Merge branch 'master' of git://git.denx.de/u-boot-arm
diff --git a/Makefile b/Makefile
index e429212..686cab1 100644
--- a/Makefile
+++ b/Makefile
@@ -8,7 +8,7 @@
 VERSION = 2014
 PATCHLEVEL = 07
 SUBLEVEL =
-EXTRAVERSION = -rc3
+EXTRAVERSION = -rc4
 NAME =
 
 # *DOCUMENTATION*
diff --git a/common/cmd_dfu.c b/common/cmd_dfu.c
index a03538d..433bddd 100644
--- a/common/cmd_dfu.c
+++ b/common/cmd_dfu.c
@@ -27,8 +27,9 @@
 	ret = dfu_init_env_entities(interface, simple_strtoul(devstring,
 							      NULL, 10));
 	if (ret)
-		return ret;
+		goto done;
 
+	ret = CMD_RET_SUCCESS;
 	if (argc > 4 && strcmp(argv[4], "list") == 0) {
 		dfu_show_entities();
 		goto done;
@@ -61,7 +62,7 @@
 	if (dfu_reset())
 		run_command("reset", 0);
 
-	return CMD_RET_SUCCESS;
+	return ret;
 }
 
 U_BOOT_CMD(dfu, CONFIG_SYS_MAXARGS, 1, do_dfu,
diff --git a/drivers/usb/eth/asix.c b/drivers/usb/eth/asix.c
index ce133f0..6557055 100644
--- a/drivers/usb/eth/asix.c
+++ b/drivers/usb/eth/asix.c
@@ -565,7 +565,7 @@
 	int flags;
 };
 
-static const struct asix_dongle const asix_dongles[] = {
+static const struct asix_dongle asix_dongles[] = {
 	{ 0x05ac, 0x1402, FLAG_TYPE_AX88772 },	/* Apple USB Ethernet Adapter */
 	{ 0x07d1, 0x3c05, FLAG_TYPE_AX88772 },	/* D-Link DUB-E100 H/W Ver B1 */
 	{ 0x2001, 0x1a02, FLAG_TYPE_AX88772 },	/* D-Link DUB-E100 H/W Ver C1 */
diff --git a/drivers/usb/eth/mcs7830.c b/drivers/usb/eth/mcs7830.c
index c353286..8e738d4 100644
--- a/drivers/usb/eth/mcs7830.c
+++ b/drivers/usb/eth/mcs7830.c
@@ -666,7 +666,7 @@
 /*
  * mcs7830_dongles - the list of supported Moschip based USB ethernet dongles
  */
-static const struct mcs7830_dongle const mcs7830_dongles[] = {
+static const struct mcs7830_dongle mcs7830_dongles[] = {
 	{ 0x9710, 0x7832, },	/* Moschip 7832 */
 	{ 0x9710, 0x7830, },	/* Moschip 7830 */
 	{ 0x9710, 0x7730, },	/* Moschip 7730 */
diff --git a/drivers/usb/eth/smsc95xx.c b/drivers/usb/eth/smsc95xx.c
index 7bf0a34..7a7a676 100644
--- a/drivers/usb/eth/smsc95xx.c
+++ b/drivers/usb/eth/smsc95xx.c
@@ -799,6 +799,7 @@
 	{ 0x0424, 0x9500 },	/* LAN9500 Ethernet */
 	{ 0x0424, 0x9730 },	/* LAN9730 Ethernet (HSIC) */
 	{ 0x0424, 0x9900 },	/* SMSC9500 USB Ethernet Device (SAL10) */
+	{ 0x0424, 0x9e00 },	/* LAN9500A Ethernet */
 	{ 0x0000, 0x0000 }	/* END - Do not remove */
 };
 
diff --git a/drivers/usb/gadget/atmel_usba_udc.c b/drivers/usb/gadget/atmel_usba_udc.c
index c99208d..2c70973 100644
--- a/drivers/usb/gadget/atmel_usba_udc.c
+++ b/drivers/usb/gadget/atmel_usba_udc.c
@@ -314,7 +314,7 @@
 
