Merge branch 'master' of git://git.denx.de/u-boot-video
diff --git a/Makefile b/Makefile
index ba1c10b..446c2f8 100644
--- a/Makefile
+++ b/Makefile
@@ -747,7 +747,7 @@
 # ARM relocations should all be R_ARM_RELATIVE.
 checkarmreloc: $(obj)u-boot
 	@if test "R_ARM_RELATIVE" != \
-		"`readelf -r $< | cut -d ' ' -f 4 | grep R_ARM | sort -u`"; \
+		"`$(CROSS_COMPILE)readelf -r $< | cut -d ' ' -f 4 | grep R_ARM | sort -u`"; \
 		then echo "$< contains relocations other than \
 		R_ARM_RELATIVE"; false; fi
 
diff --git a/README b/README
index 40ffd64..33b5728 100644
--- a/README
+++ b/README
@@ -1392,6 +1392,12 @@
 		CONFIG_DFU_NAND
 		This enables support for exposing NAND devices via DFU.
 
+		CONFIG_SYS_DFU_DATA_BUF_SIZE
+		Dfu transfer uses a buffer before writing data to the
+		raw storage device. Make the size (in bytes) of this buffer
+		configurable. The size of this buffer is also configurable
+		through the "dfu_bufsiz" environment variable.
+
 		CONFIG_SYS_DFU_MAX_FILE_SIZE
 		When updating files rather than the raw storage device,
 		we use a static buffer to copy the file into and then write
diff --git a/arch/avr32/lib/bootm.c b/arch/avr32/lib/bootm.c
index 87f3f9c..eedab9d 100644
--- a/arch/avr32/lib/bootm.c
+++ b/arch/avr32/lib/bootm.c
@@ -187,6 +187,15 @@
 	struct	tag *params, *params_start;
 	char	*commandline = getenv("bootargs");
 
+	/*
+	 * allow the PREP bootm subcommand, it is required for bootm to work
+	 *
+	 * TODO: Andreas Bießmann <andreas.devel@googlemail.com> refactor the
+	 * do_bootm_linux() for avr32
+	 */
+	if (flag & BOOTM_STATE_OS_PREP)
+		return 0;
+
 	if ((flag != 0) && (flag != BOOTM_STATE_OS_GO))
 		return 1;
 
diff --git a/arch/m68k/lib/bootm.c b/arch/m68k/lib/bootm.c
index 56b6512..cc45167 100644
--- a/arch/m68k/lib/bootm.c
+++ b/arch/m68k/lib/bootm.c
@@ -75,6 +75,12 @@
 	void  (*kernel) (bd_t *, ulong, ulong, ulong, ulong);
 	struct lmb *lmb = &images->lmb;
 
+	/*
+	 * allow the PREP bootm subcommand, it is required for bootm to work
+	 */
+	if (flag & BOOTM_STATE_OS_PREP)
+		return 0;
+
 	if ((flag != 0) && (flag != BOOTM_STATE_OS_GO))
 		return 1;
 
diff --git a/arch/microblaze/lib/bootm.c b/arch/microblaze/lib/bootm.c
index b328f94..c5dfc9e 100644
--- a/arch/microblaze/lib/bootm.c
+++ b/arch/microblaze/lib/bootm.c
@@ -40,6 +40,12 @@
 	char	*commandline = getenv("bootargs");
 	ulong	rd_data_start, rd_data_end;
 
+	/*
+	 * allow the PREP bootm subcommand, it is required for bootm to work
+	 */
+	if (flag & BOOTM_STATE_OS_PREP)
+		return 0;
+
 	if ((flag != 0) && (flag != BOOTM_STATE_OS_GO))
 		return 1;
 
diff --git a/arch/nds32/lib/bootm.c b/arch/nds32/lib/bootm.c
index 03f58bf..65ae1eb 100644
--- a/arch/nds32/lib/bootm.c
+++ b/arch/nds32/lib/bootm.c
@@ -58,6 +58,12 @@
 	char *commandline = getenv("bootargs");
 #endif
 
