Merge kroah.com:/home/greg/linux/BK/bleeding_edge-2.5

into kroah.com:/home/greg/linux/BK/gregkh-2.5

drivers/base/hotplug.c

@@ -18,6 +18,7 @@
 #include <linux/kmod.h>
 #include <linux/interrupt.h>
 #include "base.h"
+#include "fs/fs.h"
 
 /*
  * hotplugging invokes what /proc/sys/kernel/hotplug says (normally
@@ -32,14 +33,16 @@
 int dev_hotplug (struct device *dev, const char *action)
 {
 	char *argv [3], **envp, *buffer, *scratch;
+	char *dev_path;
 	int retval;
 	int i = 0;
+	int dev_length;
 
 	pr_debug ("%s\n", __FUNCTION__);
 	if (!dev)
 		return -ENODEV;
 
-	if (!dev->bus || !dev->bus->hotplug)
+	if (!dev->bus)
 		return -ENODEV;
 
 	if (!hotplug_path [0])
@@ -66,6 +69,18 @@ int dev_hotplug (struct device *dev, const char *action)
 		return -ENOMEM;
 	}
 
+	dev_length = get_devpath_length (dev);
+	dev_length += strlen("root");
+	dev_path = kmalloc (dev_length, GFP_KERNEL);
+	if (!dev_path) {
+		kfree (buffer);
+		kfree (envp);
+		return -ENOMEM;
+	}
+	memset (dev_path, 0x00, dev_length);
+	strcpy (dev_path, "root");
+	fill_devpath (dev, dev_path, dev_length);
+
 	/* only one standardized param to hotplug command: the bus name */
 	argv [0] = hotplug_path;
 	argv [1] = dev->bus->name;
@@ -77,26 +92,33 @@ int dev_hotplug (struct device *dev, const char *action)
 
 	scratch = buffer;
 
-	/* action:  add, remove */
 	envp [i++] = scratch;
 	scratch += sprintf (scratch, "ACTION=%s", action) + 1;
 
-	/* have the bus specific function set up the rest of the environment */
-	retval = dev->bus->hotplug (dev, &envp[i], NUM_ENVP - i,
-				    scratch, BUFFER_SIZE - (scratch - buffer));
-	if (retval) {
-		pr_debug ("%s - hotplug() returned %d\n", __FUNCTION__, retval);
-		goto exit;
+	envp [i++] = scratch;
+	scratch += sprintf (scratch, "DEVICE=%s", dev_path) + 1;
+	
+	if (dev->bus->hotplug) {
+		/* have the bus specific function add its stuff */
+		retval = dev->bus->hotplug (dev, &envp[i], NUM_ENVP - i,
+					    scratch,
+					    BUFFER_SIZE - (scratch - buffer));
+		if (retval) {
+			pr_debug ("%s - hotplug() returned %d\n",
+				  __FUNCTION__, retval);
+			goto exit;
+		}
 	}
 
 	pr_debug ("%s: %s %s %s %s %s %s\n", __FUNCTION__, argv [0], argv[1],
-		  action, envp[0], envp[1], envp[2]);
+		  envp[0], envp[1], envp[2], envp[3]);
 	retval = call_usermodehelper (argv [0], argv, envp);
 	if (retval)
 		pr_debug ("%s - call_usermodehelper returned %d\n",
 			  __FUNCTION__, retval);
 
 exit:
+	kfree (dev_path);
 	kfree (buffer);
 	kfree (envp);
 	return retval;

drivers/usb/class/bluetty.c

@@ -1006,9 +1006,7 @@ static void bluetooth_write_bulk_callback (struct urb *urb)
 	}
 
 	/* wake up our little function to let the tty layer know that something happened */
-	queue_task(&bluetooth->tqueue, &tq_immediate);
-	mark_bh(IMMEDIATE_BH);
-	return;
+	schedule_task(&bluetooth->tqueue);
 }
 
 

drivers/usb/class/cdc-acm.c

@@ -272,8 +272,7 @@ static void acm_write_bulk(struct urb *urb)
 	if (urb->status)
 		dbg("nonzero write bulk status received: %d", urb->status);
 
-	queue_task(&acm->tqueue, &tq_immediate);
-	mark_bh(IMMEDIATE_BH);
+	schedule_task(&acm->tqueue);
 }
 
 static void acm_softint(void *private)

drivers/usb/core/Makefile

@@ -5,7 +5,7 @@
 export-objs	:= usb.o hcd.o hcd-pci.o urb.o message.o file.o buffer.o
 
 usbcore-objs	:= usb.o usb-debug.o hub.o hcd.o urb.o message.o \
-			config.o file.o buffer.o
+			config.o file.o buffer.o driverfs.o
 
 ifeq ($(CONFIG_PCI),y)
 	usbcore-objs	+= hcd-pci.o

drivers/usb/core/devio.c

@@ -1067,6 +1067,10 @@ static int proc_ioctl (struct dev_state *ps, void *arg)
        /* disconnect kernel driver from interface, leaving it unbound.  */
        case USBDEVFS_DISCONNECT:
 		/* this function is voodoo. */
+		/* which function ... usb_device_remove()?
+		 * FIXME either the module lock (BKL) should be involved
+		 * here too, or the 'default' case below is broken
+		 */
 		driver = ifp->driver;
 		if (driver) {
 			dbg ("disconnect '%s' from dev %d interface %d",
@@ -1081,26 +1085,28 @@ static int proc_ioctl (struct dev_state *ps, void *arg)
 		retval = usb_device_probe (&ifp->dev);
 		break;
 
-       /* talk directly to the interface's driver */
-       default:
-		lock_kernel(); /* against module unload */
-               driver = ifp->driver;
-               if (driver == 0 || driver->ioctl == 0) {
+	/* talk directly to the interface's driver */
+	default:
+		/* BKL used here to protect against changing the binding
+		 * of this driver to this device, as well as unloading its
+		 * driver module.
+		 */
+		lock_kernel ();
+		driver = ifp->driver;
+		if (driver == 0 || driver->ioctl == 0) {
 			unlock_kernel();
 			retval = -ENOSYS;
 		} else {
-			if (ifp->driver->owner) {
-				__MOD_INC_USE_COUNT(ifp->driver->owner);
-				unlock_kernel();
-			}
-			/* ifno might usefully be passed ... */
-                       retval = driver->ioctl (ps->dev, ctrl.ioctl_code, buf);
-			/* size = min_t(int, size, retval)? */
-			if (ifp->driver->owner) {
-				__MOD_DEC_USE_COUNT(ifp->driver->owner);
-			} else {
+			if (driver->owner
+					&& !try_inc_mod_count (driver->owner)) {
 				unlock_kernel();
+				retval = -ENOSYS;
+				break;
 			}
+			unlock_kernel ();
+			retval = driver->ioctl (ifp, ctrl.ioctl_code, buf);
+			if (driver->owner)
+				__MOD_DEC_USE_COUNT (driver->owner);
 		}
 		
 		if (retval == -ENOIOCTLCMD)