 	DBG(DBG_GADGET, "ep_alloc_request: %p, 0x%x\n", _ep, gfp_flags);
 
-	req = malloc(sizeof(struct usba_request));
+	req = calloc(1, sizeof(struct usba_request));
 	if (!req)
 		return NULL;
 
diff --git a/drivers/usb/gadget/ci_udc.c b/drivers/usb/gadget/ci_udc.c
index b18bee4..4cd19c3 100644
--- a/drivers/usb/gadget/ci_udc.c
+++ b/drivers/usb/gadget/ci_udc.c
@@ -34,6 +34,22 @@
 #error This driver can not work on systems with caches longer than 128b
 #endif
 
+/*
+ * Every QTD must be individually aligned, since we can program any
+ * QTD's address into HW. Cache flushing requires ARCH_DMA_MINALIGN,
+ * and the USB HW requires 32-byte alignment. Align to both:
+ */
+#define ILIST_ALIGN		roundup(ARCH_DMA_MINALIGN, 32)
+/* Each QTD is this size */
+#define ILIST_ENT_RAW_SZ	sizeof(struct ept_queue_item)
+/*
+ * Align the size of the QTD too, so we can add this value to each
+ * QTD's address to get another aligned address.
+ */
+#define ILIST_ENT_SZ		roundup(ILIST_ENT_RAW_SZ, ILIST_ALIGN)
+/* For each endpoint, we need 2 QTDs, one for each of IN and OUT */
+#define ILIST_SZ		(NUM_ENDPOINTS * 2 * ILIST_ENT_SZ)
+
 #ifndef DEBUG
 #define DBG(x...) do {} while (0)
 #else
@@ -130,7 +146,9 @@
  */
 static struct ept_queue_item *ci_get_qtd(int ep_num, int dir_in)
 {
-	return controller.items[(ep_num * 2) + dir_in];
+	int index = (ep_num * 2) + dir_in;
+	uint8_t *imem = controller.items_mem + (index * ILIST_ENT_SZ);
+	return (struct ept_queue_item *)imem;
 }
 
 /**
@@ -173,8 +191,7 @@
 {
 	struct ept_queue_item *item = ci_get_qtd(ep_num, 0);
 	const uint32_t start = (uint32_t)item;
-	const uint32_t end_raw = start + 2 * sizeof(*item);
-	const uint32_t end = roundup(end_raw, ARCH_DMA_MINALIGN);
+	const uint32_t end = start + 2 * ILIST_ENT_SZ;
 
 	flush_dcache_range(start, end);
 }
@@ -189,8 +206,7 @@
 {
 	struct ept_queue_item *item = ci_get_qtd(ep_num, 0);
 	const uint32_t start = (uint32_t)item;
-	const uint32_t end_raw = start + 2 * sizeof(*item);
-	const uint32_t end = roundup(end_raw, ARCH_DMA_MINALIGN);
+	const uint32_t end = start + 2 * ILIST_ENT_SZ;
 
 	invalidate_dcache_range(start, end);
 }
@@ -206,12 +222,11 @@
 	if (num == 0 && controller.ep0_req)
 		return &controller.ep0_req->req;
 
-	ci_req = memalign(ARCH_DMA_MINALIGN, sizeof(*ci_req));
+	ci_req = calloc(1, sizeof(*ci_req));
 	if (!ci_req)
 		return NULL;
 
 	INIT_LIST_HEAD(&ci_req->queue);
-	ci_req->b_buf = 0;
 
 	if (num == 0)
 		controller.ep0_req = ci_req;
@@ -226,8 +241,11 @@
 	int num;
 
 	num = ci_ep->desc->bEndpointAddress & USB_ENDPOINT_NUMBER_MASK;
-	if (num == 0)
+	if (num == 0) {
+		if (!controller.ep0_req)
+			return;
 		controller.ep0_req = 0;
+	}
 
 	if (ci_req->b_buf)
 		free(ci_req->b_buf);
@@ -401,10 +419,11 @@
 		 * only 1 is used at a time since either an IN or an OUT but
 		 * not both is queued. For an IN transaction, item currently
 		 * points at the second of these items, so we know that we
-		 * can use (item - 1) to transmit the extra zero-length packet
+		 * can use the other to transmit the extra zero-length packet.
 		 */
-		item->next = (unsigned)(item - 1);
-		item--;
+		struct ept_queue_item *other_item = ci_get_qtd(num, 0);
+		item->next = (unsigned)other_item;
+		item = other_item;
 		item->info = INFO_ACTIVE;
 	}
 
