != USB_STOR_XFER_GOOD)
 		return USB_STOR_TRANSPORT_FAILED;
 
@@ -648,7 +653,8 @@ static int usbat_read_blocks(struct us_data *us,
  */
 static int usbat_write_blocks(struct us_data *us,
 							  unsigned char *buffer,
-							  int len)
+			      int len,
+			      int use_sg)
 {
 	int result;
 	unsigned char *command = us->iobuf;
@@ -668,7 +674,7 @@ static int usbat_write_blocks(struct us_data *us,
 		return USB_STOR_TRANSPORT_FAILED;
 	
 	/* Write the data */
-	result = usbat_bulk_write(us, buffer, len);
+	result = usbat_bulk_write(us, buffer, len, use_sg);
 	if (result != USB_STOR_XFER_GOOD)
 		return USB_STOR_TRANSPORT_FAILED;
 
@@ -887,22 +893,28 @@ static int usbat_identify_device(struct us_data *us,
  * Set the transport function based on the device type
  */
 static int usbat_set_transport(struct us_data *us,
-			       struct usbat_info *info)
+			       struct usbat_info *info,
+			       int devicetype)
 {
-	int rc;
 
-	if (!info->devicetype) {
-		rc = usbat_identify_device(us, info);
-		if (rc != USB_STOR_TRANSPORT_GOOD) {
-			US_DEBUGP("usbat_set_transport: Could not identify device\n");
-			return 1;
-		}
-	}
+	if (!info->devicetype)
+		info->devicetype = devicetype;
 
-	if (usbat_get_device_type(us) == USBAT_DEV_HP8200)
+	if (!info->devicetype)
+		usbat_identify_device(us, info);
+
+	switch (info->devicetype) {
+	default:
+		return USB_STOR_TRANSPORT_ERROR;
+
+	case  USBAT_DEV_HP8200:
 		us->transport = usbat_hp8200e_transport;
-	else if (usbat_get_device_type(us) == USBAT_DEV_FLASH)
+		break;
+
+	case USBAT_DEV_FLASH:
 		us->transport = usbat_flash_transport;
+		break;
+	}
 
 	return 0;
 }
@@ -947,7 +959,7 @@ static int usbat_flash_get_sector_count(struct us_data *us,
 	msleep(100);
 
 	/* Read the device identification data */
-	rc = usbat_read_block(us, reply, 512);
+	rc = usbat_read_block(us, reply, 512, 0);
 	if (rc != USB_STOR_TRANSPORT_GOOD)
 		goto leave;
 
@@ -1031,7 +1043,7 @@ static int usbat_flash_read_data(struct us_data *us,
 			goto leave;
 
 		/* Read the data we just requested */
-		result = usbat_read_blocks(us, buffer, len);
+		result = usbat_read_blocks(us, buffer, len, 0);
 		if (result != USB_STOR_TRANSPORT_GOOD)
 			goto leave;
   	 
@@ -1125,7 +1137,7 @@ static int usbat_flash_write_data(struct us_data *us,
 			goto leave;
 
 		/* Write the data */
-		result = usbat_write_blocks(us, buffer, len);
+		result = usbat_write_blocks(us, buffer, len, 0);
 		if (result != USB_STOR_TRANSPORT_GOOD)
 			goto leave;
 
@@ -1310,7 +1322,7 @@ static int usbat_select_and_test_registers(struct us_data *us)
 /*
  * Initialize the USBAT processor and the storage device
  */
-int init_usbat(struct us_data *us)
+static int init_usbat(struct us_data *us, int devicetype)
 {
 	int rc;
 	struct usbat_info *info;
@@ -1392,7 +1404,7 @@ int init_usbat(struct us_data *us)
 	US_DEBUGP("INIT 9\n");
 
 	/* At this point, we need to detect which device we are using */
-	if (usbat_set_transport(us, info))
+	if (usbat_set_transport(us, info, devicetype))
 		return USB_STOR_TRANSPORT_ERROR;
 
 	US_DEBUGP("INIT 10\n");
@@ -1503,10 +1515,10 @@ static int usbat_hp8200e_transport(struct scsi_cmnd *srb, struct us_data *us)
 	 * AT SPEED 4 IS UNRELIABLE!!!
 	 */
 