+	/*
+	 * allow the PREP bootm subcommand, it is required for bootm to work
+	 */
+	if (flag & BOOTM_STATE_OS_PREP)
+		return 0;
+
 	if ((flag != 0) && (flag != BOOTM_STATE_OS_GO))
 		return 1;
 
diff --git a/arch/nios2/lib/bootm.c b/arch/nios2/lib/bootm.c
index 114e146..51597ea 100644
--- a/arch/nios2/lib/bootm.c
+++ b/arch/nios2/lib/bootm.c
@@ -45,6 +45,12 @@
 	if (of_flat_tree)
 		initrd_end = (ulong)of_flat_tree;
 
+	/*
+	 * allow the PREP bootm subcommand, it is required for bootm to work
+	 */
+	if (flag & BOOTM_STATE_OS_PREP)
+		return 0;
+
 	if ((flag != 0) && (flag != BOOTM_STATE_OS_GO))
 		return 1;
 
diff --git a/arch/openrisc/lib/bootm.c b/arch/openrisc/lib/bootm.c
index 7f716b8..24ca0a7 100644
--- a/arch/openrisc/lib/bootm.c
+++ b/arch/openrisc/lib/bootm.c
@@ -41,6 +41,12 @@
 	void	(*kernel) (unsigned int);
 	ulong	rd_data_start, rd_data_end;
 
+	/*
+	 * allow the PREP bootm subcommand, it is required for bootm to work
+	 */
+	if (flag & BOOTM_STATE_OS_PREP)
+		return 0;
+
 	if ((flag != 0) && (flag != BOOTM_STATE_OS_GO))
 		return 1;
 
diff --git a/arch/sh/lib/bootm.c b/arch/sh/lib/bootm.c
index 57273fa..4fdc7aa 100644
--- a/arch/sh/lib/bootm.c
+++ b/arch/sh/lib/bootm.c
@@ -79,6 +79,12 @@
 	unsigned long size = images->ep - (unsigned long)param;
 	char *bootargs = getenv("bootargs");
 
+	/*
+	 * allow the PREP bootm subcommand, it is required for bootm to work
+	 */
+	if (flag & BOOTM_STATE_OS_PREP)
+		return 0;
+
 	if ((flag != 0) && (flag != BOOTM_STATE_OS_GO))
 		return 1;
 
diff --git a/arch/sparc/lib/bootm.c b/arch/sparc/lib/bootm.c
index 1a9343c..9e5fb40 100644
--- a/arch/sparc/lib/bootm.c
+++ b/arch/sparc/lib/bootm.c
@@ -99,6 +99,12 @@
 	void (*kernel) (struct linux_romvec *, void *);
 	int ret;
 
+	/*
+	 * allow the PREP bootm subcommand, it is required for bootm to work
+	 */
+	if (flag & BOOTM_STATE_OS_PREP)
+		return 0;
+
 	if ((flag != 0) && (flag != BOOTM_STATE_OS_GO))
 		return 1;
 
diff --git a/common/cmd_bootm.c b/common/cmd_bootm.c
index 02a5013..a36e019 100644
--- a/common/cmd_bootm.c
+++ b/common/cmd_bootm.c
@@ -669,6 +669,13 @@
 	if (!ret && (states & BOOTM_STATE_OS_PREP))
 		ret = boot_fn(BOOTM_STATE_OS_PREP, argc, argv, images);
 
+	/* Check for unsupported subcommand. */
+	if (ret) {
+		puts("subcommand not supported\n");
+		return ret;
+	}
+
+
 #ifdef CONFIG_TRACE
 	/* Pretend to run the OS, then run a user command */
 	if (!ret && (states & BOOTM_STATE_OS_FAKE_GO)) {
@@ -699,8 +706,6 @@
 		bootstage_error(BOOTSTAGE_ID_DECOMP_UNIMPL);
 	else if (ret == BOOTM_ERR_RESET)
 		do_reset(cmdtp, flag, argc, argv);
-	else
-		puts("subcommand not supported\n");
 
 	return ret;
 }
diff --git a/common/cmd_nand.c b/common/cmd_nand.c
index 8b1e01a..886212a 100644
--- a/common/cmd_nand.c
+++ b/common/cmd_nand.c
@@ -426,7 +426,7 @@
 }
 