@@ -468,22 +487,22 @@
 static void flip_ep0_direction(void)
 {
 	if (ep0_desc.bEndpointAddress == USB_DIR_IN) {
-		DBG("%s: Flipping ep0 ot OUT\n", __func__);
+		DBG("%s: Flipping ep0 to OUT\n", __func__);
 		ep0_desc.bEndpointAddress = 0;
 	} else {
-		DBG("%s: Flipping ep0 ot IN\n", __func__);
+		DBG("%s: Flipping ep0 to IN\n", __func__);
 		ep0_desc.bEndpointAddress = USB_DIR_IN;
 	}
 }
 
-static void handle_ep_complete(struct ci_ep *ep)
+static void handle_ep_complete(struct ci_ep *ci_ep)
 {
 	struct ept_queue_item *item;
 	int num, in, len;
 	struct ci_req *ci_req;
 
-	num = ep->desc->bEndpointAddress & USB_ENDPOINT_NUMBER_MASK;
-	in = (ep->desc->bEndpointAddress & USB_DIR_IN) != 0;
+	num = ci_ep->desc->bEndpointAddress & USB_ENDPOINT_NUMBER_MASK;
+	in = (ci_ep->desc->bEndpointAddress & USB_DIR_IN) != 0;
 	item = ci_get_qtd(num, in);
 	ci_invalidate_qtd(num);
 
@@ -492,12 +511,12 @@
 		printf("EP%d/%s FAIL info=%x pg0=%x\n",
 		       num, in ? "in" : "out", item->info, item->page0);
 
-	ci_req = list_first_entry(&ep->queue, struct ci_req, queue);
+	ci_req = list_first_entry(&ci_ep->queue, struct ci_req, queue);
 	list_del_init(&ci_req->queue);
-	ep->req_primed = false;
+	ci_ep->req_primed = false;
 
-	if (!list_empty(&ep->queue))
-		ci_ep_submit_next_request(ep);
+	if (!list_empty(&ci_ep->queue))
+		ci_ep_submit_next_request(ci_ep);
 
 	ci_req->req.actual = ci_req->req.length - len;
 	ci_debounce(ci_req, in);
@@ -505,7 +524,7 @@
 	DBG("ept%d %s req %p, complete %x\n",
 	    num, in ? "in" : "out", ci_req, len);
 	if (num != 0 || controller.ep0_data_phase)
-		ci_req->req.complete(&ep->ep, &ci_req->req);
+		ci_req->req.complete(&ci_ep->ep, &ci_req->req);
 	if (num == 0 && controller.ep0_data_phase) {
 		/*
 		 * Data Stage is complete, so flip ep0 dir for Status Stage,
@@ -515,7 +534,7 @@
 		flip_ep0_direction();
 		controller.ep0_data_phase = false;
 		ci_req->req.length = 0;
-		usb_ep_queue(&ep->ep, &ci_req->req, 0);
+		usb_ep_queue(&ci_ep->ep, &ci_req->req, 0);
 	}
 }
 
@@ -772,7 +791,6 @@
 static int ci_udc_probe(void)
 {
 	struct ept_queue_head *head;
-	uint8_t *imem;
 	int i;
 
 	const int num = 2 * NUM_ENDPOINTS;
@@ -782,29 +800,18 @@
 	const int eplist_raw_sz = num * sizeof(struct ept_queue_head);
 	const int eplist_sz = roundup(eplist_raw_sz, ARCH_DMA_MINALIGN);
 