-	if ( (result = usbat_write_block(us, 
+	if ((result = usbat_write_block(us,
 			USBAT_ATA, srb->cmnd, 12,
-			srb->cmnd[0]==GPCMD_BLANK ? 75 : 10)) !=
-				USB_STOR_TRANSPORT_GOOD) {
+				(srb->cmnd[0]==GPCMD_BLANK ? 75 : 10), 0) !=
+			     USB_STOR_TRANSPORT_GOOD)) {
 		return result;
 	}
 
@@ -1533,7 +1545,7 @@ static int usbat_hp8200e_transport(struct scsi_cmnd *srb, struct us_data *us)
 			len = *status;
 
 
-		result = usbat_read_block(us, srb->request_buffer, len);
+		result = usbat_read_block(us, srb->request_buffer, len, srb->use_sg);
 
 		/* Debug-print the first 32 bytes of the transfer */
 
@@ -1695,6 +1707,22 @@ static int usbat_flash_transport(struct scsi_cmnd * srb, struct us_data *us)
 	return USB_STOR_TRANSPORT_FAILED;
 }
 
+int init_usbat_cd(struct us_data *us)
+{
+	return init_usbat(us, USBAT_DEV_HP8200);
+}
+
+
+int init_usbat_flash(struct us_data *us)
+{
+	return init_usbat(us, USBAT_DEV_FLASH);
+}
+
+int init_usbat_probe(struct us_data *us)
+{
+	return init_usbat(us, 0);
+}
+
 /*
  * Default transport function. Attempts to detect which transport function
  * should be called, makes it the new default, and calls it.
@@ -1708,9 +1736,8 @@ int usbat_transport(struct scsi_cmnd *srb, struct us_data *us)
 {
 	struct usbat_info *info = (struct usbat_info*) (us->extra);
 
-	if (usbat_set_transport(us, info))
+	if (usbat_set_transport(us, info, 0))
 		return USB_STOR_TRANSPORT_ERROR;
 
 	return us->transport(srb, us);	
 }
-
diff --git a/drivers/usb/storage/shuttle_usbat.h b/drivers/usb/storage/shuttle_usbat.h
index 25e7d8b340b..3ddf143a1de 100644
--- a/drivers/usb/storage/shuttle_usbat.h
+++ b/drivers/usb/storage/shuttle_usbat.h
@@ -106,7 +106,9 @@
 #define USBAT_FEAT_ET2	0x01
 
 extern int usbat_transport(struct scsi_cmnd *srb, struct us_data *us);
-extern int init_usbat(struct us_data *us);
+extern int init_usbat_cd(struct us_data *us);
+extern int init_usbat_flash(struct us_data *us);
+extern int init_usbat_probe(struct us_data *us);
 
 struct usbat_info {
 	int devicetype;
diff --git a/drivers/usb/storage/transport.c b/drivers/usb/storage/transport.c
index 7ca896a342e..19b25c5cafd 100644
--- a/drivers/usb/storage/transport.c
+++ b/drivers/usb/storage/transport.c
@@ -115,19 +115,6 @@ static void usb_stor_blocking_completion(struct urb *urb, struct pt_regs *regs)
 
 	complete(urb_done_ptr);
 }
- 
-/* This is the timeout handler which will cancel an URB when its timeout
- * expires.
- */
-static void timeout_handler(unsigned long us_)
-{
-	struct us_data *us = (struct us_data *) us_;
-
-	if (test_and_clear_bit(US_FLIDX_URB_ACTIVE, &us->flags)) {
-		US_DEBUGP("Timeout -- cancelling URB\n");
-		usb_unlink_urb(us->current_urb);
-	}
-}
 
 /* This is the common part of the URB message submission code
  *
@@ -138,7 +125,7 @@ static void timeout_handler(unsigned long us_)
 static int usb_stor_msg_common(struct us_data *us, int timeout)
 {
 	struct completion urb_done;
-	struct timer_list to_timer;
+	long timeleft;
 	int status;
 