drivers/usb/core/driverfs.c

+/*
+ * drivers/usb/core/driverfs.c
+ *
+ * (C) Copyright 2002 David Brownell
+ * (C) Copyright 2002 Greg Kroah-Hartman
+ * (C) Copyright 2002 IBM Corp.
+ *
+ * All of the driverfs file attributes for usb devices and interfaces.
+ *
+ */
+
+
+#include <linux/config.h>
+#include <linux/kernel.h>
+
+#ifdef CONFIG_USB_DEBUG
+	#define DEBUG
+#else
+	#undef DEBUG
+#endif
+#include <linux/usb.h>
+
+#include "usb.h"
+
+/* Active configuration fields */
+#define usb_actconfig_attr(field, format_string)			\
+static ssize_t								\
+show_##field (struct device *dev, char *buf, size_t count, loff_t off)	\
+{									\
+	struct usb_device *udev;					\
+									\
+	if (off)							\
+		return 0;						\
+									\
+	udev = to_usb_device (dev);					\
+	return sprintf (buf, format_string, udev->actconfig->field);	\
+}									\
+static DEVICE_ATTR(field, S_IRUGO, show_##field, NULL);
+
+usb_actconfig_attr (bNumInterfaces, "%2d\n")
+usb_actconfig_attr (bConfigurationValue, "%2d\n")
+usb_actconfig_attr (bmAttributes, "%2x\n")
+usb_actconfig_attr (MaxPower, "%3dmA\n")
+
+/* String fields */
+static ssize_t show_product (struct device *dev, char *buf, size_t count, loff_t off)
+{
+	struct usb_device *udev;
+	int len;
+
+	if (off)
+		return 0;
+	udev = to_usb_device (dev);
+
+	len = usb_string(udev, udev->descriptor.iProduct, buf, PAGE_SIZE);
+	if (len < 0)
+		return 0;
+	buf[len] = '\n';
+	buf[len+1] = 0;
+	return len+1;
+}
+static DEVICE_ATTR(product,S_IRUGO,show_product,NULL);
+
+static ssize_t
+show_manufacturer (struct device *dev, char *buf, size_t count, loff_t off)
+{
+	struct usb_device *udev;
+	int len;
+
+	if (off)
+		return 0;
+	udev = to_usb_device (dev);
+
+	len = usb_string(udev, udev->descriptor.iManufacturer, buf, PAGE_SIZE);
+	if (len < 0)
+		return 0;
+	buf[len] = '\n';
+	buf[len+1] = 0;
+	return len+1;
+}
+static DEVICE_ATTR(manufacturer,S_IRUGO,show_manufacturer,NULL);
+
+static ssize_t
+show_serial (struct device *dev, char *buf, size_t count, loff_t off)
+{
+	struct usb_device *udev;
+	int len;
+
+	if (off)
+		return 0;
+	udev = to_usb_device (dev);
+
+	len = usb_string(udev, udev->descriptor.iSerialNumber, buf, PAGE_SIZE);
+	if (len < 0)
+		return 0;
+	buf[len] = '\n';
+	buf[len+1] = 0;
+	return len+1;
+}
+static DEVICE_ATTR(serial,S_IRUGO,show_serial,NULL);
+
+/* Descriptor fields */
+#define usb_descriptor_attr(field, format_string)			\
+static ssize_t								\
+show_##field (struct device *dev, char *buf, size_t count, loff_t off)	\
+{									\
+	struct usb_device *udev;					\
+									\
+	if (off)							\
+		return 0;						\
+									\
+	udev = to_usb_device (dev);					\
+	return sprintf (buf, format_string, udev->descriptor.field);	\
+}									\
+static DEVICE_ATTR(field, S_IRUGO, show_##field, NULL);
+
+usb_descriptor_attr (idVendor, "%04x\n")
+usb_descriptor_attr (idProduct, "%04x\n")
+usb_descriptor_attr (bcdDevice, "%04x\n")
+usb_descriptor_attr (bDeviceClass, "%02x\n")
+usb_descriptor_attr (bDeviceSubClass, "%02x\n")
+usb_descriptor_attr (bDeviceProtocol, "%02x\n")
+
+
+void usb_create_driverfs_dev_files (struct usb_device *udev)
+{
+	struct device *dev = &udev->dev;
+
+	device_create_file (dev, &dev_attr_bNumInterfaces);
+	device_create_file (dev, &dev_attr_bConfigurationValue);
+	device_create_file (dev, &dev_attr_bmAttributes);
+	device_create_file (dev, &dev_attr_MaxPower);
+	device_create_file (dev, &dev_attr_idVendor);
+	device_create_file (dev, &dev_attr_idProduct);
+	device_create_file (dev, &dev_attr_bcdDevice);
+	device_create_file (dev, &dev_attr_bDeviceClass);
+	device_create_file (dev, &dev_attr_bDeviceSubClass);
+	device_create_file (dev, &dev_attr_bDeviceProtocol);
+
+	if (udev->descriptor.iManufacturer)
+		device_create_file (dev, &dev_attr_manufacturer);
+	if (udev->descriptor.iProduct)
+		device_create_file (dev, &dev_attr_product);
+	if (udev->descriptor.iSerialNumber)
+		device_create_file (dev, &dev_attr_serial);
+}
+
+/* Interface fields */
+#define usb_intf_attr(field, format_string)				\
+static ssize_t								\
+show_##field (struct device *dev, char *buf, size_t count, loff_t off)	\
+{									\
+	struct usb_interface *intf;					\
+	int alt;							\
+									\
+	if (off)							\
+		return 0;						\
+									\
+	intf = to_usb_interface (dev);					\
+	alt = intf->act_altsetting;					\
+									\
+	return sprintf (buf, format_string, intf->altsetting[alt].field);	\
+}									\
+static DEVICE_ATTR(field, S_IRUGO, show_##field, NULL);
+
+usb_intf_attr (bAlternateSetting, "%2d\n")
+usb_intf_attr (bInterfaceClass, "%02x\n")
+usb_intf_attr (bInterfaceSubClass, "%02x\n")
+usb_intf_attr (bInterfaceProtocol, "%02x\n")
+
+void usb_create_driverfs_intf_files (struct usb_interface *intf)
+{
+	device_create_file (&intf->dev, &dev_attr_bAlternateSetting);
+	device_create_file (&intf->dev, &dev_attr_bInterfaceClass);
+	device_create_file (&intf->dev, &dev_attr_bInterfaceSubClass);
+	device_create_file (&intf->dev, &dev_attr_bInterfaceProtocol);
+}

drivers/usb/core/hcd.c

@@ -1024,6 +1024,11 @@ static int hcd_submit_urb (struct urb *urb, int mem_flags)
 	 */
 	urb = usb_get_urb (urb);
 	if (urb->dev == hcd->self.root_hub) {
+		/* NOTE:  requirement on hub callers (usbfs and the hub
+		 * driver, for now) that URBs' urb->transfer_buffer be
+		 * valid and usb_buffer_{sync,unmap}() not be needed, since
+		 * they could clobber root hub response data.
+		 */
 		urb->transfer_flags |= URB_NO_DMA_MAP;
 		return rh_urb_enqueue (hcd, urb);
 	}
@@ -1132,11 +1137,11 @@ static int hcd_unlink_urb (struct urb *urb)
 		goto done;
 	}
 
-	/* For non-periodic transfers, any status except -EINPROGRESS means
-	 * the HCD has already started to unlink this URB from the hardware.
-	 * In that case, there's no more work to do.
+	/* Except for interrupt transfers, any status except -EINPROGRESS
+	 * means the HCD already started to unlink this URB from the hardware.
+	 * So there's no more work to do.
 	 *
-	 * For periodic transfers, this is the only way to trigger unlinking
+	 * For interrupt transfers, this is the only way to trigger unlinking
 	 * from the hardware.  Since we (currently) overload urb->status to
 	 * tell the driver to unlink, error status might get clobbered ...
 	 * unless that transfer hasn't yet restarted.  One such case is when
@@ -1144,13 +1149,10 @@ static int hcd_unlink_urb (struct urb *urb)
 	 *
 	 * FIXME use an URB_UNLINKED flag to match URB_TIMEOUT_KILLED
 	 */
-	switch (usb_pipetype (urb->pipe)) {
-	case PIPE_CONTROL:
-	case PIPE_BULK:
-		if (urb->status != -EINPROGRESS) {
-			retval = -EINVAL;
-			goto done;
-		}
+	if (urb->status != -EINPROGRESS
+			&& usb_pipetype (urb->pipe) != PIPE_INTERRUPT) {
+		retval = -EINVAL;
+		goto done;
 	}
 
