Merge bk://linuxusb.bkbits.net/linus-2.5

into penguin.transmeta.com:/home/penguin/torvalds/repositories/kernel/linux

drivers/usb/hcd/Config.help

@@ -21,7 +21,6 @@ CONFIG_USB_EHCI_HCD
   The module will be called ehci-hcd.o. If you want to compile it as a
   module, say M here and read <file:Documentation/modules.txt>.
 
-OHCI (most USB hosts except VIA, Intel PIIX) support
 CONFIG_USB_OHCI_HCD
   The Open Host Controller Interface (OHCI) is a standard for accessing
   USB 1.1 host controller hardware.  It does more in hardware than Intel's

drivers/usb/hub.c

@@ -644,6 +644,49 @@ void usb_hub_port_disable(struct usb_device *hub, int port)
 			port + 1, hub->devpath, ret);
 }
 
+/* USB 2.0 spec, 7.1.7.3 / fig 7-29:
+ *
+ * Between connect detection and reset signaling there must be a delay
+ * of 100ms at least for debounce and power-settling. The corresponding
+ * timer shall restart whenever the downstream port detects a disconnect.
+ * 
+ * Apparently there are some bluetooth and irda-dongles and a number
+ * of low-speed devices which require longer delays of about 200-400ms.
+ * Not covered by the spec - but easy to deal with.
+ *
+ * This implementation uses 400ms minimum debounce timeout and checks
+ * every 10ms for transient disconnects to restart the delay.
+ */
+
+#define HUB_DEBOUNCE_TIMEOUT	400
+#define HUB_DEBOUNCE_STEP	10
+
+/* return: -1 on error, 0 on success, 1 on disconnect.  */
+static int usb_hub_port_debounce(struct usb_device *hub, int port)
+{
+	int ret;
+	unsigned delay_time;
+	u16 portchange, portstatus;
+
+	for (delay_time = 0; delay_time < HUB_DEBOUNCE_TIMEOUT; /* empty */ ) {
+
+		/* wait debounce step increment */
+		wait_ms(HUB_DEBOUNCE_STEP);
+
+		ret = usb_hub_port_status(hub, port, &portstatus, &portchange);
+		if (ret < 0)
+			return -1;
+
+		if ((portchange & USB_PORT_STAT_C_CONNECTION)) {
+			usb_clear_port_feature(hub, port+1, USB_PORT_FEAT_C_CONNECTION);
+			delay_time = 0;
+		}
+		else
+			delay_time += HUB_DEBOUNCE_STEP;
+	}
+	return ((portstatus&USB_PORT_STAT_CONNECTION)) ? 0 : 1;
+}
+
 static void usb_hub_port_connect_change(struct usb_hub *hubstate, int port,
 					u16 portstatus, u16 portchange)
 {
@@ -671,12 +714,16 @@ static void usb_hub_port_connect_change(struct usb_hub *hubstate, int port,
 		return;
 	}
 
+	if (usb_hub_port_debounce(hub, port)) {
+		err("connect-debounce failed, port %d disabled", port+1);
+		usb_hub_port_disable(hub, port);
+		return;
+	}
+
 	/* Some low speed devices have problems with the quick delay, so */
 	/*  be a bit pessimistic with those devices. RHbug #23670 */
-	if (portstatus & USB_PORT_STAT_LOW_SPEED) {
-		wait_ms(400);
+	if (portstatus & USB_PORT_STAT_LOW_SPEED)
 		delay = HUB_LONG_RESET_TIME;
-	}
 
 	down(&usb_address0_sem);
 

drivers/usb/ov511.h

@@ -9,11 +9,11 @@
 #define OV511_DEBUG	/* Turn on debug messages */
 
 #ifdef OV511_DEBUG
-#  define PDEBUG(level, fmt, args...) \
-if (debug >= (level)) info("[" __PRETTY_FUNCTION__ ":%d] " fmt, __LINE__ , \
-	## args)
+	#define PDEBUG(level, fmt, args...) \
+		if (debug >= (level)) info("[" __PRETTY_FUNCTION__ ":%d] " fmt,\
+		__LINE__ , ## args)
 #else
-#  define PDEBUG(level, fmt, args...) do {} while(0)
+	#define PDEBUG(level, fmt, args...) do {} while(0)
 #endif
 
