[patch 00/18] USB and PCI Fixes for 2.6.14-rc2

[patch 00/18] USB and PCI Fixes for 2.6.14-rc2

[Greg KH]

Hi,

Here are a number of USB and PCI fixes for 2.6.14-rc2.  There's also a
patch in here to remove me as the I2C maintainer, as Jean is doing such
a good job that I don't need to be listed there anymore.  I'll still be
the conduit for the i2c and hwmon patches into the main kernel tree, but
Jean will be taking care of the full day-to-day duties of it now.

Below is the diffstat of the whole series.

thanks,

greg k-h

 Documentation/usb/URB.txt            |   77 ++++++++++++++---------------------
 MAINTAINERS                          |    4 -
 drivers/base/class.c                 |   14 +++++-
 drivers/base/dd.c                    |    5 +-
 drivers/block/ub.c                   |   59 ++++++++++++++------------
 drivers/pci/hotplug.c                |    6 --
 drivers/pci/hotplug/rpadlpar_sysfs.c |    6 +-
 drivers/pci/hotplug/sgi_hotplug.c    |    6 +-
 drivers/pci/pci-sysfs.c              |    4 -
 drivers/pci/probe.c                  |    6 +-
 drivers/s390/cio/ccwgroup.c          |    2 
 drivers/usb/core/message.c           |    2 
 drivers/usb/core/usb.c               |    6 +-
 drivers/usb/gadget/pxa2xx_udc.c      |    4 -
 drivers/usb/gadget/pxa2xx_udc.h      |   10 ++--
 drivers/usb/host/sl811-hcd.c         |   18 ++++++--
 drivers/usb/net/pegasus.c            |   31 +++++++++-----
 drivers/usb/serial/airprime.c        |    5 +-
 drivers/usb/serial/ftdi_sio.c        |   10 ++--
 drivers/usb/serial/option.c          |   15 +++++-
 include/linux/device.h               |    7 ++-
 21 files changed, 168 insertions(+), 129 deletions(-)

[patch 01/18] Driver Core: fis bus rescan devices race

[Greg KH]

[-- Attachment #1: driver-fix-bus_rescan_devices.patch --]
[-- Type: text/plain, Size: 2088 bytes --]

From: Daniel Ritz <daniel.ritz@gmx.ch>

bus_rescan_devices_helper() does not hold the dev->sem when it checks for
!dev->driver().  device_attach() holds the sem, but calls again
device_bind_driver() even when dev->driver is set.

What happens is that a first device_attach() call (module insertion time)
is on the way binding the device to a driver.  Another thread calls
bus_rescan_devices().  Now when bus_rescan_devices_helper() checks for
dev->driver it is still NULL 'cos the the prior device_attach() is not yet
finished.  But as soon as the first one releases the dev->sem the second
device_attach() tries to rebind the already bound device again. 
device_bind_driver() does this blindly which leads to a corrupt
driver->klist_devices list (the device links itself, the head points to the
device).  Later a call to device_release_driver() sets dev->driver to NULL
and breaks the link it has to itself on knode_driver.  Rmmoding the driver
later calls driver_detach() which leads to an endless loop 'cos the list
head in klist_devices still points to the device.  And since dev->driver is
NULL it's stuck with the same device forever.  Boom.  And rmmod hangs.

Very easy to reproduce with new-style pcmcia and a 16bit card.  Just loop
modprobe <pcmcia-modules> ;cardctl eject; rmmod <card driver, pcmcia
modules>.

Easiest fix is to check if the device is already bound to a driver in
device_bind_driver().  This avoids the double binding.

Signed-off-by: Daniel Ritz <daniel.ritz@gmx.ch>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>


---
drivers/base/dd.c |    3 +++
 1 file changed, 3 insertions(+)

--- scsi-2.6.orig/drivers/base/dd.c	2005-09-20 05:59:41.000000000 -0700
+++ scsi-2.6/drivers/base/dd.c	2005-09-21 17:29:03.000000000 -0700
@@ -40,6 +40,9 @@
  */
 void device_bind_driver(struct device * dev)
 {
+	if (klist_node_attached(&dev->knode_driver))
+		return;
+
 	pr_debug("bound device '%s' to driver '%s'\n",
 		 dev->bus_id, dev->driver->name);
 	klist_add_tail(&dev->knode_driver, &dev->driver->klist_devices);

--

[patch 02/18] Driver Core: add helper device_is_registered()

[Greg KH]

[-- Attachment #1: driver-device_is_registered.patch --]
[-- Type: text/plain, Size: 2663 bytes --]

From: Daniel Ritz <daniel.ritz@gmx.ch>

[PATCH] driver core: add helper device_is_registered()

add the helper and use it instead of open coding the klist_node_attached() check
(which is a layering violation IMHO)

idea by Alan Stern.

Signed-off-by: Daniel Ritz <daniel.ritz@gmx.ch>
Cc: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
 drivers/s390/cio/ccwgroup.c |    2 +-
 drivers/usb/core/message.c  |    2 +-
 drivers/usb/core/usb.c      |    6 +++---
 include/linux/device.h      |    5 +++++
 4 files changed, 10 insertions(+), 5 deletions(-)

--- scsi-2.6.orig/drivers/s390/cio/ccwgroup.c	2005-09-21 17:37:54.000000000 -0700
+++ scsi-2.6/drivers/s390/cio/ccwgroup.c	2005-09-21 17:37:59.000000000 -0700
@@ -437,7 +437,7 @@
 	if (cdev->dev.driver_data) {
 		gdev = (struct ccwgroup_device *)cdev->dev.driver_data;
 		if (get_device(&gdev->dev)) {
-			if (klist_node_attached(&gdev->dev.knode_bus))
+			if (device_is_registered(&gdev->dev))
 				return gdev;
 			put_device(&gdev->dev);
 		}
--- scsi-2.6.orig/drivers/usb/core/message.c	2005-09-21 17:37:54.000000000 -0700
+++ scsi-2.6/drivers/usb/core/message.c	2005-09-21 17:37:59.000000000 -0700
@@ -987,7 +987,7 @@
 
 			/* remove this interface if it has been registered */
 			interface = dev->actconfig->interface[i];
-			if (!klist_node_attached(&interface->dev.knode_bus))
+			if (!device_is_registered(&interface->dev))
 				continue;
 			dev_dbg (&dev->dev, "unregistering interface %s\n",
 				interface->dev.bus_id);
--- scsi-2.6.orig/drivers/usb/core/usb.c	2005-09-21 17:37:54.000000000 -0700
+++ scsi-2.6/drivers/usb/core/usb.c	2005-09-21 17:37:59.000000000 -0700
@@ -303,7 +303,7 @@
 	/* if interface was already added, bind now; else let
 	 * the future device_add() bind it, bypassing probe()
 	 */
-	if (klist_node_attached(&dev->knode_bus))
+	if (device_is_registered(dev))
 		device_bind_driver(dev);
 
 	return 0;
@@ -336,8 +336,8 @@
 	if (iface->condition != USB_INTERFACE_BOUND)
 		return;
 