 	/* maybe set up to block on completion notification */

drivers/usb/core/hub.c

@@ -537,7 +537,7 @@ static int hub_probe(struct usb_interface *intf, const struct usb_device_id *id)
 	dev_set_drvdata (&intf->dev, hub);
 
 	if (usb_hub_configure(hub, endpoint) >= 0) {
-		strcpy (intf->dev.name, "Hub/Port Status Changes");
+		strcpy (intf->dev.name, "Hub");
 		return 0;
 	}
 
@@ -547,8 +547,11 @@ static int hub_probe(struct usb_interface *intf, const struct usb_device_id *id)
 	return -ENODEV;
 }
 
-static int hub_ioctl(struct usb_device *hub, unsigned int code, void *user_data)
+static int
+hub_ioctl(struct usb_interface *intf, unsigned int code, void *user_data)
 {
+	struct usb_device *hub = interface_to_usbdev (intf);
+
 	/* assert ifno == 0 (part of hub spec) */
 	switch (code) {
 	case USBDEVFS_HUB_PORTINFO: {

drivers/usb/core/message.c

@@ -2,6 +2,7 @@
  * message.c - synchronous message handling
  */
 
+#include <linux/pci.h>	/* for scatterlist macros */
 #include <linux/usb.h>
 #include <linux/module.h>
 #include <linux/slab.h>
@@ -123,6 +124,9 @@ int usb_internal_control_msg(struct usb_device *usb_dev, unsigned int pipe,
  *	Don't use this function from within an interrupt context, like a
  *	bottom half handler.  If you need an asynchronous message, or need to send
  *	a message from within interrupt context, use usb_submit_urb()
+ *      If a thread in your driver uses this call, make sure your disconnect()
+ *      method can wait for it to complete.  Since you don't have a handle on
+ *      the URB used, you can't cancel the request.
  */
 int usb_control_msg(struct usb_device *dev, unsigned int pipe, __u8 request, __u8 requesttype,
 			 __u16 value, __u16 index, void *data, __u16 size, int timeout)
@@ -170,6 +174,9 @@ int usb_control_msg(struct usb_device *dev, unsigned int pipe, __u8 request, __u
  *	Don't use this function from within an interrupt context, like a
  *	bottom half handler.  If you need an asynchronous message, or need to
  *	send a message from within interrupt context, use usb_submit_urb()
+ *      If a thread in your driver uses this call, make sure your disconnect()
+ *      method can wait for it to complete.  Since you don't have a handle on
+ *      the URB used, you can't cancel the request.
  */
 int usb_bulk_msg(struct usb_device *usb_dev, unsigned int pipe, 
 			void *data, int len, int *actual_length, int timeout)
@@ -189,6 +196,321 @@ int usb_bulk_msg(struct usb_device *usb_dev, unsigned int pipe,
 	return usb_start_wait_urb(urb,timeout,actual_length);
 }
 