 /* Adjust a chip/partition size down for bad blocks so we don't
- * read/write/erase past the end of a chip/partition by accident.
+ * read/write past the end of a chip/partition by accident.
  */
 static void adjust_size_for_badblocks(loff_t *size, loff_t offset, int dev)
 {
@@ -546,7 +546,6 @@
 		int scrub = !strncmp(cmd, "scrub", 5);
 		int spread = 0;
 		int args = 2;
-		int adjust_size = 0;
 		const char *scrub_warn =
 			"Warning: "
 			"scrub option will erase all factory set bad blocks!\n"
@@ -563,10 +562,8 @@
 				spread = 1;
 			} else if (!strcmp(&cmd[5], ".part")) {
 				args = 1;
-				adjust_size = 1;
 			} else if (!strcmp(&cmd[5], ".chip")) {
 				args = 0;
-				adjust_size = 1;
 			} else {
 				goto usage;
 			}
@@ -586,10 +583,6 @@
 				 &maxsize) != 0)
 			return 1;
 
-		/* size is unspecified */
-		if (adjust_size && !scrub)
-			adjust_size_for_badblocks(&size, off, dev);
-
 		nand = &nand_info[dev];
 
 		memset(&opts, 0, sizeof(opts));
diff --git a/doc/README.SPL b/doc/README.SPL
index 4e1cb28..ac9a213 100644
--- a/doc/README.SPL
+++ b/doc/README.SPL
@@ -77,7 +77,7 @@
 
 	normal_cpu:spl_cpu
 
-This this case CPU will be set to "normal_cpu" during the main u-boot
+This case CPU will be set to "normal_cpu" during the main u-boot
 build and "spl_cpu" during the SPL build.
 
 
diff --git a/drivers/dfu/dfu.c b/drivers/dfu/dfu.c
index 6af6890..0521752 100644
--- a/drivers/dfu/dfu.c
+++ b/drivers/dfu/dfu.c
@@ -20,6 +20,7 @@
  */
 
 #include <common.h>
+#include <errno.h>
 #include <malloc.h>
 #include <mmc.h>
 #include <fat.h>
@@ -41,8 +42,34 @@
 	return ++i;
 }
 
-static unsigned char __aligned(CONFIG_SYS_CACHELINE_SIZE)
-				     dfu_buf[DFU_DATA_BUF_SIZE];
+static unsigned char *dfu_buf;
+static unsigned long dfu_buf_size = CONFIG_SYS_DFU_DATA_BUF_SIZE;
+
+static unsigned char *dfu_free_buf(void)
+{
+	free(dfu_buf);
+	dfu_buf = NULL;
+	return dfu_buf;
+}
+
+static unsigned char *dfu_get_buf(void)
+{
+	char *s;
+
+	if (dfu_buf != NULL)
+		return dfu_buf;
+
+	s = getenv("dfu_bufsiz");
+	dfu_buf_size = s ? (unsigned long)simple_strtol(s, NULL, 16) :
+			CONFIG_SYS_DFU_DATA_BUF_SIZE;
+
+	dfu_buf = memalign(CONFIG_SYS_CACHELINE_SIZE, dfu_buf_size);
+	if (dfu_buf == NULL)
+		printf("%s: Could not memalign 0x%lx bytes\n",
+		       __func__, dfu_buf_size);
+
+	return dfu_buf;
+}
 
 static int dfu_write_buffer_drain(struct dfu_entity *dfu)
 {
@@ -87,8 +114,10 @@
 		dfu->offset = 0;
 		dfu->bad_skip = 0;
 		dfu->i_blk_seq_num = 0;
-		dfu->i_buf_start = dfu_buf;
-		dfu->i_buf_end = dfu_buf + sizeof(dfu_buf);
+		dfu->i_buf_start = dfu_get_buf();
+		if (dfu->i_buf_start == NULL)
+			return -ENOMEM;
+		dfu->i_buf_end = dfu_get_buf() + dfu_buf_size;
 		dfu->i_buf = dfu->i_buf_start;
 
 		dfu->inited = 1;
@@ -148,11 +177,12 @@
 		printf("\nDFU complete CRC32: 0x%08x\n", dfu->crc);
 