-	/* release only after device_add() */
-	if (klist_node_attached(&dev->knode_bus)) {
+	/* don't release if the interface hasn't been added yet */
+	if (device_is_registered(dev)) {
 		iface->condition = USB_INTERFACE_UNBINDING;
 		device_release_driver(dev);
 	}
--- scsi-2.6.orig/include/linux/device.h	2005-09-21 17:37:54.000000000 -0700
+++ scsi-2.6/include/linux/device.h	2005-09-21 17:38:29.000000000 -0700
@@ -317,6 +317,11 @@
 	dev->driver_data = data;
 }
 
+static inline int device_is_registered(struct device *dev)
+{
+	return klist_node_attached(&dev->knode_bus);
+}
+
 /*
  * High level routines for use by the bus drivers
  */

--

[patch 03/18] fix class symlinks in sysfs

[Greg KH]

[-- Attachment #1: driver-fix-class-symlinks.patch --]
[-- Type: text/plain, Size: 1693 bytes --]

From: Bill Nottingham <notting@redhat.com>

The class symlinks in sysfs don't properly handle changing device names.

To demonstrate, rename your network device from eth0 to eth1. Your
pci (or usb, or whatever) device will still have a 'net:eth0' link,
except now it points to /sys/class/net/eth1.

The attached patch makes sure the class symlink name changes when
the class device name changes. It isn't 100% correct, it should be
using sysfs_rename_link. Unfortunately, sysfs_rename_link doesn't exist.

Signed-off-by: Bill Nottingham <notting@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
 drivers/base/class.c |   13 +++++++++++++
 1 file changed, 13 insertions(+)

--- scsi-2.6.orig/drivers/base/class.c	2005-09-20 05:59:41.000000000 -0700
+++ scsi-2.6/drivers/base/class.c	2005-09-21 17:29:22.000000000 -0700
@@ -669,6 +669,7 @@
 int class_device_rename(struct class_device *class_dev, char *new_name)
 {
 	int error = 0;
+	char *old_class_name = NULL, *new_class_name = NULL;
 
 	class_dev = class_device_get(class_dev);
 	if (!class_dev)
@@ -677,12 +678,24 @@
 	pr_debug("CLASS: renaming '%s' to '%s'\n", class_dev->class_id,
 		 new_name);
 
+	if (class_dev->dev)
+		old_class_name = make_class_name(class_dev);
+
 	strlcpy(class_dev->class_id, new_name, KOBJ_NAME_LEN);
 
 	error = kobject_rename(&class_dev->kobj, new_name);
 
+	if (class_dev->dev) {
+		new_class_name = make_class_name(class_dev);
+		sysfs_create_link(&class_dev->dev->kobj, &class_dev->kobj,
+				  new_class_name);
+		sysfs_remove_link(&class_dev->dev->kobj, old_class_name);
+	}
 	class_device_put(class_dev);
 
+	kfree(old_class_name);
+	kfree(new_class_name);
+
 	return error;
 }
 

--

[patch 04/18] I2C: remove me from the MAINTAINERS file for i2c

[Greg Kroah-Hartman]

[-- Attachment #1: i2c-maintainer.patch --]
[-- Type: text/plain, Size: 551 bytes --]


Remove my name from the I2C maintainer, Jean is more than capable of
handling it all now.

Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Jean Delvare <khali@linux-fr.org>


---
 MAINTAINERS |    2 --
 1 file changed, 2 deletions(-)

--- scsi-2.6.orig/MAINTAINERS	2005-09-20 05:59:35.000000000 -0700
+++ scsi-2.6/MAINTAINERS	2005-09-21 17:29:25.000000000 -0700
@@ -1063,8 +1063,6 @@
 S:	Maintained
 
 I2C SUBSYSTEM
-P:	Greg Kroah-Hartman
-M:	greg@kroah.com
 P:	Jean Delvare
 M:	khali@linux-fr.org
 L:	lm-sensors@lm-sensors.org

--

[patch 05/18] PCI: remove unused "scratch"

[Greg KH]

[-- Attachment #1: pci-remove-unused-scratch.patch --]
[-- Type: text/plain, Size: 711 bytes --]

From: Bjorn Helgaas <bjorn.helgaas@hp.com>

Unused variable.

Signed-off-by: Bjorn Helgaas <bjorn.helgaas@hp.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
 drivers/pci/hotplug.c |    4 ----
 1 file changed, 4 deletions(-)

--- scsi-2.6.orig/drivers/pci/hotplug.c	2005-09-20 05:59:55.000000000 -0700
+++ scsi-2.6/drivers/pci/hotplug.c	2005-09-21 17:29:27.000000000 -0700
@@ -7,7 +7,6 @@
 		 char *buffer, int buffer_size)
 {
 	struct pci_dev *pdev;
-	char *scratch;
 	int i = 0;
 	int length = 0;
 
@@ -18,9 +17,6 @@
 	if (!pdev)
 		return -ENODEV;
 
-	scratch = buffer;
-
-
 	if (add_hotplug_env_var(envp, num_envp, &i,
 				buffer, buffer_size, &length,
 				"PCI_CLASS=%04X", pdev->class))

--

[patch 06/18] PCI: convert kcalloc to kzalloc

[Greg KH]

[-- Attachment #1: pci-kzalloc.patch --]
[-- Type: text/plain, Size: 1764 bytes --]

From: Pekka Enberg <penberg@cs.helsinki.fi>

This patch converts kcalloc(1, ...) calls to use the new kzalloc() function.