 	/* don't submit URBs during abort/disconnect processing */
@@ -185,22 +172,17 @@ static int usb_stor_msg_common(struct us_data *us, int timeout)
 		}
 	}
  
-	/* submit the timeout timer, if a timeout was requested */
-	if (timeout > 0) {
-		init_timer(&to_timer);
-		to_timer.expires = jiffies + timeout;
-		to_timer.function = timeout_handler;
-		to_timer.data = (unsigned long) us;
-		add_timer(&to_timer);
-	}
-
 	/* wait for the completion of the URB */
-	wait_for_completion(&urb_done);
-	clear_bit(US_FLIDX_URB_ACTIVE, &us->flags);
+	timeleft = wait_for_completion_interruptible_timeout(
+			&urb_done, timeout ? : MAX_SCHEDULE_TIMEOUT);
  
-	/* clean up the timeout timer */
-	if (timeout > 0)
-		del_timer_sync(&to_timer);
+	clear_bit(US_FLIDX_URB_ACTIVE, &us->flags);
+
+	if (timeleft <= 0) {
+		US_DEBUGP("%s -- cancelling URB\n",
+			  timeleft == 0 ? "Timeout" : "Signal");
+		usb_unlink_urb(us->current_urb);
+	}
 
 	/* return the URB status */
 	return us->current_urb->status;
@@ -721,16 +703,19 @@ void usb_stor_invoke_transport(struct scsi_cmnd *srb, struct us_data *us)
 	 * device reset. */
   Handle_Errors:
 
-	/* Let the SCSI layer know we are doing a reset, set the
-	 * RESETTING bit, and clear the ABORTING bit so that the reset
-	 * may proceed. */
+	/* Set the RESETTING bit, and clear the ABORTING bit so that
+	 * the reset may proceed. */
 	scsi_lock(us_to_host(us));
-	usb_stor_report_bus_reset(us);
 	set_bit(US_FLIDX_RESETTING, &us->flags);
 	clear_bit(US_FLIDX_ABORTING, &us->flags);
 	scsi_unlock(us_to_host(us));
 
+	/* We must release the device lock because the pre_reset routine
+	 * will want to acquire it. */
+	mutex_unlock(&us->dev_mutex);
 	result = usb_stor_port_reset(us);
+	mutex_lock(&us->dev_mutex);
+
 	if (result < 0) {
 		scsi_lock(us_to_host(us));
 		usb_stor_report_device_reset(us);
@@ -1214,31 +1199,30 @@ int usb_stor_Bulk_reset(struct us_data *us)
 				 0, us->ifnum, NULL, 0);
 }
 
-/* Issue a USB port reset to the device.  But don't do anything if
- * there's more than one interface in the device, so that other users
- * are not affected. */
+/* Issue a USB port reset to the device.  The caller must not hold
+ * us->dev_mutex.
+ */
 int usb_stor_port_reset(struct us_data *us)
 {
-	int result, rc;
+	int result, rc_lock;
 
-	if (test_bit(US_FLIDX_DISCONNECTING, &us->flags)) {
-		result = -EIO;
-		US_DEBUGP("No reset during disconnect\n");
-	} else if (us->pusb_dev->actconfig->desc.bNumInterfaces != 1) {
-		result = -EBUSY;
-		US_DEBUGP("Refusing to reset a multi-interface device\n");
-	} else {
-		result = rc =
-			usb_lock_device_for_reset(us->pusb_dev, us->pusb_intf);
-		if (result < 0) {
-			US_DEBUGP("unable to lock device for reset: %d\n",
-					result);
+	result = rc_lock =
+		usb_lock_device_for_reset(us->pusb_dev, us->pusb_intf);
+	if (result < 0)
+		US_DEBUGP("unable to lock device for reset: %d\n", result);
+	else {
+		/* Were we disconnected while waiting for the lock? */
+		if (test_bit(US_FLIDX_DISCONNECTING, &us->flags)) {
+			result = -EIO;
+			US_DEBUGP("No reset during disconnect\n");
 		} else {
-			result = usb_reset_device(us->pusb_dev);
-			if (rc)
-				usb_unlock_device(us->pusb_dev);
-			US_DEBUGP("usb_reset_device returns %d\n", result);
+			result = usb_reset_composite_device(
+					us->pusb_dev, us->pusb_intf);
+			US_DEBUGP("usb_reset_composite_device returns %d\n",
+					result);
 		}
+		if (rc_lock)
+			usb_unlock_device(us->pusb_dev);
 	}
 	return result;
 }
diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
index aec5ea8682d..543244d421c 100644
--- a/drivers/usb/storage/unusual_devs.h
+++ b/drivers/usb/storage/unusual_devs.h
@@ -78,12 +78,12 @@ UNUSUAL_DEV(  0x03f0, 0x0107, 0x0200, 0x0200,
 UNUSUAL_DEV(  0x03f0, 0x0207, 0x0001, 0x0001, 
 		"HP",
 		"CD-Writer+ 8200e",
-		US_SC_8070, US_PR_USBAT, init_usbat, 0),
+		US_SC_8070, US_PR_USBAT, init_usbat_cd, 0),
 