 /* This macro restricts an int variable to an inclusive range */
@@ -36,98 +36,105 @@ if (debug >= (level)) info("[" __PRETTY_FUNCTION__ ":%d] " fmt, __LINE__ , \
 #define VEND_MATTEL	0x0813
 #define PROD_ME2CAM	0x0002
 
+/* --------------------------------- */
+/*     OV51x REGISTER MNEMONICS      */
+/* --------------------------------- */
+
 /* Camera interface register numbers */
-#define OV511_REG_CAMERA_DELAY_MODE		0x10
-#define OV511_REG_CAMERA_EDGE_MODE		0x11
-#define OV511_REG_CAMERA_CLAMPED_PIXEL_NUM	0x12
-#define OV511_REG_CAMERA_CLAMPED_LINE_NUM	0x13
-#define OV511_REG_CAMERA_PIXEL_DIVISOR		0x14
-#define OV511_REG_CAMERA_LINE_DIVISOR		0x15
-#define OV511_REG_CAMERA_DATA_INPUT_SELECT	0x16
-#define OV511_REG_CAMERA_RESERVED_LINE_MODE	0x17
-#define OV511_REG_CAMERA_BITMASK		0x18
+#define R511_CAM_DELAY		0x10
+#define R511_CAM_EDGE		0x11
+#define R511_CAM_PXCNT		0x12
+#define R511_CAM_LNCNT		0x13
+#define R511_CAM_PXDIV		0x14
+#define R511_CAM_LNDIV		0x15
+#define R511_CAM_UV_EN		0x16
+#define R511_CAM_LINE_MODE	0x17
+#define R511_CAM_OPTS		0x18
 
 /* Snapshot mode camera interface register numbers */
-#define OV511_REG_SNAP_CAPTURED_FRAME		0x19
-#define OV511_REG_SNAP_CLAMPED_PIXEL_NUM	0x1A
-#define OV511_REG_SNAP_CLAMPED_LINE_NUM		0x1B
-#define OV511_REG_SNAP_PIXEL_DIVISOR		0x1C
-#define OV511_REG_SNAP_LINE_DIVISOR		0x1D
-#define OV511_REG_SNAP_DATA_INPUT_SELECT	0x1E
-#define OV511_REG_SNAP_BITMASK			0x1F
+#define R511_SNAP_FRAME		0x19
+#define R511_SNAP_PXCNT		0x1A
+#define R511_SNAP_LNCNT		0x1B
+#define R511_SNAP_PXDIV		0x1C
+#define R511_SNAP_LNDIV		0x1D
+#define R511_SNAP_UV_EN		0x1E
+#define R511_SNAP_OPTS		0x1F
 
 /* DRAM register numbers */
-#define OV511_REG_DRAM_ENABLE_FLOW_CONTROL	0x20
-#define OV511_REG_DRAM_READ_CYCLE_PREDICT	0x21
-#define OV511_REG_DRAM_MANUAL_READ_CYCLE	0x22
-#define OV511_REG_DRAM_REFRESH_COUNTER		0x23
+#define R511_DRAM_FLOW_CTL	0x20
+#define R511_DRAM_ARCP		0x21
+#define R511_DRAM_MRC		0x22
+#define R511_DRAM_RFC		0x23
 