+/*-------------------------------------------------------------------*/
+
+static void sg_clean (struct usb_sg_request *io)
+{
+	if (io->urbs) {
+		while (io->entries--)
+			usb_free_urb (io->urbs [io->entries]);
+		kfree (io->urbs);
+		io->urbs = 0;
+	}
+	usb_buffer_unmap_sg (io->dev, io->pipe, io->sg, io->nents);
+	io->dev = 0;
+}
+
+static void sg_complete (struct urb *urb)
+{
+	struct usb_sg_request	*io = (struct usb_sg_request *) urb->context;
+	unsigned long		flags;
+
+	spin_lock_irqsave (&io->lock, flags);
+
+	/* In 2.5 we require hcds' endpoint queues not to progress after fault
+	 * reports, until the competion callback (this!) returns.  That lets
+	 * device driver code (like this routine) unlink queued urbs first,
+	 * if it needs to, since the HC won't work on them at all.  So it's
+	 * not possible for page N+1 to overwrite page N, and so on.
+	 */
+	if (io->status && urb->actual_length) {
+		err ("driver for bus %s dev %s ep %d-%s corrupted data!",
+			io->dev->bus->bus_name, io->dev->devpath,
+			usb_pipeendpoint (urb->pipe),
+			usb_pipein (urb->pipe) ? "in" : "out");
+		// BUG ();
+	}
+
+	if (urb->status && urb->status != -ECONNRESET) {
+		int		i, found, status;
+
+		io->status = urb->status;
+
+		/* the previous urbs, and this one, completed already.
+		 * unlink the later ones so they won't rx/tx bad data,
+		 *
+		 * FIXME don't bother unlinking urbs that haven't yet been
+		 * submitted; those non-error cases shouldn't be syslogged
+		 */
+		for (i = 0, found = 0; i < io->entries; i++) {
+			if (found) {
+				status = usb_unlink_urb (io->urbs [i]);
+				if (status && status != -EINPROGRESS)
+					err ("sg_complete, unlink --> %d",
+							status);
+			} else if (urb == io->urbs [i])
+				found = 1;
+		}
+	}
+
+	/* on the last completion, signal usb_sg_wait() */
+	io->bytes += urb->actual_length;
+	io->count--;
+	if (!io->count)
+		complete (&io->complete);
+
+	spin_unlock_irqrestore (&io->lock, flags);
+}
+
+
+/**
+ * usb_sg_init - initializes scatterlist-based bulk/interrupt I/O request
+ * @io: request block being initialized.  until usb_sg_wait() returns,
+ *	treat this as a pointer to an opaque block of memory,
+ * @dev: the usb device that will send or receive the data
+ * @pipe: endpoint "pipe" used to transfer the data
+ * @period: polling rate for interrupt endpoints, in frames or
+ * 	(for high speed endpoints) microframes; ignored for bulk
+ * @sg: scatterlist entries
+ * @nents: how many entries in the scatterlist
+ * @length: how many bytes to send from the scatterlist, or zero to
+ * 	send every byte identified in the list.
+ * @mem_flags: SLAB_* flags affecting memory allocations in this call
+ *
+ * Returns zero for success, else a negative errno value.  This initializes a
+ * scatter/gather request, allocating resources such as I/O mappings and urb
+ * memory (except maybe memory used by USB controller drivers).
+ *
+ * The request must be issued using usb_sg_wait(), which waits for the I/O to
+ * complete (or to be canceled) and then cleans up all resources allocated by
+ * usb_sg_init().
+ *
+ * The request may be canceled with usb_sg_cancel(), either before or after
+ * usb_sg_wait() is called.
+ *
+ * NOTE:
+ *
+ * At this writing, don't use the interrupt transfer mode, since the old old
+ * "automagic resubmit" mode hasn't yet been removed.  It should be removed
+ * by the time 2.5 finalizes.
+ */
+int usb_sg_init (
+	struct usb_sg_request	*io,
+	struct usb_device	*dev,
+	unsigned		pipe, 
+	unsigned		period,
+	struct scatterlist	*sg,
+	int			nents,
+	size_t			length,
+	int			mem_flags
+)
+{
+	int			i;
+	int			urb_flags;
+
+	if (!io || !dev || !sg
+			|| usb_pipecontrol (pipe)
+			|| usb_pipeisoc (pipe)
+			|| nents <= 0)
+		return -EINVAL;
+
+	spin_lock_init (&io->lock);
+	io->dev = dev;
+	io->pipe = pipe;
+	io->sg = sg;
+	io->nents = nents;
+
+	/* initialize all the urbs we'll use */
+	io->entries = usb_buffer_map_sg (dev, pipe, sg, nents);
+	if (io->entries <= 0)
+		return io->entries;
+
+	io->count = 0;
+	io->urbs = kmalloc (io->entries * sizeof *io->urbs, mem_flags);
+	if (!io->urbs)
+		goto nomem;
+
+	urb_flags = USB_ASYNC_UNLINK | URB_NO_DMA_MAP | URB_NO_INTERRUPT;
+	if (usb_pipein (pipe))
+		urb_flags |= URB_SHORT_NOT_OK;
+
+	for (i = 0; i < io->entries; i++, io->count = i) {
+		unsigned		len;
+
+		io->urbs [i] = usb_alloc_urb (0, mem_flags);
+		if (!io->urbs [i]) {
+			io->entries = i;
+			goto nomem;
+		}
+
+		io->urbs [i]->dev = dev;
+		io->urbs [i]->pipe = pipe;
+		io->urbs [i]->interval = period;
+		io->urbs [i]->transfer_flags = urb_flags;
+
+		io->urbs [i]->complete = sg_complete;
+		io->urbs [i]->context = io;
+		io->urbs [i]->status = -EINPROGRESS;
+		io->urbs [i]->actual_length = 0;
+
+		io->urbs [i]->transfer_dma = sg_dma_address (sg + i);
+		len = sg_dma_len (sg + i);
+		if (length) {
+			len = min_t (unsigned, len, length);
+			length -= len;
+			if (length == 0)
+				io->entries = i + 1;
+		}
+		io->urbs [i]->transfer_buffer_length = len;
+	}
+	io->urbs [--i]->transfer_flags &= ~URB_NO_INTERRUPT;
+
+	/* transaction state */
+	io->status = 0;
+	io->bytes = 0;
+	init_completion (&io->complete);
+	return 0;
+
+nomem:
+	sg_clean (io);
+	return -ENOMEM;
+}
+
+
+/**
+ * usb_sg_wait - synchronously execute scatter/gather request
+ * @io: request block handle, as initialized with usb_sg_init().
+ * 	some fields become accessible when this call returns.
+ * Context: !in_interrupt ()
+ *
+ * This function blocks until the specified I/O operation completes.  It
+ * leverages the grouping of the related I/O requests to get good transfer
+ * rates, by queueing the requests.  At higher speeds, such queuing can
+ * significantly improve USB throughput.
+ *
+ * There are three kinds of completion for this function.
+ * (1) success, where io->status is zero.  The number of io->bytes
+ *     transferred is as requested.
+ * (2) error, where io->status is a negative errno value.  The number
+ *     of io->bytes transferred before the error is usually less
+ *     than requested, and can be nonzero.
+ * (3) cancelation, a type of error with status -ECONNRESET that
+ *     is initiated by usb_sg_cancel().
+ *
+ * When this function returns, all memory allocated through usb_sg_init() or
+ * this call will have been freed.  The request block parameter may still be
+ * passed to usb_sg_cancel(), or it may be freed.  It could also be
+ * reinitialized and then reused.
+ *
+ * Data Transfer Rates:
+ *
+ * Bulk transfers are valid for full or high speed endpoints.
+ * The best full speed data rate is 19 packets of 64 bytes each
+ * per frame, or 1216 bytes per millisecond.
+ * The best high speed data rate is 13 packets of 512 bytes each
+ * per microframe, or 52 KBytes per millisecond.
+ *
+ * The reason to use interrupt transfers through this API would most likely
+ * be to reserve high speed bandwidth, where up to 24 KBytes per millisecond
+ * could be transferred.  That capability is less useful for low or full
+ * speed interrupt endpoints, which allow at most one packet per millisecond,
+ * of at most 8 or 64 bytes (respectively).
+ */
+void usb_sg_wait (struct usb_sg_request *io)
+{
+	int		i;
+	unsigned long	flags;
+
+	/* queue the urbs.  */
+	spin_lock_irqsave (&io->lock, flags);
+	for (i = 0; i < io->entries && !io->status; i++) {
+		int	retval;
+
+		retval = usb_submit_urb (io->urbs [i], SLAB_ATOMIC);
+
+		/* after we submit, let completions or cancelations fire;
+		 * we handshake using io->status.
+		 */
+		spin_unlock_irqrestore (&io->lock, flags);
+		switch (retval) {
+			/* maybe we retrying will recover */
+		case -ENXIO:	// hc didn't queue this one
+		case -EAGAIN:
+		case -ENOMEM:
+			retval = 0;
+			i--;
+			// FIXME:  should it usb_sg_cancel() on INTERRUPT?
+			// how about imposing a backoff?
+			set_current_state (TASK_UNINTERRUPTIBLE);
+			schedule ();
+			break;
+
+			/* no error? continue immediately.
+			 *
+			 * NOTE: to work better with UHCI (4K I/O buffer may
+			 * need 3K of TDs) it may be good to limit how many
+			 * URBs are queued at once; N milliseconds?
+			 */
+		case 0:
+			cpu_relax ();
+			break;
+
+			/* fail any uncompleted urbs */
+		default:
+			io->urbs [i]->status = retval;
+			dbg ("usb_sg_msg, submit --> %d", retval);
+			usb_sg_cancel (io);
+		}
+		spin_lock_irqsave (&io->lock, flags);
+		if (retval && io->status == -ECONNRESET)
+			io->status = retval;
+	}
+	spin_unlock_irqrestore (&io->lock, flags);
+
+	/* OK, yes, this could be packaged as non-blocking.
+	 * So could the submit loop above ... but it's easier to
+	 * solve neither problem than to solve both!
+	 */
+	wait_for_completion (&io->complete);
+
+	sg_clean (io);
+}
+
+/**
+ * usb_sg_cancel - stop scatter/gather i/o issued by usb_sg_wait()
+ * @io: request block, initialized with usb_sg_init()
+ *
+ * This stops a request after it has been started by usb_sg_wait().
+ * It can also prevents one initialized by usb_sg_init() from starting,
+ * so that call just frees resources allocated to the request.
+ */
+void usb_sg_cancel (struct usb_sg_request *io)
+{
+	unsigned long	flags;
+
+	spin_lock_irqsave (&io->lock, flags);
+
+	/* shut everything down, if it didn't already */
+	if (!io->status) {
+		int	i;
+
+		io->status = -ECONNRESET;
+		for (i = 0; i < io->entries; i++) {
+			int	retval;
+
+			if (!io->urbs [i]->dev)
+				continue;
+			retval = usb_unlink_urb (io->urbs [i]);
+			if (retval && retval != -EINPROGRESS)
+				warn ("usb_sg_cancel, unlink --> %d", retval);
+			// FIXME don't warn on "not yet submitted" error
+		}
+	}
+	spin_unlock_irqrestore (&io->lock, flags);
+}
+
+/*-------------------------------------------------------------------*/
+
 /**
  * usb_get_descriptor - issues a generic GET_DESCRIPTOR request
  * @dev: the device whose descriptor is being retrieved
@@ -659,6 +981,11 @@ int usb_string(struct usb_device *dev, int index, char *buf, size_t size)
 // synchronous request completion model
 EXPORT_SYMBOL(usb_control_msg);
 EXPORT_SYMBOL(usb_bulk_msg);
+
+EXPORT_SYMBOL(usb_sg_init);
+EXPORT_SYMBOL(usb_sg_cancel);
+EXPORT_SYMBOL(usb_sg_wait);
+
 // synchronous control message convenience routines
 EXPORT_SYMBOL(usb_get_descriptor);
 EXPORT_SYMBOL(usb_get_device_descriptor);

drivers/usb/core/urb.c

@@ -232,22 +232,19 @@ int usb_submit_urb(struct urb *urb, int mem_flags)
 		return -EMSGSIZE;
 	}
 