 UNUSUAL_DEV(  0x03f0, 0x0307, 0x0001, 0x0001, 
 		"HP",
 		"CD-Writer+ CD-4e",
-		US_SC_8070, US_PR_USBAT, init_usbat, 0),
+		US_SC_8070, US_PR_USBAT, init_usbat_cd, 0),
 #endif
 
 /* Reported by Sebastian Kapfer <sebastian_kapfer@gmx.net>
@@ -133,6 +133,14 @@ UNUSUAL_DEV(  0x0420, 0x0001, 0x0100, 0x0100,
 		US_SC_DEVICE, US_PR_DEVICE, NULL,
 		US_FL_IGNORE_RESIDUE ),
 
+/* Reported by Jiri Slaby <jirislaby@gmail.com> and
+ * Rene C. Castberg <Rene@Castberg.org> */
+UNUSUAL_DEV(  0x0421, 0x0446, 0x0100, 0x0100,
+		"Nokia",
+		"N80",
+		US_SC_DEVICE, US_PR_DEVICE, NULL,
+		US_FL_IGNORE_RESIDUE | US_FL_FIX_CAPACITY ),
+
 /* Reported by Olaf Hering <olh@suse.de> from novell bug #105878 */
 UNUSUAL_DEV(  0x0424, 0x0fdc, 0x0210, 0x0210,
 		"SMSC",
@@ -216,6 +224,14 @@ UNUSUAL_DEV(  0x04a4, 0x0004, 0x0001, 0x0001,
 		"DVD-CAM DZ-MV100A Camcorder",
 		US_SC_SCSI, US_PR_CB, NULL, US_FL_SINGLE_LUN),
 
+/* Patch for Nikon coolpix 2000
+ * Submitted by Fabien Cosse <fabien.cosse@wanadoo.fr>*/
+UNUSUAL_DEV(  0x04b0, 0x0301, 0x0010, 0x0010,
+		"NIKON",
+		"NIKON DSC E2000",
+		US_SC_DEVICE, US_PR_DEVICE,NULL,
+		US_FL_NOT_LOCKABLE ),
+
 /* Reported by Andreas Bockhold <andreas@bockionline.de> */
 UNUSUAL_DEV(  0x04b0, 0x0405, 0x0100, 0x0100,
 		"NIKON",
@@ -223,13 +239,12 @@ UNUSUAL_DEV(  0x04b0, 0x0405, 0x0100, 0x0100,
 		US_SC_DEVICE, US_PR_DEVICE, NULL,
 		US_FL_FIX_CAPACITY),
 
-/* Patch for Nikon coolpix 2000
- * Submitted by Fabien Cosse <fabien.cosse@wanadoo.fr>*/
-UNUSUAL_DEV(  0x04b0, 0x0301, 0x0010, 0x0010,
+/* Reported by Jamie Kitson <jamie@staberinde.fsnet.co.uk> */
+UNUSUAL_DEV(  0x04b0, 0x040d, 0x0100, 0x0100,
 		"NIKON",
-		"NIKON DSC E2000",
-		US_SC_DEVICE, US_PR_DEVICE,NULL,
-		US_FL_NOT_LOCKABLE ),
+		"NIKON DSC D70s",
+		US_SC_DEVICE, US_PR_DEVICE, NULL,
+		US_FL_FIX_CAPACITY),
 