 		/* clear everything */
+		dfu_free_buf();
 		dfu->crc = 0;
 		dfu->offset = 0;
 		dfu->i_blk_seq_num = 0;
 		dfu->i_buf_start = dfu_buf;
-		dfu->i_buf_end = dfu_buf + sizeof(dfu_buf);
+		dfu->i_buf_end = dfu_buf;
 		dfu->i_buf = dfu->i_buf_start;
 
 		dfu->inited = 0;
@@ -218,7 +248,11 @@
 	       __func__, dfu->name, buf, size, blk_seq_num, dfu->i_buf);
 
 	if (!dfu->inited) {
-		ret = dfu->read_medium(dfu, 0, buf, &dfu->r_left);
+		dfu->i_buf_start = dfu_get_buf();
+		if (dfu->i_buf_start == NULL)
+			return -ENOMEM;
+
+		ret = dfu->read_medium(dfu, 0, dfu->i_buf_start, &dfu->r_left);
 		if (ret != 0) {
 			debug("%s: failed to get r_left\n", __func__);
 			return ret;
@@ -229,8 +263,7 @@
 		dfu->i_blk_seq_num = 0;
 		dfu->crc = 0;
 		dfu->offset = 0;
-		dfu->i_buf_start = dfu_buf;
-		dfu->i_buf_end = dfu_buf + sizeof(dfu_buf);
+		dfu->i_buf_end = dfu_get_buf() + dfu_buf_size;
 		dfu->i_buf = dfu->i_buf_start;
 		dfu->b_left = 0;
 
@@ -257,11 +290,12 @@
 		debug("%s: %s CRC32: 0x%x\n", __func__, dfu->name, dfu->crc);
 		puts("\nUPLOAD ... done\nCtrl+C to exit ...\n");
 
+		dfu_free_buf();
 		dfu->i_blk_seq_num = 0;
 		dfu->crc = 0;
 		dfu->offset = 0;
 		dfu->i_buf_start = dfu_buf;
-		dfu->i_buf_end = dfu_buf + sizeof(dfu_buf);
+		dfu->i_buf_end = dfu_buf;
 		dfu->i_buf = dfu->i_buf_start;
 		dfu->b_left = 0;
 
diff --git a/drivers/dfu/dfu_mmc.c b/drivers/dfu/dfu_mmc.c
index e2f3978..e7ee077 100644
--- a/drivers/dfu/dfu_mmc.c
+++ b/drivers/dfu/dfu_mmc.c
@@ -98,6 +98,8 @@
 			op == DFU_OP_READ ? "load" : "write",
 			dfu->data.mmc.dev, dfu->data.mmc.part,
 			(unsigned int) buf, dfu->name);
+		if (op == DFU_OP_WRITE)
+			sprintf(cmd_buf + strlen(cmd_buf), " %ld", *len);
 		break;
 	default:
 		printf("%s: Layout (%s) not (yet) supported!\n", __func__,
diff --git a/drivers/dfu/dfu_nand.c b/drivers/dfu/dfu_nand.c
index 7dc89b2..07dee89 100644
--- a/drivers/dfu/dfu_nand.c
+++ b/drivers/dfu/dfu_nand.c
@@ -63,12 +63,26 @@
 
 	nand = &nand_info[nand_curr_device];
 
-	if (op == DFU_OP_READ)
+	if (op == DFU_OP_READ) {
 		ret = nand_read_skip_bad(nand, start, &count, &actual,
 				lim, buf);
-	else
+	} else {
+		nand_erase_options_t opts;
+
+		memset(&opts, 0, sizeof(opts));
+		opts.offset = start;
+		opts.length = count;
+		opts.spread = 1;
+		opts.quiet = 1;
+		opts.lim = lim;
+		/* first erase */
+		ret = nand_erase_opts(nand, &opts);
+		if (ret)
+			return ret;
+		/* then write */
 		ret = nand_write_skip_bad(nand, start, &count, &actual,
 				lim, buf, 0);
+	}
 
 	if (ret != 0) {
 		printf("%s: nand_%s_skip_bad call failed at %llx!\n",
diff --git a/drivers/mtd/nand/docg4.c b/drivers/mtd/nand/docg4.c
index 7dd9953..09f01c8 100644
--- a/drivers/mtd/nand/docg4.c
+++ b/drivers/mtd/nand/docg4.c
@@ -487,7 +487,7 @@
 }
 
 static int docg4_read_oob(struct mtd_info *mtd, struct nand_chip *nand,
-			  int page, int sndcmd)
+			  int page)
 {
 	struct docg4_priv *doc = nand->priv;
 	void __iomem *docptr = CONFIG_SYS_NAND_BASE;
@@ -577,7 +577,7 @@
 		writew(p[i], nand->IO_ADDR_W);
 }
 