Signed-off-by: Pekka Enberg <penberg@cs.helsinki.fi>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>


---
 drivers/pci/hotplug/sgi_hotplug.c |    6 +++---
 drivers/pci/pci-sysfs.c           |    2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

--- scsi-2.6.orig/drivers/pci/hotplug/sgi_hotplug.c	2005-09-20 05:59:55.000000000 -0700
+++ scsi-2.6/drivers/pci/hotplug/sgi_hotplug.c	2005-09-21 17:29:30.000000000 -0700
@@ -159,7 +159,7 @@
 
 	pcibus_info = SN_PCIBUS_BUSSOFT_INFO(pci_bus);
 
-	slot = kcalloc(1, sizeof(*slot), GFP_KERNEL);
+	slot = kzalloc(sizeof(*slot), GFP_KERNEL);
 	if (!slot)
 		return -ENOMEM;
 	bss_hotplug_slot->private = slot;
@@ -491,7 +491,7 @@
 		if (sn_pci_slot_valid(pci_bus, device) != 1)
 			continue;
 
-		bss_hotplug_slot = kcalloc(1, sizeof(*bss_hotplug_slot),
+		bss_hotplug_slot = kzalloc(sizeof(*bss_hotplug_slot),
 					   GFP_KERNEL);
 		if (!bss_hotplug_slot) {
 			rc = -ENOMEM;
@@ -499,7 +499,7 @@
 		}
 
 		bss_hotplug_slot->info =
-			kcalloc(1, sizeof(struct hotplug_slot_info),
+			kzalloc(sizeof(struct hotplug_slot_info),
 				GFP_KERNEL);
 		if (!bss_hotplug_slot->info) {
 			rc = -ENOMEM;
--- scsi-2.6.orig/drivers/pci/pci-sysfs.c	2005-09-20 05:59:55.000000000 -0700
+++ scsi-2.6/drivers/pci/pci-sysfs.c	2005-09-21 17:29:30.000000000 -0700
@@ -360,7 +360,7 @@
 			continue;
 
 		/* allocate attribute structure, piggyback attribute name */
-		res_attr = kcalloc(1, sizeof(*res_attr) + 10, GFP_ATOMIC);
+		res_attr = kzalloc(sizeof(*res_attr) + 10, GFP_ATOMIC);
 		if (res_attr) {
 			char *res_attr_name = (char *)(res_attr + 1);
 

--

[patch 07/18] fix drivers/pci/probe.c warning

[Greg KH]

[-- Attachment #1: pci-fix-probe-warning.patch --]
[-- Type: text/plain, Size: 1744 bytes --]

From: Amos Waterland <apw@us.ibm.com>

This function expects an unsigned 32-bit type as its third argument:

 static u32 pci_size(u32 base, u32 maxbase, u32 mask)

However, given these definitions:

 #define PCI_BASE_ADDRESS_MEM_MASK (~0x0fUL)
 #define PCI_ROM_ADDRESS_MASK (~0x7ffUL)

these two calls in drivers/pci/probe.c are problematic for architectures
for which a UL is not equivalent to a u32:
 
 sz = pci_size(l, sz, PCI_BASE_ADDRESS_MEM_MASK);
 sz = pci_size(l, sz, PCI_ROM_ADDRESS_MASK);

Hence the below compile warning when building for ARCH=ppc64:

 drivers/pci/probe.c: In function `pci_read_bases':
 /.../probe.c:168: warning: large integer implicitly truncated to unsigned type
 /.../probe.c:218: warning: large integer implicitly truncated to unsigned type

Here is a simple fix.

Signed-off-by: Amos Waterland <apw@us.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>


---
 drivers/pci/probe.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- scsi-2.6.orig/drivers/pci/probe.c	2005-09-20 05:59:55.000000000 -0700
+++ scsi-2.6/drivers/pci/probe.c	2005-09-21 17:29:32.000000000 -0700
@@ -165,7 +165,7 @@
 		if (l == 0xffffffff)
 			l = 0;
 		if ((l & PCI_BASE_ADDRESS_SPACE) == PCI_BASE_ADDRESS_SPACE_MEMORY) {
-			sz = pci_size(l, sz, PCI_BASE_ADDRESS_MEM_MASK);
+			sz = pci_size(l, sz, (u32)PCI_BASE_ADDRESS_MEM_MASK);
 			if (!sz)
 				continue;
 			res->start = l & PCI_BASE_ADDRESS_MEM_MASK;
@@ -215,7 +215,7 @@
 		if (l == 0xffffffff)
 			l = 0;
 		if (sz && sz != 0xffffffff) {
-			sz = pci_size(l, sz, PCI_ROM_ADDRESS_MASK);
+			sz = pci_size(l, sz, (u32)PCI_ROM_ADDRESS_MASK);
 			if (sz) {
 				res->flags = (l & IORESOURCE_ROM_ENABLE) |
 				  IORESOURCE_MEM | IORESOURCE_PREFETCH |

--

[patch 08/18] PCI Hotplug: Fix buffer overrun in rpadlpar_sysfs.c

[Greg KH]

[-- Attachment #1: pci-buffer-overrun-rpaldpar.patch --]
[-- Type: text/plain, Size: 783 bytes --]

From: Linda Xie <lxiep@us.ibm.com>

Signed-off-by: Linda Xie <lxie@us.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>


---
 drivers/pci/hotplug/rpadlpar_sysfs.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- scsi-2.6.orig/drivers/pci/hotplug/rpadlpar_sysfs.c	2005-09-20 05:59:55.000000000 -0700
+++ scsi-2.6/drivers/pci/hotplug/rpadlpar_sysfs.c	2005-09-21 17:29:34.000000000 -0700
@@ -62,7 +62,7 @@
 	char drc_name[MAX_DRC_NAME_LEN];
 	char *end;
 
-	if (nbytes > MAX_DRC_NAME_LEN)
+	if (nbytes >= MAX_DRC_NAME_LEN)
 		return 0;
 
 	memcpy(drc_name, buf, nbytes);
@@ -83,7 +83,7 @@
 	char drc_name[MAX_DRC_NAME_LEN];
 	char *end;
 
-	if (nbytes > MAX_DRC_NAME_LEN)
+	if (nbytes >= MAX_DRC_NAME_LEN)
 		return 0;
 
 	memcpy(drc_name, buf, nbytes);

--

[patch 09/18] ub: fix burning cds

[Greg KH]

[-- Attachment #1: ub-burn-cd-fix.patch --]
[-- Type: text/plain, Size: 6656 bytes --]

From: Pete Zaitcev <zaitcev@redhat.com>

This patch fixes a few problems with ub and cleans up a couple of things:

 - Bump UB_MAX_REQ_SG, this allows to burn CDs
 - Drop initialization of urb.transfer_flags,
   now that URB_UNLINK_ASYNC is gone
 - Add forgotten processing of stalls at GetMaxLUN
 - Remove a few more P3-tagged printks whose time has come
 - Correct comment about ZIP-100

Signed-off-by: Pete Zaitcev <zaitcev@yahoo.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

 drivers/block/ub.c |   53 +++++++++++++++++++++++++++--------------------------
 1 file changed, 27 insertions(+), 26 deletions(-)