 /* ISO FIFO register numbers */
-#define OV511_REG_FIFO_PACKET_SIZE		0x30
-#define OV511_REG_FIFO_BITMASK			0x31
-
-/* PIO register numbers */
-#define OV511_REG_PIO_BITMASK			0x38
-#define OV511_REG_PIO_DATA_PORT			0x39
-#define OV511_REG_PIO_BIST			0x3E
-
-/* I2C register numbers */
-#define OV511_REG_I2C_CONTROL			0x40
-#define OV518_REG_I2C_CONTROL			0x47	/* OV518(+) only */
-#define OV511_REG_I2C_SLAVE_ID_WRITE		0x41
-#define OV511_REG_I2C_SUB_ADDRESS_3_BYTE	0x42
-#define OV511_REG_I2C_SUB_ADDRESS_2_BYTE	0x43
-#define OV511_REG_I2C_SLAVE_ID_READ		0x44
-#define OV511_REG_I2C_DATA_PORT			0x45
-#define OV511_REG_I2C_CLOCK_PRESCALER		0x46
-#define OV511_REG_I2C_TIME_OUT_COUNTER		0x47
-
-/* I2C snapshot register numbers */
-#define OV511_REG_I2C_SNAP_SUB_ADDRESS		0x48
-#define OV511_REG_I2C_SNAP_DATA_PORT		0x49
-
-/* System control register numbers */
-#define OV511_REG_SYSTEM_RESET			0x50
-#define 	OV511_RESET_UDC			0x01
-#define 	OV511_RESET_I2C			0x02
-#define 	OV511_RESET_FIFO		0x04
-#define 	OV511_RESET_OMNICE		0x08
-#define 	OV511_RESET_DRAM_INTF		0x10
-#define 	OV511_RESET_CAMERA_INTF		0x20
-#define 	OV511_RESET_OV511		0x40
-#define 	OV511_RESET_NOREGS		0x3F /* All but OV511 & regs */
-#define 	OV511_RESET_ALL			0x7F
-#define OV511_REG_SYSTEM_CLOCK_DIVISOR		0x51
-#define OV511_REG_SYSTEM_SNAPSHOT		0x52
-#define OV511_REG_SYSTEM_INIT         		0x53
-#define OV511_REG_SYSTEM_PWR_CLK		0x54 /* OV511+/OV518(+) only */
-#define OV511_REG_SYSTEM_LED_CTL		0x55	/* OV511+ only */
-#define OV518_REG_GPIO_IN			0x55	/* OV518(+) only */
-#define OV518_REG_GPIO_OUT			0x56	/* OV518(+) only */
-#define OV518_REG_GPIO_CTL			0x57	/* OV518(+) only */
-#define OV518_REG_GPIO_PULSE_IN			0x58	/* OV518(+) only */
-#define OV518_REG_GPIO_PULSE_CLEAR		0x59	/* OV518(+) only */
-#define OV518_REG_GPIO_PULSE_POLARITY		0x5a	/* OV518(+) only */
-#define OV518_REG_GPIO_PULSE_EN			0x5b	/* OV518(+) only */
-#define OV518_REG_GPIO_RESET			0x5c	/* OV518(+) only */
-#define OV511_REG_SYSTEM_USER_DEFINED		0x5E
-#define OV511_REG_SYSTEM_CUSTOM_ID		0x5F
-
-/* OmniCE register numbers */
-#define OV511_OMNICE_PREDICTION_HORIZ_Y		0x70
-#define OV511_OMNICE_PREDICTION_HORIZ_UV	0x71
-#define OV511_OMNICE_PREDICTION_VERT_Y		0x72
-#define OV511_OMNICE_PREDICTION_VERT_UV		0x73
-#define OV511_OMNICE_QUANTIZATION_HORIZ_Y	0x74
-#define OV511_OMNICE_QUANTIZATION_HORIZ_UV	0x75
-#define OV511_OMNICE_QUANTIZATION_VERT_Y	0x76
-#define OV511_OMNICE_QUANTIZATION_VERT_UV	0x77