-static void write_page(struct mtd_info *mtd, struct nand_chip *nand,
+static int write_page(struct mtd_info *mtd, struct nand_chip *nand,
 		       const uint8_t *buf, int use_ecc)
 {
 	void __iomem *docptr = CONFIG_SYS_NAND_BASE;
@@ -626,16 +626,18 @@
 	write_nop(docptr);
 	writew(0, docptr + DOC_DATAEND);
 	write_nop(docptr);
+
+	return 0;
 }
 
-static void docg4_write_page_raw(struct mtd_info *mtd, struct nand_chip *nand,
-				 const uint8_t *buf)
+static int docg4_write_page_raw(struct mtd_info *mtd, struct nand_chip *nand,
+				 const uint8_t *buf, int oob_required)
 {
 	return write_page(mtd, nand, buf, 0);
 }
 
-static void docg4_write_page(struct mtd_info *mtd, struct nand_chip *nand,
-			     const uint8_t *buf)
+static int docg4_write_page(struct mtd_info *mtd, struct nand_chip *nand,
+			     const uint8_t *buf, int oob_required)
 {
 	return write_page(mtd, nand, buf, 1);
 }
@@ -706,13 +708,13 @@
 
 
 static int docg4_read_page_raw(struct mtd_info *mtd, struct nand_chip *nand,
-			       uint8_t *buf, int page)
+			       uint8_t *buf, int oob_required, int page)
 {
 	return read_page(mtd, nand, buf, page, 0);
 }
 
 static int docg4_read_page(struct mtd_info *mtd, struct nand_chip *nand,
-			   uint8_t *buf, int page)
+			   uint8_t *buf, int oob_required, int page)
 {
 	return read_page(mtd, nand, buf, page, 1);
 }
@@ -779,7 +781,7 @@
 		return -ENOMEM;
 
 	read_page_prologue(CONFIG_SYS_NAND_BASE, g4_addr);
-	status = docg4_read_page(mtd, nand, buf, DOCG4_FACTORY_BBT_PAGE);
+	status = docg4_read_page(mtd, nand, buf, 0, DOCG4_FACTORY_BBT_PAGE);
 	if (status)
 		goto exit;
 
@@ -858,7 +860,7 @@
 
 	/* write first page of block */
 	write_page_prologue(CONFIG_SYS_NAND_BASE, g4_addr);
-	docg4_write_page(mtd, nand, buf);
+	docg4_write_page(mtd, nand, buf, 1);
 	ret = pageprog(mtd);
 	if (!ret)
 		mtd->ecc_stats.badblocks++;
@@ -959,8 +961,8 @@
 	nand->ecc.size = DOCG4_PAGE_SIZE;
 	nand->ecc.prepad = 8;
 	nand->ecc.bytes	= 8;
-	nand->options =
-		NAND_BUSWIDTH_16 | NAND_NO_SUBPAGE_WRITE | NAND_NO_AUTOINCR;
+	nand->ecc.strength = DOCG4_T;
+	nand->options = NAND_BUSWIDTH_16 | NAND_NO_SUBPAGE_WRITE;
 	nand->controller = &nand->hwcontrol;
 
 	/* methods */
diff --git a/drivers/mtd/nand/docg4_spl.c b/drivers/mtd/nand/docg4_spl.c
index 95e856c..734cbeb 100644
--- a/drivers/mtd/nand/docg4_spl.c
+++ b/drivers/mtd/nand/docg4_spl.c
@@ -113,7 +113,6 @@
 	int g4_index = 0;
 	uint16_t flash_status;
 	uint16_t *buf;
-	uint16_t discard, magic_high, magic_low;
 