--- scsi-2.6.orig/drivers/block/ub.c	2005-09-20 05:59:42.000000000 -0700
+++ scsi-2.6/drivers/block/ub.c	2005-09-21 17:29:36.000000000 -0700
@@ -172,7 +172,7 @@
  */
 struct ub_dev;
 
-#define UB_MAX_REQ_SG	4
+#define UB_MAX_REQ_SG	9	/* cdrecord requires 32KB and maybe a header */
 #define UB_MAX_SECTORS 64
 
 /*
@@ -387,7 +387,7 @@
 	struct bulk_cs_wrap work_bcs;
 	struct usb_ctrlrequest work_cr;
 
-	int sg_stat[UB_MAX_REQ_SG+1];
+	int sg_stat[6];
 	struct ub_scsi_trace tr;
 };
 
@@ -525,12 +525,13 @@
 	    "qlen %d qmax %d\n",
 	    sc->cmd_queue.qlen, sc->cmd_queue.qmax);
 	cnt += sprintf(page + cnt,
-	    "sg %d %d %d %d %d\n",
+	    "sg %d %d %d %d %d .. %d\n",
 	    sc->sg_stat[0],
 	    sc->sg_stat[1],
 	    sc->sg_stat[2],
 	    sc->sg_stat[3],
-	    sc->sg_stat[4]);
+	    sc->sg_stat[4],
+	    sc->sg_stat[5]);
 
 	list_for_each (p, &sc->luns) {
 		lun = list_entry(p, struct ub_lun, link);
@@ -835,7 +836,7 @@
 		return -1;
 	}
 	cmd->nsg = n_elem;
-	sc->sg_stat[n_elem]++;
+	sc->sg_stat[n_elem < 5 ? n_elem : 5]++;
 
 	/*
 	 * build the command
@@ -891,7 +892,7 @@
 		return -1;
 	}
 	cmd->nsg = n_elem;
-	sc->sg_stat[n_elem]++;
+	sc->sg_stat[n_elem < 5 ? n_elem : 5]++;
 
 	memcpy(&cmd->cdb, rq->cmd, rq->cmd_len);
 	cmd->cdb_len = rq->cmd_len;
@@ -1010,7 +1011,6 @@
 	sc->last_pipe = sc->send_bulk_pipe;
 	usb_fill_bulk_urb(&sc->work_urb, sc->dev, sc->send_bulk_pipe,
 	    bcb, US_BULK_CB_WRAP_LEN, ub_urb_complete, sc);
-	sc->work_urb.transfer_flags = 0;
 
 	/* Fill what we shouldn't be filling, because usb-storage did so. */
 	sc->work_urb.actual_length = 0;
@@ -1019,7 +1019,6 @@
 
 	if ((rc = usb_submit_urb(&sc->work_urb, GFP_ATOMIC)) != 0) {
 		/* XXX Clear stalls */
-		printk("ub: cmd #%d start failed (%d)\n", cmd->tag, rc); /* P3 */
 		ub_complete(&sc->work_done);
 		return rc;
 	}
@@ -1190,11 +1189,9 @@
 			return;
 		}
 		if (urb->status != 0) {
-			printk("ub: cmd #%d cmd status (%d)\n", cmd->tag, urb->status); /* P3 */
 			goto Bad_End;
 		}
 		if (urb->actual_length != US_BULK_CB_WRAP_LEN) {
-			printk("ub: cmd #%d xferred %d\n", cmd->tag, urb->actual_length); /* P3 */
 			/* XXX Must do reset here to unconfuse the device */
 			goto Bad_End;
 		}
@@ -1395,14 +1392,12 @@
 	usb_fill_bulk_urb(&sc->work_urb, sc->dev, pipe,
 	    page_address(sg->page) + sg->offset, sg->length,
 	    ub_urb_complete, sc);
-	sc->work_urb.transfer_flags = 0;
 	sc->work_urb.actual_length = 0;
 	sc->work_urb.error_count = 0;
 	sc->work_urb.status = 0;
 
 	if ((rc = usb_submit_urb(&sc->work_urb, GFP_ATOMIC)) != 0) {
 		/* XXX Clear stalls */
-		printk("ub: data #%d submit failed (%d)\n", cmd->tag, rc); /* P3 */
 		ub_complete(&sc->work_done);
 		ub_state_done(sc, cmd, rc);
 		return;
@@ -1442,7 +1437,6 @@
 	sc->last_pipe = sc->recv_bulk_pipe;
 	usb_fill_bulk_urb(&sc->work_urb, sc->dev, sc->recv_bulk_pipe,
 	    &sc->work_bcs, US_BULK_CS_WRAP_LEN, ub_urb_complete, sc);
-	sc->work_urb.transfer_flags = 0;
 	sc->work_urb.actual_length = 0;
 	sc->work_urb.error_count = 0;
 	sc->work_urb.status = 0;
@@ -1563,7 +1557,6 @@
 
 	usb_fill_control_urb(&sc->work_urb, sc->dev, sc->send_ctrl_pipe,
 	    (unsigned char*) cr, NULL, 0, ub_urb_complete, sc);
-	sc->work_urb.transfer_flags = 0;
 	sc->work_urb.actual_length = 0;
 	sc->work_urb.error_count = 0;
 	sc->work_urb.status = 0;
@@ -2000,17 +1993,16 @@
 
 	usb_fill_control_urb(&sc->work_urb, sc->dev, sc->recv_ctrl_pipe,
 	    (unsigned char*) cr, p, 1, ub_probe_urb_complete, &compl);
-	sc->work_urb.transfer_flags = 0;
 	sc->work_urb.actual_length = 0;
 	sc->work_urb.error_count = 0;
 	sc->work_urb.status = 0;
 
 	if ((rc = usb_submit_urb(&sc->work_urb, GFP_KERNEL)) != 0) {
 		if (rc == -EPIPE) {
-			printk("%s: Stall at GetMaxLUN, using 1 LUN\n",
+			printk("%s: Stall submitting GetMaxLUN, using 1 LUN\n",
 			     sc->name); /* P3 */
 		} else {
-			printk(KERN_WARNING
+			printk(KERN_NOTICE
 			     "%s: Unable to submit GetMaxLUN (%d)\n",
 			     sc->name, rc);
 		}
@@ -2028,6 +2020,18 @@
 	del_timer_sync(&timer);
 	usb_kill_urb(&sc->work_urb);
 