-#define OV511_OMNICE_ENABLE			0x78
-#define OV511_OMNICE_LUT_ENABLE			0x79		
-#define OV511_OMNICE_Y_LUT_BEGIN		0x80
-#define OV511_OMNICE_Y_LUT_END			0x9F
-#define OV511_OMNICE_UV_LUT_BEGIN		0xA0
-#define OV511_OMNICE_UV_LUT_END			0xBF
+#define R51x_FIFO_PSIZE		0x30	/* 2 bytes wide w/ OV518(+) */
+#define R511_FIFO_OPTS		0x31
+
+/* Parallel IO register numbers */
+#define R511_PIO_OPTS		0x38
+#define R511_PIO_DATA		0x39
+#define R511_PIO_BIST		0x3E
+#define R518_GPIO_IN		0x55	/* OV518(+) only */
+#define R518_GPIO_OUT		0x56	/* OV518(+) only */
+#define R518_GPIO_CTL		0x57	/* OV518(+) only */
+#define R518_GPIO_PULSE_IN	0x58	/* OV518(+) only */
+#define R518_GPIO_PULSE_CLEAR	0x59	/* OV518(+) only */
+#define R518_GPIO_PULSE_POL	0x5a	/* OV518(+) only */
+#define R518_GPIO_PULSE_EN	0x5b	/* OV518(+) only */
+#define R518_GPIO_RESET		0x5c	/* OV518(+) only */
+
+/* I2C registers */
+#define R511_I2C_CTL		0x40
+#define R518_I2C_CTL		0x47	/* OV518(+) only */
+#define R51x_I2C_W_SID		0x41
+#define R51x_I2C_SADDR_3	0x42
+#define R51x_I2C_SADDR_2	0x43
+#define R51x_I2C_R_SID		0x44
+#define R51x_I2C_DATA		0x45
+#define R51x_I2C_CLOCK		0x46
+#define R51x_I2C_TIMEOUT	0x47
+
+/* I2C snapshot registers */
+#define R511_SI2C_SADDR_3	0x48
+#define R511_SI2C_DATA		0x49
+
+/* System control registers */
+#define R51x_SYS_RESET		0x50
+		/* Reset type definitions */
+#define 	OV511_RESET_UDC		0x01
+#define 	OV511_RESET_I2C		0x02
+#define 	OV511_RESET_FIFO	0x04
+#define 	OV511_RESET_OMNICE	0x08
+#define 	OV511_RESET_DRAM	0x10
+#define 	OV511_RESET_CAM_INT	0x20
+#define 	OV511_RESET_OV511	0x40
+#define 	OV511_RESET_NOREGS	0x3F /* All but OV511 & regs */
+#define 	OV511_RESET_ALL		0x7F
+
+#define R511_SYS_CLOCK_DIV	0x51
+#define R51x_SYS_SNAP		0x52
+#define R51x_SYS_INIT         	0x53
+#define R511_SYS_PWR_CLK	0x54 /* OV511+/OV518(+) only */
+#define R511_SYS_LED_CTL	0x55 /* OV511+ only */
+#define R511_SYS_USER		0x5E
+#define R511_SYS_CUST_ID	0x5F
+
+/* OmniCE (compression) registers */
+#define R511_COMP_PHY		0x70
+#define R511_COMP_PHUV		0x71
+#define R511_COMP_PVY		0x72
+#define R511_COMP_PVUV		0x73
+#define R511_COMP_QHY		0x74
+#define R511_COMP_QHUV		0x75
+#define R511_COMP_QVY		0x76
+#define R511_COMP_QVUV		0x77
+#define R511_COMP_EN		0x78
+#define R511_COMP_LUT_EN	0x79		
+#define R511_COMP_LUT_BEGIN	0x80
+
+/* --------------------------------- */
+/*         ALTERNATE NUMBERS         */
+/* --------------------------------- */
 