 	/* flash_offset must be aligned to the start of a block */
 	if (flash_offset & 0x3ffff)
@@ -154,9 +153,9 @@
 	 * The IPL on the palmtreo680 requires that this contain a 32 bit magic
 	 * number, or the load aborts.  We'll ignore it.
 	 */
-	discard = readw(docptr + 0x103c); /* hw quirk; 1st read discarded */
-	magic_low = readw(docptr + 0x103c);
-	magic_high = readw(docptr + DOCG4_MYSTERY_REG);
+	readw(docptr + 0x103c); /* hw quirk; 1st read discarded */
+	readw(docptr + 0x103c);	/* lower 16 bits of magic number */
+	readw(docptr + DOCG4_MYSTERY_REG); /* upper 16 bits of magic number */
 	writew(0, docptr + DOC_DATAEND);
 	write_nop(docptr);
 	write_nop(docptr);
@@ -183,15 +182,15 @@
 		write_nop(docptr);
 
 		/* read the 512 bytes of page data, 2 bytes at a time */
-		discard = readw(docptr + 0x103c);
+		readw(docptr + 0x103c); /* hw quirk */
 		for (i = 0; i < 256; i++)
 			*buf++ = readw(docptr + 0x103c);
 
 		/* read oob, but discard it */
 		for (i = 0; i < 7; i++)
-			discard = readw(docptr + 0x103c);
-		discard = readw(docptr + DOCG4_OOB_6_7);
-		discard = readw(docptr + DOCG4_OOB_6_7);
+			readw(docptr + 0x103c);
+		readw(docptr + DOCG4_OOB_6_7);
+		readw(docptr + DOCG4_OOB_6_7);
 
 		writew(0, docptr + DOC_DATAEND);
 		write_nop(docptr);
diff --git a/drivers/mtd/nand/jz4740_nand.c b/drivers/mtd/nand/jz4740_nand.c
index a691fbc..9421e56 100644
--- a/drivers/mtd/nand/jz4740_nand.c
+++ b/drivers/mtd/nand/jz4740_nand.c
@@ -256,7 +256,7 @@
 	nand->ecc.strength	= 4;
 	nand->ecc.layout	= &qi_lb60_ecclayout_2gb;
 	nand->chip_delay	= 50;
-	nand->options		= NAND_USE_FLASH_BBT;
+	nand->bbt_options	|= NAND_BBT_USE_FLASH;
 
 	return 0;
 }
diff --git a/drivers/mtd/nand/nand_util.c b/drivers/mtd/nand/nand_util.c
index d81972c..1d22b52 100644
--- a/drivers/mtd/nand/nand_util.c
+++ b/drivers/mtd/nand/nand_util.c
@@ -120,6 +120,10 @@
 
 		WATCHDOG_RESET();
 
+		if (opts->lim && (erase.addr >= (opts->offset + opts->lim))) {
+			puts("Size of erase exceeds limit\n");
+			return -EFBIG;
+		}
 		if (!opts->scrub && bbtest) {
 			int ret = mtd_block_isbad(meminfo, erase.addr);
 			if (ret > 0) {
diff --git a/drivers/mtd/nand/s3c2410_nand.c b/drivers/mtd/nand/s3c2410_nand.c
index 43d8213..1187b9f 100644
--- a/drivers/mtd/nand/s3c2410_nand.c
+++ b/drivers/mtd/nand/s3c2410_nand.c
@@ -179,9 +179,7 @@
 #endif
 
 #ifdef CONFIG_S3C2410_NAND_BBT
-	nand->options = NAND_USE_FLASH_BBT;
-#else
-	nand->options = 0;
+	nand->bbt_options |= NAND_BBT_USE_FLASH;
 #endif
 
 	debug("end of nand_init\n");
diff --git a/drivers/usb/eth/asix.c b/drivers/usb/eth/asix.c
index 76624b9..db39bd8 100644
--- a/drivers/usb/eth/asix.c
+++ b/drivers/usb/eth/asix.c
@@ -585,6 +585,7 @@
 static const struct asix_dongle const asix_dongles[] = {
 	{ 0x05ac, 0x1402, FLAG_TYPE_AX88772 },	/* Apple USB Ethernet Adapter */
 	{ 0x07d1, 0x3c05, FLAG_TYPE_AX88772 },	/* D-Link DUB-E100 H/W Ver B1 */
+	{ 0x2001, 0x1a02, FLAG_TYPE_AX88772 },	/* D-Link DUB-E100 H/W Ver C1 */
 	/* Cables-to-Go USB Ethernet Adapter */
 	{ 0x0b95, 0x772a, FLAG_TYPE_AX88772 },
 	{ 0x0b95, 0x7720, FLAG_TYPE_AX88772 },	/* Trendnet TU2-ET100 V3.0R */
diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c
index f30778a..f867793 100644
--- a/drivers/usb/gadget/composite.c
+++ b/drivers/usb/gadget/composite.c
@@ -997,7 +997,8 @@
 	if (status < 0)
 		goto fail;
 