+	if ((rc = sc->work_urb.status) < 0) {
+		if (rc == -EPIPE) {
+			printk("%s: Stall at GetMaxLUN, using 1 LUN\n",
+			     sc->name); /* P3 */
+		} else {
+			printk(KERN_NOTICE
+			     "%s: Error at GetMaxLUN (%d)\n",
+			     sc->name, rc);
+		}
+		goto err_io;
+	}
+
 	if (sc->work_urb.actual_length != 1) {
 		printk("%s: GetMaxLUN returned %d bytes\n", sc->name,
 		    sc->work_urb.actual_length); /* P3 */
@@ -2048,6 +2052,7 @@
 	kfree(p);
 	return nluns;
 
+err_io:
 err_submit:
 	kfree(p);
 err_alloc:
@@ -2080,7 +2085,6 @@
 
 	usb_fill_control_urb(&sc->work_urb, sc->dev, sc->send_ctrl_pipe,
 	    (unsigned char*) cr, NULL, 0, ub_probe_urb_complete, &compl);
-	sc->work_urb.transfer_flags = 0;
 	sc->work_urb.actual_length = 0;
 	sc->work_urb.error_count = 0;
 	sc->work_urb.status = 0;
@@ -2241,10 +2245,10 @@
 	for (i = 0; i < 3; i++) {
 		if ((rc = ub_sync_getmaxlun(sc)) < 0) {
 			/* 
-			 * Some devices (i.e. Iomega Zip100) need this --
-			 * apparently the bulk pipes get STALLed when the
-			 * GetMaxLUN request is processed.
-			 * XXX I have a ZIP-100, verify it does this.
+			 * This segment is taken from usb-storage. They say
+			 * that ZIP-100 needs this, but my own ZIP-100 works
+			 * fine without this.
+			 * Still, it does not seem to hurt anything.
 			 */
 			if (rc == -EPIPE) {
 				ub_probe_clear_stall(sc, sc->recv_bulk_pipe);
@@ -2313,7 +2317,7 @@
 	disk->first_minor = lun->id * UB_MINORS_PER_MAJOR;
 	disk->fops = &ub_bd_fops;
 	disk->private_data = lun;
-	disk->driverfs_dev = &sc->intf->dev;	/* XXX Many to one ok? */
+	disk->driverfs_dev = &sc->intf->dev;
 
 	rc = -ENOMEM;
 	if ((q = blk_init_queue(ub_request_fn, &sc->lock)) == NULL)
@@ -2466,9 +2470,6 @@
 {
 	int rc;
 
-	/* P3 */ printk("ub: sizeof ub_scsi_cmd %zu ub_dev %zu ub_lun %zu\n",
-			sizeof(struct ub_scsi_cmd), sizeof(struct ub_dev), sizeof(struct ub_lun));
-
 	if ((rc = register_blkdev(UB_MAJOR, DRV_NAME)) != 0)
 		goto err_regblkdev;
 	devfs_mk_dir(DEVFS_NAME);

--

[patch 10/18] USB: more device IDs for Option card driver

[Greg KH]

[-- Attachment #1: usb-option-new-ids.patch --]
[-- Type: text/plain, Size: 1566 bytes --]

From: Matthias Urlichs <smurf@smurf.noris.de>

Added support for HUAWEI E600 and Audiovox AirCard

User reports say that these devices work without driver modification.

Signed-off-by: Matthias Urlichs <smurf@smurf.noris.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>


---
 drivers/usb/serial/option.c |    7 +++++++
 1 file changed, 7 insertions(+)

--- scsi-2.6.orig/drivers/usb/serial/option.c	2005-09-20 06:00:04.000000000 -0700
+++ scsi-2.6/drivers/usb/serial/option.c	2005-09-21 17:29:39.000000000 -0700
@@ -25,6 +25,7 @@
   2005-06-20  v0.4.1 add missing braces :-/
                      killed end-of-line whitespace
   2005-07-15  v0.4.2 rename WLAN product to FUSION, add FUSION2
+  2005-09-10  v0.4.3 added HUAWEI E600 card and Audiovox AirCard
 
   Work sponsored by: Sigos GmbH, Germany <info@sigos.de>
 
@@ -71,15 +72,21 @@
 
 /* Vendor and product IDs */
 #define OPTION_VENDOR_ID			0x0AF0
+#define HUAWEI_VENDOR_ID			0x12D1
+#define AUDIOVOX_VENDOR_ID			0x0F3D
 
 #define OPTION_PRODUCT_OLD		0x5000
 #define OPTION_PRODUCT_FUSION	0x6000
 #define OPTION_PRODUCT_FUSION2	0x6300
+#define HUAWEI_PRODUCT_E600     0x1001
+#define AUDIOVOX_PRODUCT_AIRCARD 0x0112
 
 static struct usb_device_id option_ids[] = {
 	{ USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_OLD) },
 	{ USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_FUSION) },
 	{ USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_FUSION2) },
+	{ USB_DEVICE(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E600) },
+	{ USB_DEVICE(AUDIOVOX_VENDOR_ID, AUDIOVOX_PRODUCT_AIRCARD) },
 	{ } /* Terminating entry */
 };
 

--

[patch 11/18] USB: ftdi_sio: allow baud rate to be changed without raising RTS and DTR

[Greg KH]

[-- Attachment #1: usb-ftdi_sio-baud-rate-change.patch --]
[-- Type: text/plain, Size: 1494 bytes --]

From: Peter Favrholdt <pfavr@how.dk>

I'm using a 2 port USB RS232 dongle to connect to a serial-IR cradle for
a bar code reader). Detecting the baudrate of the serial-IR involves
keeping DTR low while changing baudrate.

This works using normal 16550A serial ports as well as the FTDI driver
version 1.4.0 (Linux 2.6.8) but stopped working with the change to
"ensure RTS and DTR are raised when changing baudrate" introduced in
version 1.4.1 (Linux 2.6.9).

The attached patch fixes this, so RTS and DTR is only raised when
changing baudrate iff the previous baudrate was B0.

Signed-off-by: Peter Favrholdt <pfavr@how.dk>
Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
 drivers/usb/serial/ftdi_sio.c |    8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

--- scsi-2.6.orig/drivers/usb/serial/ftdi_sio.c	2005-09-20 06:00:04.000000000 -0700
+++ scsi-2.6/drivers/usb/serial/ftdi_sio.c	2005-09-21 17:29:41.000000000 -0700
@@ -1846,10 +1846,12 @@
 	} else {
 		/* set the baudrate determined before */
 		if (change_speed(port)) {
-			err("%s urb failed to set baurdrate", __FUNCTION__);
+			err("%s urb failed to set baudrate", __FUNCTION__);
+		}
+		/* Ensure RTS and DTR are raised when baudrate changed from 0 */
+		if ((old_termios->c_cflag & CBAUD) == B0) {
+			set_mctrl(port, TIOCM_DTR | TIOCM_RTS);
 		}
-		/* Ensure  RTS and DTR are raised */
-		set_mctrl(port, TIOCM_DTR | TIOCM_RTS);
 	}
 
 	/* Set flow control */

--

[patch 12/18] USB: fix pxa2xx_udc compile warnings

[Greg KH]

[-- Attachment #1: usb-pxa2xx_udc-build-fix.patch --]
[-- Type: text/plain, Size: 1860 bytes --]

From: Richard Purdie <rpurdie@rpsys.net>

This patch fixes several types in the PXA25x udc driver and hence fixes
several compiler warnings.