-	/* "high bandwidth" mode, 1-3 packets/uframe? */
-	if (dev->speed == USB_SPEED_HIGH) {
-		int	mult;
-		switch (temp) {
-		case PIPE_ISOCHRONOUS:
-		case PIPE_INTERRUPT:
-			mult = 1 + ((max >> 11) & 0x03);
+	/* periodic transfers limit size per frame/uframe,
+	 * but drivers only control those sizes for ISO.
+	 * while we're checking, initialize return status.
+	 */
+	if (temp == PIPE_ISOCHRONOUS) {
+		int	n, len;
+
+		/* "high bandwidth" mode, 1-3 packets/uframe? */
+		if (dev->speed == USB_SPEED_HIGH) {
+			int	mult = 1 + ((max >> 11) & 0x03);
 			max &= 0x03ff;
 			max *= mult;
 		}
-	}
-
-	/* periodic transfers limit size per frame/uframe */
-	switch (temp) {
-	case PIPE_ISOCHRONOUS: {
-		int	n, len;
 
 		if (urb->number_of_packets <= 0)		    
 			return -EINVAL;
@@ -255,13 +252,9 @@ int usb_submit_urb(struct urb *urb, int mem_flags)
 			len = urb->iso_frame_desc [n].length;
 			if (len < 0 || len > max) 
 				return -EMSGSIZE;
+			urb->iso_frame_desc [n].status = -EXDEV;
+			urb->iso_frame_desc [n].actual_length = 0;
 		}
-
-		}
-		break;
-	case PIPE_INTERRUPT:
-		if (urb->transfer_buffer_length > max)
-			return -EMSGSIZE;
 	}
 
 	/* the I/O buffer must be mapped/unmapped, except when length=0 */

drivers/usb/core/usb.c

@@ -42,6 +42,7 @@
 #include <linux/usb.h>
 
 #include "hcd.h"
+#include "usb.h"
 
 extern int  usb_hub_init(void);
 extern void usb_hub_cleanup(void);
@@ -123,6 +124,8 @@ int usb_device_remove(struct device *dev)
 	if (driver->owner) {
 		m = try_inc_mod_count(driver->owner);
 		if (m == 0) {
+			// FIXME this happens even when we just rmmod
+			// drivers that aren't in active use... 
 			err("Dieing driver still bound to device.\n");
 			return -EIO;
 		}
@@ -524,9 +527,8 @@ static int usb_hotplug (struct device *dev, char **envp, int num_envp,
 	if (!dev)
 		return -ENODEV;
 
-	/* check for generic driver, we do not call do hotplug calls for it */
 	if (dev->driver == &usb_generic_driver)
-		return -ENODEV;
+		return 0;
 
 	intf = to_usb_interface(dev);
 	if (!intf)
@@ -629,98 +631,6 @@ static int usb_hotplug (struct device *dev, char **envp,
 
 #endif	/* CONFIG_HOTPLUG */
 
-/* driverfs files */
-
-/* devices have one current configuration, with one
- * or more interfaces that are used concurrently 
- */
-static ssize_t
-show_config (struct device *dev, char *buf, size_t count, loff_t off)
-{
-	struct usb_device	*udev;
-
-	if (off)
-		return 0;
-	udev = to_usb_device (dev);
-	return sprintf (buf, "%u\n", udev->actconfig->bConfigurationValue);
-}
-
-static DEVICE_ATTR(configuration,S_IRUGO,show_config,NULL);
-
-/* interfaces have one current setting; alternates
- * can have different endpoints and class info.
- */
-static ssize_t
-show_altsetting (struct device *dev, char *buf, size_t count, loff_t off)
-{
-	struct usb_interface	*interface;
-
-	if (off)
-		return 0;
-	interface = to_usb_interface (dev);
-	return sprintf (buf, "%u\n", interface->altsetting->bAlternateSetting);
-}
-static DEVICE_ATTR(altsetting,S_IRUGO,show_altsetting,NULL);
-
-/* product driverfs file */
-static ssize_t show_product (struct device *dev, char *buf, size_t count, loff_t off)
-{
-	struct usb_device *udev;
-	int len;
-
-	if (off)
-		return 0;
-	udev = to_usb_device (dev);
-
-	len = usb_string(udev, udev->descriptor.iProduct, buf, PAGE_SIZE);
-	if (len < 0)
-		return 0;
-	buf[len] = '\n';
-	buf[len+1] = 0;
-	return len+1;
-}
-static DEVICE_ATTR(product,S_IRUGO,show_product,NULL);
-
-/* manufacturer driverfs file */
-static ssize_t
-show_manufacturer (struct device *dev, char *buf, size_t count, loff_t off)
-{
-	struct usb_device *udev;
-	int len;
-
-	if (off)
-		return 0;
-	udev = to_usb_device (dev);
-
-	len = usb_string(udev, udev->descriptor.iManufacturer, buf, PAGE_SIZE);
-	if (len < 0)
-		return 0;
-	buf[len] = '\n';
-	buf[len+1] = 0;
-	return len+1;
-}
-static DEVICE_ATTR(manufacturer,S_IRUGO,show_manufacturer,NULL);
-
-/* serial number driverfs file */
-static ssize_t
-show_serial (struct device *dev, char *buf, size_t count, loff_t off)
-{
-	struct usb_device *udev;
-	int len;
-
-	if (off)
-		return 0;
-	udev = to_usb_device (dev);
-
-	len = usb_string(udev, udev->descriptor.iSerialNumber, buf, PAGE_SIZE);
-	if (len < 0)
-		return 0;
-	buf[len] = '\n';
-	buf[len+1] = 0;
-	return len+1;
-}
-static DEVICE_ATTR(serial,S_IRUGO,show_serial,NULL);
-
 /**
  * usb_alloc_dev - allocate a usb device structure (usbcore-internal)
  * @parent: hub to which device is connected
@@ -1133,13 +1043,7 @@ int usb_new_device(struct usb_device *dev, struct device *parent)
 		return err;
 
 	/* add the USB device specific driverfs files */
-	device_create_file (&dev->dev, &dev_attr_configuration);
-	if (dev->descriptor.iManufacturer)
-		device_create_file (&dev->dev, &dev_attr_manufacturer);
-	if (dev->descriptor.iProduct)
-		device_create_file (&dev->dev, &dev_attr_product);
-	if (dev->descriptor.iSerialNumber)
-		device_create_file (&dev->dev, &dev_attr_serial);
+	usb_create_driverfs_dev_files (dev);
 
 	/* Register all of the interfaces for this device with the driver core.
 	 * Remember, interfaces get bound to drivers, not devices. */
@@ -1169,7 +1073,7 @@ int usb_new_device(struct usb_device *dev, struct device *parent)
 		}
 		dbg ("%s - registering %s", __FUNCTION__, interface->dev.bus_id);
 		device_register (&interface->dev);
-		device_create_file (&interface->dev, &dev_attr_altsetting);
+		usb_create_driverfs_intf_files (interface);
 	}
 