-	const int ilist_align = roundup(ARCH_DMA_MINALIGN, 32);
-	const int ilist_ent_raw_sz = 2 * sizeof(struct ept_queue_item);
-	const int ilist_ent_sz = roundup(ilist_ent_raw_sz, ARCH_DMA_MINALIGN);
-	const int ilist_sz = NUM_ENDPOINTS * ilist_ent_sz;
-
 	/* The QH list must be aligned to 4096 bytes. */
 	controller.epts = memalign(eplist_align, eplist_sz);
 	if (!controller.epts)
 		return -ENOMEM;
 	memset(controller.epts, 0, eplist_sz);
 
-	/*
-	 * Each qTD item must be 32-byte aligned, each qTD touple must be
-	 * cacheline aligned. There are two qTD items for each endpoint and
-	 * only one of them is used for the endpoint at time, so we can group
-	 * them together.
-	 */
-	controller.items_mem = memalign(ilist_align, ilist_sz);
+	controller.items_mem = memalign(ILIST_ALIGN, ILIST_SZ);
 	if (!controller.items_mem) {
 		free(controller.epts);
 		return -ENOMEM;
 	}
-	memset(controller.items_mem, 0, ilist_sz);
+	memset(controller.items_mem, 0, ILIST_SZ);
 
 	for (i = 0; i < 2 * NUM_ENDPOINTS; i++) {
 		/*
@@ -824,15 +831,9 @@
 		head->next = TERMINATE;
 		head->info = 0;
 
-		imem = controller.items_mem + ((i >> 1) * ilist_ent_sz);
-		if (i & 1)
-			imem += sizeof(struct ept_queue_item);
-
-		controller.items[i] = (struct ept_queue_item *)imem;
-
 		if (i & 1) {
-			ci_flush_qh(i - 1);
-			ci_flush_qtd(i - 1);
+			ci_flush_qh(i / 2);
+			ci_flush_qtd(i / 2);
 		}
 	}
 
@@ -909,6 +910,9 @@
 {
 	udc_disconnect();
 
+	driver->unbind(&controller.gadget);
+	controller.driver = NULL;
+
 	ci_ep_free_request(&controller.ep[0].ep, &controller.ep0_req->req);
 	free(controller.items_mem);
 	free(controller.epts);
diff --git a/drivers/usb/gadget/ci_udc.h b/drivers/usb/gadget/ci_udc.h
index c214402..346164a 100644
--- a/drivers/usb/gadget/ci_udc.h
+++ b/drivers/usb/gadget/ci_udc.h
@@ -102,7 +102,6 @@
 	struct usb_gadget_driver	*driver;
 	struct ehci_ctrl		*ctrl;
 	struct ept_queue_head		*epts;
-	struct ept_queue_item		*items[2 * NUM_ENDPOINTS];
 	uint8_t				*items_mem;
 	struct ci_ep			ep[NUM_ENDPOINTS];
 };
diff --git a/drivers/usb/gadget/f_fastboot.c b/drivers/usb/gadget/f_fastboot.c
index 9dd85b6..7a1acb9 100644
--- a/drivers/usb/gadget/f_fastboot.c
+++ b/drivers/usb/gadget/f_fastboot.c
@@ -331,8 +331,11 @@
 	char *cmd = req->buf;
 	char response[RESPONSE_LEN];
 	const char *s;
+	size_t chars_left;
 
 	strcpy(response, "OKAY");
+	chars_left = sizeof(response) - strlen(response) - 1;
+
 	strsep(&cmd, ":");
 	if (!cmd) {
 		fastboot_tx_write_str("FAILmissing var");
@@ -340,18 +343,18 @@
 	}
 
 	if (!strcmp_l1("version", cmd)) {
-		strncat(response, FASTBOOT_VERSION, sizeof(response));
+		strncat(response, FASTBOOT_VERSION, chars_left);
 	} else if (!strcmp_l1("bootloader-version", cmd)) {
-		strncat(response, U_BOOT_VERSION, sizeof(response));
+		strncat(response, U_BOOT_VERSION, chars_left);
 	} else if (!strcmp_l1("downloadsize", cmd)) {
 		char str_num[12];
 