 /* Alternate numbers for various max packet sizes (OV511 only) */
 #define OV511_ALT_SIZE_992	0
@@ -159,6 +166,10 @@ if (debug >= (level)) info("[" __PRETTY_FUNCTION__ ":%d] " fmt, __LINE__ , \
 #define OV518_ALT_SIZE_768	6
 #define OV518_ALT_SIZE_896	7
 
+/* --------------------------------- */
+/*     OV7610 REGISTER MNEMONICS     */
+/* --------------------------------- */
+
 /* OV7610 registers */
 #define OV7610_REG_GAIN          0x00	/* gain setting (5:0) */
 #define OV7610_REG_BLUE          0x01	/* blue channel balance */
@@ -210,26 +221,27 @@ if (debug >= (level)) info("[" __PRETTY_FUNCTION__ ":%d] " fmt, __LINE__ , \
 					/* 36-37 reserved */
 #define OV7610_REG_COM_K         0x38	/* misc registers */
 
+/* --------------------------------- */
+/*           I2C ADDRESSES           */
+/* --------------------------------- */
+
+#define OV7xx0_SID   0x42
+#define OV6xx0_SID   0xC0
+#define OV8xx0_SID   0xA0
+#define KS0127_SID   0xD8
+#define SAA7111A_SID 0x48
+
+/* --------------------------------- */
+/*       MISCELLANEOUS DEFINES       */
+/* --------------------------------- */
+
+#define I2C_CLOCK_PRESCALER 	0x03
+
 #define FRAMES_PER_DESC		10	/* FIXME - What should this be? */
-#define FRAME_SIZE_PER_DESC	993	/* FIXME - Deprecated */
 #define MAX_FRAME_SIZE_PER_DESC	993	/* For statically allocated stuff */
 #define PIXELS_PER_SEG		256	/* Pixels per segment */
 
-#define OV511_ENDPOINT_ADDRESS 1	/* Isoc endpoint number */
-
-/* I2C addresses */
-#define OV7xx0_I2C_WRITE_ID   0x42
-#define OV7xx0_I2C_READ_ID    0x43
-#define OV6xx0_I2C_WRITE_ID   0xC0
-#define OV6xx0_I2C_READ_ID    0xC1
-#define OV8xx0_I2C_WRITE_ID   0xA0
-#define OV8xx0_I2C_READ_ID    0xA1
-#define KS0127_I2C_WRITE_ID   0xD8
-#define KS0127_I2C_READ_ID    0xD9
-#define SAA7111A_I2C_WRITE_ID 0x48
-#define SAA7111A_I2C_READ_ID  0x49
-
-#define OV511_I2C_CLOCK_PRESCALER 0x03
+#define OV511_ENDPOINT_ADDRESS	1	/* Isoc endpoint number */
 
 /* Bridge types */
 enum {
@@ -429,11 +441,14 @@ struct ov51x_decomp_ops {
 
 #define OV511_NUMFRAMES	2
 #if OV511_NUMFRAMES > VIDEO_MAX_FRAME
-#error "OV511_NUMFRAMES is too high"
+	#error "OV511_NUMFRAMES is too high"
 #endif
 
 #define OV511_NUMSBUF		2
 
+/* Control transfers use up to 4 bytes */
+#define OV511_CBUF_SIZE		4
+
 struct usb_ov511 {
 	struct video_device vdev;
 
@@ -535,6 +550,10 @@ struct usb_ov511 {
 	/* I2C interface to kernel */
 	struct semaphore i2c_lock;	  /* Protect I2C controller regs */
 	unsigned char primary_i2c_slave;  /* I2C write id of sensor */
+
+	/* Control transaction stuff */
+	unsigned char *cbuf;		/* Buffer for payload */
+	struct semaphore cbuf_lock;
 };
 
 struct cam_list {

drivers/usb/uhci.h

@@ -121,15 +121,16 @@ struct uhci_qh {
  * for TD <info>: (a.k.a. Token)
  */
 #define TD_TOKEN_TOGGLE		19
-#define TD_PID			0xFF
+#define TD_TOKEN_PID_MASK	0xFF
+#define TD_TOKEN_EXPLEN_MASK	0x7FF		/* expected length, encoded as n - 1 */
 