 	/* add a /proc/bus/usb entry */
@@ -1194,6 +1098,8 @@ int usb_new_device(struct usb_device *dev, struct device *parent)
  * avoid behaviors like using "DMA bounce buffers", or tying down I/O mapping
  * hardware for long idle periods.  The implementation varies between
  * platforms, depending on details of how DMA will work to this device.
+ * Using these buffers also helps prevent cacheline sharing problems on
+ * architectures where CPU caches are not DMA-coherent.
  *
  * When the buffer is no longer used, free it with usb_buffer_free().
  */

drivers/usb/core/usb.h

+/* Functions local to drivers/usb/core/ */
+
+extern void usb_create_driverfs_dev_files (struct usb_device *dev);
+extern void usb_create_driverfs_intf_files (struct usb_interface *intf);
+

drivers/usb/host/ehci-hcd.c

@@ -749,7 +749,7 @@ static int ehci_urb_dequeue (struct usb_hcd *hcd, struct urb *urb)
 	default:
 		spin_lock_irqsave (&ehci->lock, flags);
 		if (ehci->reclaim) {
-			dbg ("dq %p: reclaim = %p, %s",
+			vdbg ("dq %p: reclaim = %p, %s",
 				qh, ehci->reclaim, RUN_CONTEXT);
 			if (qh == ehci->reclaim) {
 				/* unlinking qh for another queued urb? */

drivers/usb/host/ehci-q.c

@@ -255,23 +255,23 @@ qh_completions (struct ehci_hcd *ehci, struct ehci_qh *qh)
 		struct urb	*urb = qtd->urb;
 		u32		token = 0;
 
+		/* hc's on-chip qh overlay cache can overwrite our idea of
+		 * next qtd ptrs, if we appended a qtd while the queue was
+		 * advancing.  (because we don't use dummy qtds.)
+		 */
+		if (cpu_to_le32 (qtd->qtd_dma) == qh->hw_current
+				&& qtd->hw_next != qh->hw_qtd_next) {
+			qh->hw_alt_next = qtd->hw_alt_next;
+			qh->hw_qtd_next = qtd->hw_next;
+			COUNT (ehci->stats.qpatch);
+		}
+
 		/* clean up any state from previous QTD ...*/
 		if (last) {
 			if (likely (last->urb != urb)) {
 				ehci_urb_done (ehci, last->urb);
 				count++;
 			}
-
-			/* qh overlays can have HC's old cached copies of
-			 * next qtd ptrs, if an URB was queued afterwards.
-			 */
-			if (cpu_to_le32 (last->qtd_dma) == qh->hw_current
-					&& last->hw_next != qh->hw_qtd_next) {
-				qh->hw_alt_next = last->hw_alt_next;
-				qh->hw_qtd_next = last->hw_next;
-				COUNT (ehci->stats.qpatch);
-			}
-
 			ehci_qtd_free (ehci, last);
 			last = 0;
 		}
@@ -529,7 +529,8 @@ qh_urb_transaction (
 	}
 
 	/* by default, enable interrupt on urb completion */
-	if (likely (!(urb->transfer_flags & URB_NO_INTERRUPT)))
+// ... do it always, unless we switch over to dummy qtds
+//	if (likely (!(urb->transfer_flags & URB_NO_INTERRUPT)))
 		qtd->hw_token |= __constant_cpu_to_le32 (QTD_IOC);
 	return head;
 
@@ -785,7 +786,6 @@ static struct ehci_qh *qh_append_tds (
 		/* append to tds already queued to this qh? */
 		if (unlikely (!list_empty (&qh->qtd_list) && qtd)) {
 			struct ehci_qtd		*last_qtd;
-			int			short_rx = 0;
 			u32			hw_next;
 
 			/* update the last qtd's "next" pointer */
@@ -800,23 +800,16 @@ static struct ehci_qh *qh_append_tds (
 					&& (epnum & 0x10)) {
 				// only the last QTD for now
 				last_qtd->hw_alt_next = hw_next;
-				short_rx = 1;
 			}
 
-			/* Adjust any old copies in qh overlay too.
-			 * Interrupt code must cope with case of HC having it
-			 * cached, and clobbering these updates.
-			 * ... complicates getting rid of extra interrupts!
-			 * (Or:  use dummy td, so cache always stays valid.)
+			/* qh_completions() may need to patch the qh overlay if
+			 * the hc was advancing this queue while we appended.
+			 * we know it can: last_qtd->hw_token has IOC set.
+			 *
+			 * or:  use a dummy td (so the overlay gets the next td
+			 * only when we set its active bit); fewer irqs.
 			 */
-			if (qh->hw_current == cpu_to_le32 (last_qtd->qtd_dma)) {
-				wmb ();
-				qh->hw_qtd_next = hw_next;
-				if (short_rx)
-					qh->hw_alt_next = hw_next
-				    		| (qh->hw_alt_next & 0x1e);
-				vdbg ("queue to qh %p, patch", qh);
-			}
+			wmb ();
 
 		/* no URB queued */
 		} else {

drivers/usb/host/hc_sl811.c

@@ -28,7 +28,7 @@
 #include <linux/kernel.h>
 #include <linux/delay.h>
 #include <linux/sched.h>
-#include <linux/malloc.h>
+#include <linux/slab.h>
 #include <linux/errno.h>
 #include <linux/init.h>
 #include <linux/smp_lock.h>
@@ -1158,6 +1158,7 @@ static hci_t *__devinit hc_alloc_hci (void)
 	bus = usb_alloc_bus (&hci_device_operations);
 	if (!bus) {
 		kfree (hci);
+		kfree (ps);
 		return NULL;
 	}
 

drivers/usb/host/ohci-hcd.c

@@ -193,12 +193,6 @@ static int ohci_urb_enqueue (
 			break;
 		case PIPE_ISOCHRONOUS: /* number of packets from URB */
 			size = urb->number_of_packets;
-			if (size <= 0)
-				return -EINVAL;
-			for (i = 0; i < urb->number_of_packets; i++) {
-  				urb->iso_frame_desc [i].actual_length = 0;
-  				urb->iso_frame_desc [i].status = -EXDEV;
-  			}
 			break;
 	}
 

drivers/usb/host/ohci-mem.c

@@ -48,10 +48,10 @@ dma_to_ed_td (struct hash_list_t * entry, dma_addr_t dma)
 	struct hash_t * scan = entry->head;
 	while (scan && scan->dma != dma)
 		scan = scan->next;
-	return scan->virt;
+	return scan ? scan->virt : 0;
 }
 
-static struct td *
+static inline struct td *
 dma_to_td (struct ohci_hcd *hc, dma_addr_t td_dma)
 {
 	td_dma &= TD_MASK;
@@ -62,7 +62,7 @@ dma_to_td (struct ohci_hcd *hc, dma_addr_t td_dma)
 // FIXME:  when updating the hashtables this way, mem_flags is unusable...
 