 /* BENQ DC5330
  * Reported by Manuel Fombuena <mfombuena@ya.com> and
@@ -393,7 +408,7 @@ UNUSUAL_DEV(  0x04fc, 0x80c2, 0x0100, 0x0100,
 UNUSUAL_DEV(  0x04e6, 0x1010, 0x0000, 0x9999,
 		"Shuttle/SCM",
 		"USBAT-02",
-		US_SC_SCSI, US_PR_USBAT, init_usbat,
+		US_SC_SCSI, US_PR_USBAT, init_usbat_flash,
 		US_FL_SINGLE_LUN),
 #endif
 
@@ -797,7 +812,7 @@ UNUSUAL_DEV(  0x0781, 0x0002, 0x0009, 0x0009,
 UNUSUAL_DEV(  0x0781, 0x0005, 0x0005, 0x0005,
 		"Sandisk",
 		"ImageMate SDDR-05b",
-		US_SC_SCSI, US_PR_USBAT, init_usbat,
+		US_SC_SCSI, US_PR_USBAT, init_usbat_flash,
 		US_FL_SINGLE_LUN ),
 #endif
 
diff --git a/drivers/usb/storage/usb.c b/drivers/usb/storage/usb.c
index dd108634348..e232c7c8990 100644
--- a/drivers/usb/storage/usb.c
+++ b/drivers/usb/storage/usb.c
@@ -221,6 +221,37 @@ static int storage_resume(struct usb_interface *iface)
 #endif /* CONFIG_PM */
 
 /*
+ * The next two routines get called just before and just after
+ * a USB port reset, whether from this driver or a different one.
+ */
+
+static void storage_pre_reset(struct usb_interface *iface)
+{
+	struct us_data *us = usb_get_intfdata(iface);
+
+	US_DEBUGP("%s\n", __FUNCTION__);
+
+	/* Make sure no command runs during the reset */
+	mutex_lock(&us->dev_mutex);
+}
+
+static void storage_post_reset(struct usb_interface *iface)
+{
+	struct us_data *us = usb_get_intfdata(iface);
+
+	US_DEBUGP("%s\n", __FUNCTION__);
+
+	/* Report the reset to the SCSI core */
+	scsi_lock(us_to_host(us));
+	usb_stor_report_bus_reset(us);
+	scsi_unlock(us_to_host(us));
+
+	/* FIXME: Notify the subdrivers that they need to reinitialize
+	 * the device */
+	mutex_unlock(&us->dev_mutex);
+}
+
+/*
  * fill_inquiry_response takes an unsigned char array (which must
  * be at least 36 characters) and populates the vendor name,
  * product name, and revision fields. Then the array is copied
@@ -593,6 +624,15 @@ static int get_transport(struct us_data *us)
 		break;
 #endif
 
+#ifdef CONFIG_USB_STORAGE_ALAUDA
+	case US_PR_ALAUDA:
+		us->transport_name  = "Alauda Control/Bulk";
+		us->transport = alauda_transport;
+		us->transport_reset = usb_stor_Bulk_reset;
+		us->max_lun = 1;
+		break;
+#endif
+
 	default:
 		return -EIO;
 	}
@@ -648,15 +688,6 @@ static int get_protocol(struct us_data *us)
 		break;
 #endif
 
-#ifdef CONFIG_USB_STORAGE_ALAUDA
-	case US_PR_ALAUDA:
-		us->transport_name  = "Alauda Control/Bulk";
-		us->transport = alauda_transport;
-		us->transport_reset = usb_stor_Bulk_reset;
-		us->max_lun = 1;
-		break;
-#endif
-
 	default:
 		return -EIO;
 	}
@@ -1002,6 +1033,8 @@ static struct usb_driver usb_storage_driver = {
 	.suspend =	storage_suspend,
 	.resume =	storage_resume,
 #endif
+	.pre_reset =	storage_pre_reset,
+	.post_reset =	storage_post_reset,
 	.id_table =	storage_usb_ids,
 };