Signed-off-by: Richard Purdie <rpurdie@rpsys.net>
Acked-by: David Brownell <dbrownell@users.sourceforge.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>


---
 drivers/usb/gadget/pxa2xx_udc.c |    4 ++--
 drivers/usb/gadget/pxa2xx_udc.h |    8 ++++----
 2 files changed, 6 insertions(+), 6 deletions(-)

--- scsi-2.6.orig/drivers/usb/gadget/pxa2xx_udc.c	2005-09-20 06:00:03.000000000 -0700
+++ scsi-2.6/drivers/usb/gadget/pxa2xx_udc.c	2005-09-21 17:29:43.000000000 -0700
@@ -422,7 +422,7 @@
 }
 
 static int
-write_packet(volatile u32 *uddr, struct pxa2xx_request *req, unsigned max)
+write_packet(volatile unsigned long *uddr, struct pxa2xx_request *req, unsigned max)
 {
 	u8		*buf;
 	unsigned	length, count;
@@ -2602,7 +2602,7 @@
  * VBUS IRQs should probably be ignored so that the PXA device just acts
  * "dead" to USB hosts until system resume.
  */
-static int pxa2xx_udc_suspend(struct device *dev, u32 state, u32 level)
+static int pxa2xx_udc_suspend(struct device *dev, pm_message_t state, u32 level)
 {
 	struct pxa2xx_udc	*udc = dev_get_drvdata(dev);
 
--- scsi-2.6.orig/drivers/usb/gadget/pxa2xx_udc.h	2005-09-20 06:00:03.000000000 -0700
+++ scsi-2.6/drivers/usb/gadget/pxa2xx_udc.h	2005-09-21 17:29:43.000000000 -0700
@@ -69,11 +69,11 @@
 	 * UDDR = UDC Endpoint Data Register (the fifo)
 	 * DRCM = DMA Request Channel Map
 	 */
-	volatile u32				*reg_udccs;
-	volatile u32				*reg_ubcr;
-	volatile u32				*reg_uddr;
+	volatile unsigned long			*reg_udccs;
+	volatile unsigned long			*reg_ubcr;
+	volatile unsigned long			*reg_uddr;
 #ifdef USE_DMA
-	volatile u32				*reg_drcmr;
+	volatile unsigned long			*reg_drcmr;
 #define	drcmr(n)  .reg_drcmr = & DRCMR ## n ,
 #else
 #define	drcmr(n)  

--

[patch 13/18] USB: sl811-hcd minor fixes

[Greg KH]

[-- Attachment #1: usb-sl811-minor-fixes.patch --]
[-- Type: text/plain, Size: 2206 bytes --]

From: David Brownell <david-b@pacbell.net>

Three minor sl811-hcd fixes:

 - Elminate memory leak on one (rare) disable/shutdown path.

 - For periodic transfers that don't need to be scheduled, update
   urb->start_frame to represent the transfer phase correctly.

 - Report the (single) port as removable, by default.

Since no drivers yet use start_frame or that part of the hub descriptor,
only that leak is likely to ever matter.

Signed-off-by: David Brownell <dbrownell@users.sourceforge.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

 drivers/usb/host/sl811-hcd.c |   16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)

--- scsi-2.6.orig/drivers/usb/host/sl811-hcd.c	2005-09-20 06:00:03.000000000 -0700
+++ scsi-2.6/drivers/usb/host/sl811-hcd.c	2005-09-21 17:29:45.000000000 -0700
@@ -782,6 +782,9 @@
 /* usb 1.1 says max 90% of a frame is available for periodic transfers.
  * this driver doesn't promise that much since it's got to handle an
  * IRQ per packet; irq handling latencies also use up that time.
+ *
+ * NOTE:  the periodic schedule is a sparse tree, with the load for
+ * each branch minimized.  see fig 3.5 in the OHCI spec for example.
  */
 #define	MAX_PERIODIC_LOAD	500	/* out of 1000 usec */
 
@@ -843,6 +846,7 @@
 	if (!(sl811->port1 & (1 << USB_PORT_FEAT_ENABLE))
 			|| !HC_IS_RUNNING(hcd->state)) {
 		retval = -ENODEV;
+		kfree(ep);
 		goto fail;
 	}
 
@@ -911,8 +915,16 @@
 	case PIPE_ISOCHRONOUS:
 	case PIPE_INTERRUPT:
 		urb->interval = ep->period;
-		if (ep->branch < PERIODIC_SIZE)
+		if (ep->branch < PERIODIC_SIZE) {
+			/* NOTE:  the phase is correct here, but the value
+			 * needs offsetting by the transfer queue depth.
+			 * All current drivers ignore start_frame, so this
+			 * is unlikely to ever matter...
+			 */
+			urb->start_frame = (sl811->frame & (PERIODIC_SIZE - 1))
+						+ ep->branch;
 			break;
+		}
 
 		retval = balance(sl811, ep->period, ep->load);
 		if (retval < 0)
@@ -1122,7 +1134,7 @@
 	desc->wHubCharacteristics = (__force __u16)cpu_to_le16(temp);
 
 	/* two bitmaps:  ports removable, and legacy PortPwrCtrlMask */
-	desc->bitmap[0] = 1 << 1;
+	desc->bitmap[0] = 0 << 1;
 	desc->bitmap[1] = ~0;
 }
 

--

[patch 14/18] USB: fix pegasus driver

[Greg KH]

[-- Attachment #1: usb-pegasus-fix.patch --]
[-- Type: text/plain, Size: 2454 bytes --]

From: Kevin Vigor <kevin@realmsys.com>

Addresses some small bugs in the pegasus ethernet-over-USB driver. 
Specifically, malformed long packets from the adapter could cause a kernel
panic; the interrupt interval calculation was inappropriate for high-speed
devices; the return code from read_mii_word was tested incorrectly; and
failure to unlink outstanding URBs before freeing them could lead to kernel
panics when unloading the driver.