 /* Add a hash entry for a TD/ED; return true on success */
-static int
+static inline int
 hash_add_ed_td (
 	struct hash_list_t *entry,
 	void *virt,
@@ -97,7 +97,7 @@ hash_add_td (struct ohci_hcd *hc, struct td *td, int mem_flags)
 }
 
 
-static void
+static inline void
 hash_free_ed_td (struct hash_list_t *entry, void *virt)
 {
 	struct hash_t *scan, *prev;

drivers/usb/host/ohci-q.c

@@ -854,6 +854,11 @@ static struct td *dl_reverse_done_list (struct ohci_hcd *ohci)
 	    	int		cc;
 
 		td = dma_to_td (ohci, td_dma);
+		if (!td) {
+			err ("%s bad entry %8x",
+				ohci->hcd.self.bus_name, td_dma);
+			break;
+		}
 
 		td->hwINFO |= cpu_to_le32 (TD_DONE);
 		cc = TD_CC_GET (le32_to_cpup (&td->hwINFO));

drivers/usb/serial/cyberjack.c

@@ -437,9 +437,7 @@ static void cyberjack_write_bulk_callback (struct urb *urb)
 			/* Throw away data. No better idea what to do with it. */
 			priv->wrfilled=0;
 			priv->wrsent=0;
-			queue_task(&port->tqueue, &tq_immediate);
-			mark_bh(IMMEDIATE_BH);
-			return;
+			goto exit;
 		}
 
 		dbg("%s - priv->wrsent=%d", __FUNCTION__,priv->wrsent);
@@ -453,16 +451,10 @@ static void cyberjack_write_bulk_callback (struct urb *urb)
 			priv->wrfilled=0;
 			priv->wrsent=0;
 		}
-
-		queue_task(&port->tqueue, &tq_immediate);
-		mark_bh(IMMEDIATE_BH);
-		return;
 	}
 
-	queue_task(&port->tqueue, &tq_immediate);
-	mark_bh(IMMEDIATE_BH);
-	
-	return;
+exit:
+	schedule_task(&port->tqueue);
 }
 
 static int __init cyberjack_init (void)

drivers/usb/serial/empeg.c

@@ -362,11 +362,7 @@ static void empeg_write_bulk_callback (struct urb *urb)
 		return;
 	}
 
-	queue_task(&port->tqueue, &tq_immediate);
-	mark_bh(IMMEDIATE_BH);
-
-	return;
-
+	schedule_task(&port->tqueue);
 }
 
 

drivers/usb/serial/ftdi_sio.c

@@ -484,10 +484,8 @@ static void ftdi_sio_write_bulk_callback (struct urb *urb)
 		dbg("nonzero write bulk status received: %d", urb->status);
 		return;
 	}
-	queue_task(&port->tqueue, &tq_immediate);
-	mark_bh(IMMEDIATE_BH);
 
-	return;
+	schedule_task(&port->tqueue);
 } /* ftdi_sio_write_bulk_callback */
 
 

drivers/usb/serial/ipaq.c

@@ -465,10 +465,8 @@ static void ipaq_write_bulk_callback(struct urb *urb)
 		priv->active = 0;
 		spin_unlock_irqrestore(&write_list_lock, flags);
 	}
-	queue_task(&port->tqueue, &tq_immediate);
-	mark_bh(IMMEDIATE_BH);
-	
-	return;
+
+	schedule_task(&port->tqueue);
 }
 
 static int ipaq_write_room(struct usb_serial_port *port)

drivers/usb/serial/ir-usb.c

@@ -426,10 +426,7 @@ static void ir_write_bulk_callback (struct urb *urb)
 		urb->actual_length,
 		urb->transfer_buffer);
 
-	queue_task(&port->tqueue, &tq_immediate);
-	mark_bh(IMMEDIATE_BH);
-	
-	return;
+	schedule_task(&port->tqueue);
 }
 
 static void ir_read_bulk_callback (struct urb *urb)

drivers/usb/serial/keyspan.c

@@ -447,10 +447,8 @@ static void	usa2x_outdat_callback(struct urb *urb)
 	p_priv = (struct keyspan_port_private *)(port->private);
 	dbg ("%s - urb %d", __FUNCTION__, urb == p_priv->out_urbs[1]); 
 
-	if (port->open_count) {
-		queue_task(&port->tqueue, &tq_immediate);
-		mark_bh(IMMEDIATE_BH);
-	}
+	if (port->open_count)
+		schedule_task(&port->tqueue);
 }
 
 static void	usa26_inack_callback(struct urb *urb)

drivers/usb/serial/kl5kusb105.c

@@ -577,10 +577,7 @@ static void klsi_105_write_bulk_callback ( struct urb *urb)
 	}
 
 	/* from generic_write_bulk_callback */
-	queue_task(&port->tqueue, &tq_immediate);
-	mark_bh(IMMEDIATE_BH);
-
-	return;
+	schedule_task(&port->tqueue);
 } /* klsi_105_write_bulk_completion_callback */
 
 

drivers/usb/serial/mct_u232.c

@@ -507,8 +507,7 @@ static void mct_u232_write_bulk_callback (struct urb *urb)
 		
 	} else {
 		/* from generic_write_bulk_callback */
-		queue_task(&port->tqueue, &tq_immediate);
-		mark_bh(IMMEDIATE_BH);
+		schedule_task(&port->tqueue);
 	}
 
 	return;

drivers/usb/serial/omninet.c

@@ -359,12 +359,9 @@ static void omninet_write_bulk_callback (struct urb *urb)
 		return;
 	}
 
-	queue_task(&port->tqueue, &tq_immediate);
-	mark_bh(IMMEDIATE_BH);
+	schedule_task(&port->tqueue);
 
 //	dbg("omninet_write_bulk_callback, tty %0x\n", tty);
-
-	return;
 }
 
 

drivers/usb/serial/pl2303.c

@@ -705,10 +705,7 @@ static void pl2303_write_bulk_callback (struct urb *urb)
 		return;
 	}
 
-	queue_task(&port->tqueue, &tq_immediate);
-	mark_bh(IMMEDIATE_BH);
-
-	return;
+	schedule_task(&port->tqueue);
 }
 
 

drivers/usb/serial/usbserial.c

@@ -1092,10 +1092,7 @@ static void generic_write_bulk_callback (struct urb *urb)
 
 	usb_serial_port_softint((void *)port);
 
-	queue_task(&port->tqueue, &tq_immediate);
-	mark_bh(IMMEDIATE_BH);
-
-	return;
+	schedule_task(&port->tqueue);
 }
 
 static void generic_shutdown (struct usb_serial *serial)

drivers/usb/serial/visor.c

@@ -182,9 +182,10 @@ static struct usb_device_id id_table [] = {
 	{ USB_DEVICE(PALM_VENDOR_ID, PALM_M500_ID) },
 	{ USB_DEVICE(PALM_VENDOR_ID, PALM_M505_ID) },
 	{ USB_DEVICE(PALM_VENDOR_ID, PALM_M515_ID) },
+	{ USB_DEVICE(PALM_VENDOR_ID, PALM_I705_ID) },
 	{ USB_DEVICE(PALM_VENDOR_ID, PALM_M125_ID) },
 	{ USB_DEVICE(PALM_VENDOR_ID, PALM_M130_ID) },
-	{ USB_DEVICE(PALM_VENDOR_ID, PALM_I705_ID) },
+	{ USB_DEVICE(PALM_VENDOR_ID, PALM_ZIRE_ID) },
 	{ USB_DEVICE(HANDSPRING_VENDOR_ID, HANDSPRING_VISOR_ID) },
 	{ USB_DEVICE(SONY_VENDOR_ID, SONY_CLIE_4_0_ID) },
 	{ USB_DEVICE(SONY_VENDOR_ID, SONY_CLIE_S360_ID) },
@@ -202,9 +203,10 @@ static struct usb_device_id id_table_combined [] = {
 	{ USB_DEVICE(PALM_VENDOR_ID, PALM_M500_ID) },
 	{ USB_DEVICE(PALM_VENDOR_ID, PALM_M505_ID) },
 	{ USB_DEVICE(PALM_VENDOR_ID, PALM_M515_ID) },
+	{ USB_DEVICE(PALM_VENDOR_ID, PALM_I705_ID) },
 	{ USB_DEVICE(PALM_VENDOR_ID, PALM_M125_ID) },
 	{ USB_DEVICE(PALM_VENDOR_ID, PALM_M130_ID) },
-	{ USB_DEVICE(PALM_VENDOR_ID, PALM_I705_ID) },
+	{ USB_DEVICE(PALM_VENDOR_ID, PALM_ZIRE_ID) },
 	{ USB_DEVICE(SONY_VENDOR_ID, SONY_CLIE_3_5_ID) },
 	{ USB_DEVICE(SONY_VENDOR_ID, SONY_CLIE_4_0_ID) },
 	{ USB_DEVICE(SONY_VENDOR_ID, SONY_CLIE_S360_ID) },
@@ -458,10 +460,7 @@ static void visor_write_bulk_callback (struct urb *urb)
 	/* free up the transfer buffer, as usb_free_urb() does not do this */
 	kfree (urb->transfer_buffer);
 