-	cdev->desc = *composite->dev;
+	memcpy(&cdev->desc, composite->dev,
+	       sizeof(struct usb_device_descriptor));
 	cdev->desc.bMaxPacketSize0 = gadget->ep0->maxpacket;
 
 	debug("%s: ready\n", composite->name);
diff --git a/drivers/usb/gadget/f_dfu.c b/drivers/usb/gadget/f_dfu.c
index a322ae5..e3fa0e3 100644
--- a/drivers/usb/gadget/f_dfu.c
+++ b/drivers/usb/gadget/f_dfu.c
@@ -183,6 +183,7 @@
 {
 	f_dfu->usb_function.strings = dfu_strings;
 	f_dfu->usb_function.hs_descriptors = f_dfu->function;
+	f_dfu->dfu_state = DFU_STATE_dfuIDLE;
 }
 
 static inline void to_runtime_mode(struct f_dfu *f_dfu)
@@ -233,7 +234,6 @@
 	case USB_REQ_DFU_DETACH:
 		f_dfu->dfu_state = DFU_STATE_appDETACH;
 		to_dfu_mode(f_dfu);
-		f_dfu->dfu_state = DFU_STATE_dfuIDLE;
 		value = RET_ZLP;
 		break;
 	default:
@@ -589,7 +589,7 @@
 	struct usb_interface_descriptor *d;
 	int i = 0;
 
-	f_dfu->function = calloc(sizeof(struct usb_descriptor_header *), n);
+	f_dfu->function = calloc(sizeof(struct usb_descriptor_header *), n + 1);
 	if (!f_dfu->function)
 		goto enomem;
 
@@ -653,6 +653,8 @@
 			->iInterface = id;
 	}
 
+	to_dfu_mode(f_dfu);
+
 	stringtab_dfu.strings = f_dfu->strings;
 
 	cdev->req->context = f_dfu;
diff --git a/drivers/usb/gadget/f_mass_storage.c b/drivers/usb/gadget/f_mass_storage.c
index 45bc132..5b348d7 100644
--- a/drivers/usb/gadget/f_mass_storage.c
+++ b/drivers/usb/gadget/f_mass_storage.c
@@ -577,9 +577,9 @@
 {
 	struct fsg_dev		*fsg = fsg_from_func(f);
 	struct usb_request	*req = fsg->common->ep0req;
-	u16			w_index = le16_to_cpu(ctrl->wIndex);
-	u16			w_value = le16_to_cpu(ctrl->wValue);
-	u16			w_length = le16_to_cpu(ctrl->wLength);
+	u16			w_index = get_unaligned_le16(&ctrl->wIndex);
+	u16			w_value = get_unaligned_le16(&ctrl->wValue);
+	u16			w_length = get_unaligned_le16(&ctrl->wLength);
 
 	if (!fsg_is_set(fsg->common))
 		return -EOPNOTSUPP;
@@ -617,7 +617,7 @@
 	     "unknown class-specific control req "
 	     "%02x.%02x v%04x i%04x l%u\n",
 	     ctrl->bRequestType, ctrl->bRequest,
-	     le16_to_cpu(ctrl->wValue), w_index, w_length);
+	     get_unaligned_le16(&ctrl->wValue), w_index, w_length);
 	return -EOPNOTSUPP;
 }
 
diff --git a/drivers/usb/gadget/g_dnl.c b/drivers/usb/gadget/g_dnl.c
index cc3f344..8a3777b 100644
--- a/drivers/usb/gadget/g_dnl.c
+++ b/drivers/usb/gadget/g_dnl.c
@@ -125,6 +125,12 @@
 	return usb_add_config(cdev, &config);
 }
 
+__weak
+int g_dnl_bind_fixup(struct usb_device_descriptor *dev)
+{
+	return 0;
+}
+
 static int g_dnl_bind(struct usb_composite_dev *cdev)
 {
 	struct usb_gadget *gadget = cdev->gadget;
@@ -147,6 +153,7 @@
 	g_dnl_string_defs[1].id = id;
 	device_desc.iProduct = id;
 