 #define uhci_maxlen(token)	((token) >> 21)
-#define uhci_expected_length(info) (((info >> 21) + 1) & TD_CTRL_ACTLEN_MASK) /* 1-based */
+#define uhci_expected_length(info) (((info >> 21) + 1) & TD_TOKEN_EXPLEN_MASK) /* 1-based */
 #define uhci_toggle(token)	(((token) >> TD_TOKEN_TOGGLE) & 1)
 #define uhci_endpoint(token)	(((token) >> 15) & 0xf)
 #define uhci_devaddr(token)	(((token) >> 8) & 0x7f)
 #define uhci_devep(token)	(((token) >> 8) & 0x7ff)
-#define uhci_packetid(token)	((token) & 0xff)
+#define uhci_packetid(token)	((token) & TD_TOKEN_PID_MASK)
 #define uhci_packetout(token)	(uhci_packetid(token) != USB_PID_IN)
 #define uhci_packetin(token)	(uhci_packetid(token) == USB_PID_IN)
 
@@ -163,7 +164,7 @@ struct uhci_td {
 	struct list_head list;		/* P: urb->lock */
 
 	int frame;
-	struct list_head fl_list;	/* P: frame_list_lock */
+	struct list_head fl_list;	/* P: uhci->frame_list_lock */
 } __attribute__((aligned(16)));
 
 /*
@@ -306,21 +307,25 @@ struct uhci {
 	struct uhci_qh *skelqh[UHCI_NUM_SKELQH];	/* Skeleton QH's */
 
 	spinlock_t frame_list_lock;
-	struct uhci_frame_list *fl;		/* Frame list */
+	struct uhci_frame_list *fl;		/* P: uhci->frame_list_lock */
 	int fsbr;				/* Full speed bandwidth reclamation */
 	int is_suspended;
 
+	/* Main list of URB's currently controlled by this HC */
+	spinlock_t urb_list_lock;
+	struct list_head urb_list;		/* P: uhci->urb_list_lock */
+
+	/* List of QH's that are done, but waiting to be unlinked (race) */
 	spinlock_t qh_remove_list_lock;
-	struct list_head qh_remove_list;
+	struct list_head qh_remove_list;	/* P: uhci->qh_remove_list_lock */
 
+	/* List of asynchronously unlinked URB's */
 	spinlock_t urb_remove_list_lock;
-	struct list_head urb_remove_list;
-
-	spinlock_t urb_list_lock;
-	struct list_head urb_list;
+	struct list_head urb_remove_list;	/* P: uhci->urb_remove_list_lock */
 
+	/* List of URB's awaiting completion callback */
 	spinlock_t complete_list_lock;
-	struct list_head complete_list;
+	struct list_head complete_list;		/* P: uhci->complete_list_lock */
 
 	struct virt_root_hub rh;	/* private data of the virtual root hub */
 };
@@ -333,7 +338,7 @@ struct urb_priv {
 	dma_addr_t transfer_buffer_dma_handle;
 
 	struct uhci_qh *qh;		/* QH for this URB */
-	struct list_head td_list;
+	struct list_head td_list;	/* P: urb->lock */
 
 	int fsbr : 1;			/* URB turned on FSBR */
 	int fsbr_timeout : 1;		/* URB timed out on FSBR */
@@ -345,12 +350,37 @@ struct urb_priv {
 	int status;			/* Final status */
 
 	unsigned long inserttime;	/* In jiffies */
-	unsigned long fsbrtime;	/* In jiffies */
+	unsigned long fsbrtime;		/* In jiffies */
 
-	struct list_head queue_list;
-	struct list_head complete_list;
+	struct list_head queue_list;	/* P: uhci->frame_list_lock */
+	struct list_head complete_list;	/* P: uhci->complete_list_lock */
 };
 