 		sprintf(str_num, "%08x", CONFIG_USB_FASTBOOT_BUF_SIZE);
-		strncat(response, str_num, sizeof(response));
+		strncat(response, str_num, chars_left);
 	} else if (!strcmp_l1("serialno", cmd)) {
 		s = getenv("serial#");
 		if (s)
-			strncat(response, s, sizeof(response));
+			strncat(response, s, chars_left);
 		else
 			strcpy(response, "FAILValue not set");
 	} else {
diff --git a/drivers/usb/gadget/f_mass_storage.c b/drivers/usb/gadget/f_mass_storage.c
index 6374bb9..f274d96 100644
--- a/drivers/usb/gadget/f_mass_storage.c
+++ b/drivers/usb/gadget/f_mass_storage.c
@@ -2462,12 +2462,12 @@
 
 	/* Allocate? */
 	if (!common) {
-		common = calloc(sizeof *common, 1);
+		common = calloc(sizeof(*common), 1);
 		if (!common)
 			return ERR_PTR(-ENOMEM);
 		common->free_storage_on_release = 1;
 	} else {
-		memset(common, 0, sizeof common);
+		memset(common, 0, sizeof(*common));
 		common->free_storage_on_release = 0;
 	}
 
diff --git a/drivers/usb/gadget/f_thor.c b/drivers/usb/gadget/f_thor.c
index 28f215e..4e06273 100644
--- a/drivers/usb/gadget/f_thor.c
+++ b/drivers/usb/gadget/f_thor.c
@@ -306,7 +306,6 @@
 	ALLOC_CACHE_ALIGN_BUFFER(struct rqt_box, rqt, sizeof(struct rqt_box));
 	int ret = -EINVAL;
 
-	memset(rqt, 0, sizeof(rqt));
 	memcpy(rqt, thor_rx_data_buf, sizeof(struct rqt_box));
 
 	debug("+RQT: %d, %d\n", rqt->rqt, rqt->rqt_data);
diff --git a/drivers/usb/host/r8a66597-hcd.c b/drivers/usb/host/r8a66597-hcd.c
index dfe5423..5114544 100644
--- a/drivers/usb/host/r8a66597-hcd.c
+++ b/drivers/usb/host/r8a66597-hcd.c
@@ -164,8 +164,8 @@
 
 	r8a66597_bset(r8a66597, INTL, SOFCFG);
 	r8a66597_write(r8a66597, 0, INTENB0);
-	r8a66597_write(r8a66597, 0, INTENB1);
-	r8a66597_write(r8a66597, 0, INTENB2);
+	for (port = 0; port < R8A66597_MAX_ROOT_HUB; port++)
+		r8a66597_write(r8a66597, 0, get_intenb_reg(port));
 
 	r8a66597_bset(r8a66597, CONFIG_R8A66597_ENDIAN & BIGEND, CFIFOSEL);
 	r8a66597_bset(r8a66597, CONFIG_R8A66597_ENDIAN & BIGEND, D0FIFOSEL);
@@ -807,7 +807,7 @@
 
 	R8A66597_DPRINT("%s\n", __func__);
 
-	memset(r8a66597, 0, sizeof(r8a66597));
+	memset(r8a66597, 0, sizeof(*r8a66597));
 	r8a66597->reg = CONFIG_R8A66597_BASE_ADDR;
 
 	disable_controller(r8a66597);
diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index d1c2e5c..59dc096 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -643,8 +643,8 @@
 	struct xhci_ctrl *ctrl = udev->controller;
 	struct xhci_hcor *hcor = ctrl->hcor;
 
-	if (((req->requesttype & USB_RT_PORT) &&
-	     le16_to_cpu(req->index)) > CONFIG_SYS_USB_XHCI_MAX_ROOT_PORTS) {
+	if ((req->requesttype & USB_RT_PORT) &&
+	    le16_to_cpu(req->index) > CONFIG_SYS_USB_XHCI_MAX_ROOT_PORTS) {
 		printf("The request port(%d) is not configured\n",
 			le16_to_cpu(req->index) - 1);
 		return -EINVAL;