Signed-off-by: Kevin Vigor <kevin@realmsys.com>
Cc: Petko Manolov <petkan@users.sourceforge.net>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>


---
 drivers/usb/net/pegasus.c |   29 ++++++++++++++++++++---------
 1 file changed, 20 insertions(+), 9 deletions(-)

--- scsi-2.6.orig/drivers/usb/net/pegasus.c	2005-09-20 06:00:04.000000000 -0700
+++ scsi-2.6/drivers/usb/net/pegasus.c	2005-09-21 17:29:48.000000000 -0700
@@ -648,6 +648,13 @@
 	}
 
 	/*
+	 * If the packet is unreasonably long, quietly drop it rather than
+	 * kernel panicing by calling skb_put.
+	 */
+	if (pkt_len > PEGASUS_MTU)
+		goto goon;
+
+	/*
 	 * at this point we are sure pegasus->rx_skb != NULL
 	 * so we go ahead and pass up the packet.
 	 */
@@ -886,15 +893,17 @@
 	__u8 data[2];
 
 	read_eprom_word(pegasus, 4, (__u16 *) data);
-	if (data[1] < 0x80) {
-		if (netif_msg_timer(pegasus))
-			dev_info(&pegasus->intf->dev,
-				"intr interval changed from %ums to %ums\n",
-				data[1], 0x80);
-		data[1] = 0x80;
-#ifdef	PEGASUS_WRITE_EEPROM
-		write_eprom_word(pegasus, 4, *(__u16 *) data);
+	if (pegasus->usb->speed != USB_SPEED_HIGH) {
+		if (data[1] < 0x80) {
+			if (netif_msg_timer(pegasus))
+				dev_info(&pegasus->intf->dev, "intr interval "
+					"changed from %ums to %ums\n",
+					data[1], 0x80);
+			data[1] = 0x80;
+#ifdef PEGASUS_WRITE_EEPROM
+			write_eprom_word(pegasus, 4, *(__u16 *) data);
 #endif
+		}
 	}
 	pegasus->intr_interval = data[1];
 }
@@ -904,8 +913,9 @@
 	pegasus_t *pegasus = netdev_priv(net);
 	u16 tmp;
 
-	if (read_mii_word(pegasus, pegasus->phy, MII_BMSR, &tmp))
+	if (!read_mii_word(pegasus, pegasus->phy, MII_BMSR, &tmp))
 		return;
+
 	if (tmp & BMSR_LSTATUS)
 		netif_carrier_on(net);
 	else
@@ -1355,6 +1365,7 @@
 	cancel_delayed_work(&pegasus->carrier_check);
 	unregister_netdev(pegasus->net);
 	usb_put_dev(interface_to_usbdev(intf));
+	unlink_all_urbs(pegasus);
 	free_all_urbs(pegasus);
 	free_skb_pool(pegasus);
 	if (pegasus->rx_skb)

--

[patch 15/18] usb/serial/option.c: Increase input buffer size

[Greg KH]

[-- Attachment #1: usb-option-urb-buffer.patch --]
[-- Type: text/plain, Size: 1024 bytes --]

From: Matthias Urlichs <smurf@smurf.noris.de>

The card sometimes sends >2000 bytes in one single chunk. Ouch.

Signed-Off-By: Matthias Urlichs <smurf@smurf.noris.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
 drivers/usb/serial/option.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

--- scsi-2.6.orig/drivers/usb/serial/option.c	2005-09-21 17:29:40.000000000 -0700
+++ scsi-2.6/drivers/usb/serial/option.c	2005-09-21 17:29:50.000000000 -0700
@@ -26,6 +26,8 @@
                      killed end-of-line whitespace
   2005-07-15  v0.4.2 rename WLAN product to FUSION, add FUSION2
   2005-09-10  v0.4.3 added HUAWEI E600 card and Audiovox AirCard
+  2005-09-20  v0.4.4 increased recv buffer size: the card sometimes
+                     wants to send >2000 bytes.
 
   Work sponsored by: Sigos GmbH, Germany <info@sigos.de>
 
@@ -139,7 +141,7 @@
 
 #define N_IN_URB 4
 #define N_OUT_URB 1
-#define IN_BUFLEN 1024
+#define IN_BUFLEN 4096
 #define OUT_BUFLEN 128
 
 struct option_port_private {

--

[patch 16/18] USB: Add Novatel CDMA Wireless PC card IDs to airprime

[Greg KH]

[-- Attachment #1: usb-airprime-id.patch --]
[-- Type: text/plain, Size: 887 bytes --]

From: David Hollis <dhollis@davehollis.com>


USB: Add device id's for Novatel Wireless CDMA wireless PC card.
     The Novatel CDMA card behaves the same as the AirPrime by providing
     a USB serial port.

Signed-off-by: David Hollis <dhollis@davehollis.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
 drivers/usb/serial/airprime.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- scsi-2.6.orig/drivers/usb/serial/airprime.c	2005-09-20 06:00:04.000000000 -0700
+++ scsi-2.6/drivers/usb/serial/airprime.c	2005-09-21 17:29:52.000000000 -0700
@@ -16,7 +16,8 @@
 #include "usb-serial.h"
 
 static struct usb_device_id id_table [] = {
-	{ USB_DEVICE(0xf3d, 0x0112) },
+	{ USB_DEVICE(0xf3d, 0x0112) },  /* AirPrime CDMA Wireless PC Card */
+	{ USB_DEVICE(0x1410, 0x1110) }, /* Novatel Wireless Merlin CDMA */
 	{ },
 };
 MODULE_DEVICE_TABLE(usb, id_table);

--

[patch 17/18] ub: Comment out unconditional stall clear

[Greg KH]

[-- Attachment #1: ub-fix-ipaq.patch --]
[-- Type: text/plain, Size: 970 bytes --]

From: Pete Zaitcev <zaitcev@redhat.com>

This code appears to be more trouble than it's worth, considering that
no normal users reload drivers. So, we comment it for now. It is not
removed outright for the benefit of hackers (that is, myself).

Signed-off-by: Pete Zaitcev <zaitcev@yahoo.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
 drivers/block/ub.c |    2 ++
 1 file changed, 2 insertions(+)

--- scsi-2.6.orig/drivers/block/ub.c	2005-09-21 17:29:38.000000000 -0700
+++ scsi-2.6/drivers/block/ub.c	2005-09-21 17:29:54.000000000 -0700
@@ -2217,8 +2217,10 @@
 	 * This is needed to clear toggles. It is a problem only if we do
 	 * `rmmod ub && modprobe ub` without disconnects, but we like that.
 	 */
+#if 0 /* iPod Mini fails if we do this (big white iPod works) */
 	ub_probe_clear_stall(sc, sc->recv_bulk_pipe);
 	ub_probe_clear_stall(sc, sc->send_bulk_pipe);
+#endif
 
 	/*
 	 * The way this is used by the startup code is a little specific.