+/*
+ * Locking in uhci.c
+ *
+ * spinlocks are used extensively to protect the many lists and data
+ * structures we have. It's not that pretty, but it's necessary. We
+ * need to be done with all of the locks (except complete_list_lock) when
+ * we call urb->complete. I've tried to make it simple enough so I don't
+ * have to spend hours racking my brain trying to figure out if the
+ * locking is safe.
+ *
+ * Here's the safe locking order to prevent deadlocks:
+ *
+ * #1 uhci->urb_list_lock
+ * #2 urb->lock
+ * #3 uhci->urb_remove_list_lock, uhci->frame_list_lock, 
+ *   uhci->qh_remove_list_lock
+ * #4 uhci->complete_list_lock
+ *
+ * If you're going to grab 2 or more locks at once, ALWAYS grab the lock
+ * at the lowest level FIRST and NEVER grab locks at the same level at the
+ * same time.
+ * 
+ * So, if you need uhci->urb_list_lock, grab it before you grab urb->lock
+ */
+
 /* -------------------------------------------------------------------------
    Virtual Root HUB
    ------------------------------------------------------------------------- */

drivers/usb/usb-ohci.c

@@ -205,6 +205,7 @@ static void urb_rm_priv_locked (struct urb * urb)
 		urb_free_priv ((struct ohci *)urb->dev->bus->hcpriv, urb_priv);
 		usb_dec_dev_use (urb->dev);
 		urb->dev = NULL;
+		usb_put_urb (urb);
 	}
 }
 
@@ -553,6 +554,9 @@ static int sohci_submit_urb (struct urb * urb, int mem_flags)
 //	if(usb_endpoint_halted (urb->dev, usb_pipeendpoint (pipe), usb_pipeout (pipe))) 
 //		return -EPIPE;
 	
+	/* increment the reference count of the urb, as we now also control it */
+	urb = usb_get_urb (urb);
+
 	usb_inc_dev_use (urb->dev);
 	ohci = (ohci_t *) urb->dev->bus->hcpriv;
 	
@@ -568,12 +572,14 @@ static int sohci_submit_urb (struct urb * urb, int mem_flags)
 	 * such as powering down ports */
 	if (ohci->disabled) {
 		usb_dec_dev_use (urb->dev);	
+		usb_put_urb (urb);
 		return -ESHUTDOWN;
 	}
 
 	/* every endpoint has a ed, locate and fill it */
 	if (!(ed = ep_add_ed (urb->dev, pipe, urb->interval, 1, mem_flags))) {
 		usb_dec_dev_use (urb->dev);	
+		usb_put_urb (urb);
 		return -ENOMEM;
 	}
 
@@ -595,6 +601,7 @@ static int sohci_submit_urb (struct urb * urb, int mem_flags)
 			size = urb->number_of_packets;
 			if (size <= 0) {
 				usb_dec_dev_use (urb->dev);	
+				usb_put_urb (urb);
 				return -EINVAL;
 			}
 			for (i = 0; i < urb->number_of_packets; i++) {
@@ -615,6 +622,7 @@ static int sohci_submit_urb (struct urb * urb, int mem_flags)
 	urb_priv = kmalloc (sizeof (urb_priv_t) + size * sizeof (td_t *), mem_flags);
 	if (!urb_priv) {
 		usb_dec_dev_use (urb->dev);	
+		usb_put_urb (urb);
 		return -ENOMEM;
 	}
 	memset (urb_priv, 0, sizeof (urb_priv_t) + size * sizeof (td_t *));
@@ -632,6 +640,7 @@ static int sohci_submit_urb (struct urb * urb, int mem_flags)
 			urb_free_priv (ohci, urb_priv);
 			spin_unlock_irqrestore (&usb_ed_lock, flags);
 			usb_dec_dev_use (urb->dev);	
+			usb_put_urb (urb);
 			return -ENOMEM;
 		}
 	}	
@@ -640,6 +649,7 @@ static int sohci_submit_urb (struct urb * urb, int mem_flags)
 		urb_free_priv (ohci, urb_priv);
 		spin_unlock_irqrestore (&usb_ed_lock, flags);
 		usb_dec_dev_use (urb->dev);	
+		usb_put_urb (urb);
 		return -EINVAL;
 	}
 	