+	g_dnl_bind_fixup(&device_desc);
 	ret = g_dnl_config_register(cdev);
 	if (ret)
 		goto error;
diff --git a/drivers/usb/musb-new/musb_uboot.c b/drivers/usb/musb-new/musb_uboot.c
index 15d2ec0..c240032 100644
--- a/drivers/usb/musb-new/musb_uboot.c
+++ b/drivers/usb/musb-new/musb_uboot.c
@@ -1,4 +1,5 @@
 #include <common.h>
+#include <watchdog.h>
 #include <asm/errno.h>
 #include <linux/usb/ch9.h>
 #include <linux/usb/gadget.h>
@@ -164,6 +165,7 @@
 
 int usb_gadget_handle_interrupts(void)
 {
+	WATCHDOG_RESET();
 	if (!gadget || !gadget->isr)
 		return -EINVAL;
 
diff --git a/include/dfu.h b/include/dfu.h
index a107f4b..124653c 100644
--- a/include/dfu.h
+++ b/include/dfu.h
@@ -68,7 +68,9 @@
 
 #define DFU_NAME_SIZE			32
 #define DFU_CMD_BUF_SIZE		128
-#define DFU_DATA_BUF_SIZE		(1024*1024*8)	/* 8 MiB */
+#ifndef CONFIG_SYS_DFU_DATA_BUF_SIZE
+#define CONFIG_SYS_DFU_DATA_BUF_SIZE		(1024*1024*8)	/* 8 MiB */
+#endif
 #ifndef CONFIG_SYS_DFU_MAX_FILE_SIZE
 #define CONFIG_SYS_DFU_MAX_FILE_SIZE	(4 << 20)	/* 4 MiB */
 #endif
diff --git a/include/g_dnl.h b/include/g_dnl.h
index f47395f..f8affd8 100644
--- a/include/g_dnl.h
+++ b/include/g_dnl.h
@@ -23,7 +23,7 @@
 
 #include <linux/usb/ch9.h>
 #include <linux/usb/gadget.h>
-
+int g_dnl_bind_fixup(struct usb_device_descriptor *);
 int g_dnl_register(const char *s);
 void g_dnl_unregister(void);
 
diff --git a/include/linux/usb/composite.h b/include/linux/usb/composite.h
index 53cb095..4f76f88 100644
--- a/include/linux/usb/composite.h
+++ b/include/linux/usb/composite.h
@@ -331,7 +331,7 @@
 	/* private: */
 	/* internals */
 	unsigned int			suspended:1;
-	struct usb_device_descriptor	desc;
+	struct usb_device_descriptor __aligned(CONFIG_SYS_CACHELINE_SIZE) desc;
 	struct list_head		configs;
 	struct usb_composite_driver	*driver;
 	u8				next_string_id;
diff --git a/include/nand.h b/include/nand.h
index 26190e4..228d871 100644
--- a/include/nand.h
+++ b/include/nand.h
@@ -125,6 +125,8 @@
 
 	/* Don't include skipped bad blocks in size to be erased */
 	int spread;
+	/* maximum size that actual may be in order to not exceed the buf */
+	loff_t lim;
 };
 
 typedef struct nand_erase_options nand_erase_options_t;
diff --git a/lib/rsa/rsa-sign.c b/lib/rsa/rsa-sign.c
index a75ae24..e30d8ca 100644
--- a/lib/rsa/rsa-sign.c
+++ b/lib/rsa/rsa-sign.c
@@ -20,7 +20,6 @@
 #include "mkimage.h"
 #include <stdio.h>
 #include <string.h>
-#include <error.h>
 #include <image.h>
 #include <time.h>
 #include <openssl/rsa.h>
diff --git a/tools/proftool.c b/tools/proftool.c
index a48ed28..aa05e77 100644
--- a/tools/proftool.c
+++ b/tools/proftool.c
@@ -333,7 +333,7 @@
 		if (err == REG_NOMATCH)
 			continue;
 
-		if (err != REG_NOERROR) {
+		if (err) {
 			regex_report_error(&item->regex, err, "match",
 					   item->name);
 			break;