--

[patch 18/18] USB: Update Documentation/usb/URB.txt

[Greg KH]

[-- Attachment #1: usb-update-urb.txt.patch --]
[-- Type: text/plain, Size: 6226 bytes --]

From: Alan Stern <stern@rowland.harvard.edu>

This patch (as564) updates Documentation/usb/URB.txt, bringing it roughly 
up to the current level.

Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
 Documentation/usb/URB.txt |   76 +++++++++++++++++++---------------------------
 1 file changed, 32 insertions(+), 44 deletions(-)

--- scsi-2.6.orig/Documentation/usb/URB.txt	2005-09-20 05:59:35.000000000 -0700
+++ scsi-2.6/Documentation/usb/URB.txt	2005-09-21 17:29:56.000000000 -0700
@@ -1,5 +1,6 @@
 Revised: 2000-Dec-05.
 Again:   2002-Jul-06
+Again:   2005-Sep-19
 
     NOTE:
 
@@ -18,8 +19,8 @@
   and deliver the data and status back. 
 
 - Execution of an URB is inherently an asynchronous operation, i.e. the 
-  usb_submit_urb(urb) call returns immediately after it has successfully queued 
-  the requested action. 
+  usb_submit_urb(urb) call returns immediately after it has successfully
+  queued the requested action.
 
 - Transfers for one URB can be canceled with usb_unlink_urb(urb) at any time. 
 
@@ -94,8 +95,9 @@
 
 	void usb_free_urb(struct urb *urb)
 
-You may not free an urb that you've submitted, but which hasn't yet been
-returned to you in a completion callback.
+You may free an urb that you've submitted, but which hasn't yet been
+returned to you in a completion callback.  It will automatically be
+deallocated when it is no longer in use.
 
 
 1.4. What has to be filled in?
@@ -145,30 +147,36 @@
 
 1.6. How to cancel an already running URB?
 
-For an URB which you've submitted, but which hasn't been returned to
-your driver by the host controller, call
+There are two ways to cancel an URB you've submitted but which hasn't
+been returned to your driver yet.  For an asynchronous cancel, call
 
 	int usb_unlink_urb(struct urb *urb)
 
 It removes the urb from the internal list and frees all allocated
-HW descriptors. The status is changed to reflect unlinking. After 
-usb_unlink_urb() returns with that status code, you can free the URB
-with usb_free_urb().
-
-There is also an asynchronous unlink mode.  To use this, set the
-the URB_ASYNC_UNLINK flag in urb->transfer flags before calling
-usb_unlink_urb().  When using async unlinking, the URB will not
-normally be unlinked when usb_unlink_urb() returns.  Instead, wait
-for the completion handler to be called.
+HW descriptors. The status is changed to reflect unlinking.  Note
+that the URB will not normally have finished when usb_unlink_urb()
+returns; you must still wait for the completion handler to be called.
+
+To cancel an URB synchronously, call
+
+	void usb_kill_urb(struct urb *urb)
+
+It does everything usb_unlink_urb does, and in addition it waits
+until after the URB has been returned and the completion handler
+has finished.  It also marks the URB as temporarily unusable, so
+that if the completion handler or anyone else tries to resubmit it
+they will get a -EPERM error.  Thus you can be sure that when
+usb_kill_urb() returns, the URB is totally idle.
 
 
 1.7. What about the completion handler?
 
 The handler is of the following type:
 
-	typedef void (*usb_complete_t)(struct urb *);
+	typedef void (*usb_complete_t)(struct urb *, struct pt_regs *)
 
-i.e. it gets just the URB that caused the completion call.
+I.e., it gets the URB that caused the completion call, plus the
+register values at the time of the corresponding interrupt (if any).
 In the completion handler, you should have a look at urb->status to
 detect any USB errors. Since the context parameter is included in the URB,
 you can pass information to the completion handler. 
@@ -176,17 +184,11 @@
 Note that even when an error (or unlink) is reported, data may have been
 transferred.  That's because USB transfers are packetized; it might take
 sixteen packets to transfer your 1KByte buffer, and ten of them might
-have transferred succesfully before the completion is called.
+have transferred succesfully before the completion was called.
 
 
 NOTE:  ***** WARNING *****
-Don't use urb->dev field in your completion handler; it's cleared
-as part of giving urbs back to drivers.  (Addressing an issue with
-ownership of periodic URBs, which was otherwise ambiguous.) Instead,
-use urb->context to hold all the data your driver needs.
-
-NOTE:  ***** WARNING *****
-Also, NEVER SLEEP IN A COMPLETION HANDLER.  These are normally called
+NEVER SLEEP IN A COMPLETION HANDLER.  These are normally called
 during hardware interrupt processing.  If you can, defer substantial
 work to a tasklet (bottom half) to keep system latencies low.  You'll
 probably need to use spinlocks to protect data structures you manipulate
@@ -229,24 +231,10 @@
 Interrupt transfers, like isochronous transfers, are periodic, and happen
 in intervals that are powers of two (1, 2, 4 etc) units.  Units are frames
 for full and low speed devices, and microframes for high speed ones.
-
-Currently, after you submit one interrupt URB, that urb is owned by the
-host controller driver until you cancel it with usb_unlink_urb().  You
-may unlink interrupt urbs in their completion handlers, if you need to.
-
-After a transfer completion is called, the URB is automagically resubmitted.
-THIS BEHAVIOR IS EXPECTED TO BE REMOVED!!
-
-Interrupt transfers may only send (or receive) the "maxpacket" value for
-the given interrupt endpoint; if you need more data, you will need to
-copy that data out of (or into) another buffer.  Similarly, you can't
-queue interrupt transfers.
-THESE RESTRICTIONS ARE EXPECTED TO BE REMOVED!!
-
-Note that this automagic resubmission model does make it awkward to use
-interrupt OUT transfers.  The portable solution involves unlinking those
-OUT urbs after the data is transferred, and perhaps submitting a final
-URB for a short packet.
-
 The usb_submit_urb() call modifies urb->interval to the implemented interval
 value that is less than or equal to the requested interval value.
+
+In Linux 2.6, unlike earlier versions, interrupt URBs are not automagically
+restarted when they complete.  They end when the completion handler is
+called, just like other URBs.  If you want an interrupt URB to be restarted,
+your completion handler must resubmit it.

--