@@ -662,6 +672,7 @@ static int sohci_submit_urb (struct urb * urb, int mem_flags)
 				urb_free_priv (ohci, urb_priv);
 				spin_unlock_irqrestore (&usb_ed_lock, flags);
 				usb_dec_dev_use (urb->dev);	
+				usb_put_urb (urb);
 				return bustime;
 			}
 			usb_claim_bandwidth (urb->dev, urb, bustime, usb_pipeisoc (urb->pipe));
@@ -2100,6 +2111,7 @@ static int rh_submit_urb (struct urb * urb)
 	urb->dev = NULL;
 	if (urb->complete)
 	    	urb->complete (urb);
+	usb_put_urb (urb);
 	return 0;
 }
 
@@ -2123,6 +2135,7 @@ static int rh_unlink_urb (struct urb * urb)
 				urb->complete (urb);
 		} else
 			urb->status = -ENOENT;
+		usb_put_urb (urb);
 	}
 	return 0;
 }

drivers/usb/usb-uhci.c

@@ -1217,6 +1217,7 @@ _static int uhci_unlink_urb_sync (uhci_t *s, struct urb *urb)
 			urb->complete ((struct urb *) urb);
 		}
 		usb_dec_dev_use (usb_dev);
+		usb_put_urb (urb);
 	}
 	else
 		spin_unlock_irqrestore (&s->urb_list_lock, flags);
@@ -1305,7 +1306,7 @@ _static void uhci_cleanup_unlink(uhci_t *s, int force)
 #else
 			kfree (urb_priv);
 #endif
-
+			usb_put_urb (urb);
 		}
 	}
 }
@@ -1650,6 +1651,9 @@ _static int uhci_submit_urb (struct urb *urb, int mem_flags)
 		return -EINVAL;
 	}
 
+	/* increment the reference count of the urb, as we now also control it */
+	urb = usb_get_urb (urb);
+
 	usb_inc_dev_use (urb->dev);
 
 	spin_lock_irqsave (&s->urb_list_lock, flags);
@@ -1665,6 +1669,7 @@ _static int uhci_submit_urb (struct urb *urb, int mem_flags)
 		     (!(urb->transfer_flags & USB_QUEUE_BULK) || !(queued_urb->transfer_flags & USB_QUEUE_BULK)))) {
 			spin_unlock_irqrestore (&s->urb_list_lock, flags);
 			usb_dec_dev_use (urb->dev);
+			usb_put_urb (urb);
 			err("ENXIO %08x, flags %x, urb %p, burb %p",urb->pipe,urb->transfer_flags,urb,queued_urb);
 			return -ENXIO;	// urb already queued
 		}
@@ -1678,6 +1683,7 @@ _static int uhci_submit_urb (struct urb *urb, int mem_flags)
 	if (!urb_priv) {
 		usb_dec_dev_use (urb->dev);
 		spin_unlock_irqrestore (&s->urb_list_lock, flags);
+		usb_put_urb (urb);
 		return -ENOMEM;
 	}
 
@@ -1766,6 +1772,7 @@ _static int uhci_submit_urb (struct urb *urb, int mem_flags)
 #else
 		kfree (urb_priv);
 #endif
+		usb_put_urb (urb);
 		return ret;
 	}
 
@@ -2730,6 +2737,7 @@ _static int process_urb (uhci_t *s, struct list_head *p)
 			}
 			
 			usb_dec_dev_use (usb_dev);
+			usb_put_urb (urb);
 		}
 	}
 

drivers/usb/vicam.c

@@ -40,6 +40,8 @@
 #include <linux/errno.h>
 #include <linux/poll.h>
 #include <linux/init.h>
+#include <linux/mm.h>
+#include <linux/pagemap.h>
 #include <linux/slab.h>
 #include <linux/fcntl.h>
 #include <linux/module.h>