-	queue_task(&port->tqueue, &tq_immediate);
-	mark_bh(IMMEDIATE_BH);
-
-	return;
+	schedule_task(&port->tqueue);
 }
 
 

drivers/usb/serial/visor.h

@@ -27,6 +27,7 @@
 #define PALM_I705_ID			0x0020
 #define PALM_M125_ID			0x0040
 #define PALM_M130_ID			0x0050
+#define PALM_ZIRE_ID			0x0070
 
 #define SONY_VENDOR_ID			0x054C
 #define SONY_CLIE_3_5_ID		0x0038

drivers/usb/serial/whiteheat.c

@@ -918,10 +918,7 @@ static void whiteheat_write_callback(struct urb *urb)
 
 	usb_serial_port_softint((void *)port);
 
-	queue_task(&port->tqueue, &tq_immediate);
-	mark_bh(IMMEDIATE_BH);
-
-	return;
+	schedule_task(&port->tqueue);
 }
 
 

drivers/usb/storage/transport.c

@@ -530,6 +530,8 @@ int usb_stor_clear_halt(struct us_data *us, int pipe)
 	if (result < 0)
 		return result;
 
+	printk(KERN_ERR "usb_stor_clear_halt() WORKED!\n");
+
 	/* reset the toggles and endpoint flags */
 	usb_endpoint_running(us->pusb_dev, usb_pipeendpoint(pipe),
 		usb_pipeout(pipe));

include/linux/usb.h

@@ -84,6 +84,7 @@
 #include <linux/list.h>		/* for struct list_head */
 #include <linux/device.h>	/* for struct device */
 #include <linux/fs.h>		/* for struct file_operations */
+#include <linux/completion.h>	/* for struct completion */
 
 
 static __inline__ void wait_ms(unsigned int ms)
@@ -452,9 +453,9 @@ static inline int usb_make_path (struct usb_device *dev, char *buf, size_t size)
  * User mode code can read these tables to choose which modules to load.
  * Declare the table as a MODULE_DEVICE_TABLE.
  *
- * The third probe() parameter will point to a matching entry from this
- * table.  (Null value reserved.)  Use the driver_data field for each
- * match to hold information tied to that match:  device quirks, etc.
+ * A probe() parameter will point to a matching entry from this table.
+ * Use the driver_info field for each match to hold information tied
+ * to that match:  device quirks, etc.
  *
  * Terminate the driver's table with an all-zeroes entry.
  * Use the flag values to control which fields are compared.
@@ -604,17 +605,14 @@ struct usb_device_id {
  * @name: The driver name should be unique among USB drivers,
  *	and should normally be the same as the module name.
  * @probe: Called to see if the driver is willing to manage a particular
- *	interface on a device.  The probe routine returns a handle that 
- *	will later be provided to disconnect(), or a null pointer to
- *	indicate that the driver will not handle the interface.
- *	The handle is normally a pointer to driver-specific data.
- *	If the probe() routine needs to access the interface
- *	structure itself, use usb_ifnum_to_if() to make sure it's using
- *	the right one.
+ *	interface on a device.  If it is, probe returns zero and uses
+ *	dev_set_drvdata() to associate driver-specific data with the
+ *	interface.  It may also use usb_set_interface() to specify the
+ *	appropriate altsetting.  If unwilling to manage the interface,
+ *	return a negative errno value.
  * @disconnect: Called when the interface is no longer accessible, usually
- *	because its device has been (or is being) disconnected.  The
- *	handle passed is what was returned by probe(), or was provided
- *	to usb_driver_claim_interface().
+ *	because its device has been (or is being) disconnected or the
+ *	driver module is being unloaded.
  * @ioctl: Used for drivers that want to talk to userspace through
  *	the "usbfs" filesystem.  This lets devices provide ways to
  *	expose information to user space regardless of where they
@@ -648,7 +646,7 @@ struct usb_driver {
 
 	void (*disconnect) (struct usb_interface *intf);
 
-	int (*ioctl) (struct usb_device *dev, unsigned int code, void *buf);
+	int (*ioctl) (struct usb_interface *intf, unsigned int code, void *buf);
 
 	const struct usb_device_id *id_table;
 
@@ -1074,6 +1072,57 @@ extern int usb_set_interface(struct usb_device *dev, int ifnum, int alternate);
 
 #define USB_CTRL_SET_TIMEOUT	3
 
+
+/**
+ * struct usb_sg_request - support for scatter/gather I/O
+ * @status: zero indicates success, else negative errno
+ * @bytes: counts bytes transferred.
+ *
+ * These requests are initialized using usb_sg_init(), and then are used
+ * as request handles passed to usb_sg_wait() or usb_sg_cancel().  Most
+ * members of the request object aren't for driver access.
+ *
+ * The status and bytecount values are valid only after usb_sg_wait()
+ * returns.  If the status is zero, then the bytecount matches the total
+ * from the request.
+ *
+ * After an error completion, drivers may need to clear a halt condition
+ * on the endpoint.
+ */
+struct usb_sg_request {
+	int			status;
+	size_t			bytes;
+
+	// members not documented above are private to usbcore,
+	// and are not provided for driver access!
+	spinlock_t		lock;
+
+	struct usb_device	*dev;
+	int			pipe;
+	struct scatterlist	*sg;
+	int			nents;
+
+	int			entries;
+	struct urb		**urbs;
+
+	int			count;
+	struct completion	complete;
+};
+
+int usb_sg_init (
+	struct usb_sg_request	*io,
+	struct usb_device	*dev,
+	unsigned		pipe, 
+	unsigned		period,
+	struct scatterlist	*sg,
+	int			nents,
+	size_t			length,
+	int			mem_flags
+);
+void usb_sg_cancel (struct usb_sg_request *io);
+void usb_sg_wait (struct usb_sg_request *io);
+
+
 /* -------------------------------------------------------------------------- */
 
 /*

include/linux/usbdevice_fs.h

@@ -108,7 +108,7 @@ struct usbdevfs_urb {
 	struct usbdevfs_iso_packet_desc iso_frame_desc[0];
 };
 
-/* ioctls for talking to drivers in the usbcore module: */
+/* ioctls for talking directly to drivers */
 struct usbdevfs_ioctl {
 	int	ifno;		/* interface 0..N ; negative numbers reserved */
 	int	ioctl_code;	/* MUST encode size + direction of data so the